title: SQL injection on INSERT
body: <p>The SQL Injection on INSERT as described here doesn't seem to work with MySQL.
  <a href="https://stackoverflow.com/questions/681583/sql-injection-on-insert/6784869#6784869">SQL injection on INSERT</a></p>
  
  <p>When I use this statement:</p>
  
  <p><code>INSERT INTO COMMENTS VALUES('122','$_GET[value1]');</code></p>
  
  <p>With this as the 'value1' variable value:</p>
  
  <p><code>'); DELETE FROM users; --</code></p>
  
  <p>This error gets returned:</p>
  
  <p><code>Error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'DELETE FROM users; --')' at line 1</code></p>
  
  <p>What's wrong???</p>
  
  <p>PS: Someone suggested me to do an SQL injection with this as variable value: </p>
  
  <p><code>',(SELECT group_concat(table_name) FROM information_schema.tables INTO OUTFILE '/var/www/tables.txt'))-- -</code> </p>
  
  <p>But it didn't work either, and returned a syntax error.</p>