note 54658 rejected from function.mssql-get-last-message by nlopess

Note Submitter: deniomariz at gmail dot com ---- I'm trying to build a demo of SQL Injection (SI) to discuss with my students. The idea is discuss how to avoid SI using some secure code techiques. I'm using PHP 4.3.11 and MSSQL 80 on a windows XP box. Sometimes a multiline query is submitted to the server, something like this: -------------------- use sales; select name from users; drop table xxx; -------------------- Note the query above has in fact three queries, each one producing a message but the function mssql_get_last_message() aparently doesn't return all of them to the user. Capturing the packets during connection I can see all messages returning from the server, like this: ----------- (1) Changed database context to 'sales' (2) <result set here> (3) Cannot drop the table 'xxx', because it does not exist in the system catalog. ---------------- But only the first message is returned from mssql_get_last_message(). Can anyone help to explain this ? Thanks.