note 49972 added to security.database.sql-injection

In reference to: Example 27-2. Splitting the result set into pages ... and making superusers (PostgreSQL and MySQL) This example seems to want to give an example of how someone can inject another SQL statement (rather than a subquery, or whatever other technique) into the intended SQL statement. I'm not sure about the PostgreSQL part, but the MySQL part is misleading. The 2nd grey box seems to say that if you put: 0; UPDATE user SET Password=PASSWORD('crack') WHERE user='root'; FLUSH PRIVILEGES; into $offset: $query = "SELECT id, name FROM products ORDER BY name LIMIT 20 OFFSET $offset;"; then mysql_query(); will execute it. But mysql_query() doesn't execute mulitiple statements. So, I think this is poor example and quite misleading -- causing someone not familiar with MySQL to believe mysql_query() executes mulitple SQL statements. ---- Manual Page -- http://www.php.net/manual/en/security.database.sql-injection.php Edit -- http://master.php.net/manage/user-notes.php?action=edit+49972 Delete: added to the manual -- http://master.php.net/manage/user-notes.php?action=delete+49972&report=yes&reason=added+to+the+manual Delete: bad code -- http://master.php.net/manage/user-notes.php?action=delete+49972&report=yes&reason=bad+code Delete: spam -- http://master.php.net/manage/user-notes.php?action=delete+49972&report=yes&reason=spam Delete: useless -- http://master.php.net/manage/user-notes.php?action=delete+49972&report=yes&reason=useless Delete: other reasons -- http://master.php.net/manage/user-notes.php?action=delete+49972&report=yes Reject -- http://master.php.net/manage/user-notes.php?action=reject+49972&report=yes Search -- http://master.php.net/manage/user-notes.php