This question is to settle an argument between me and a coworker.

Let's say we have the following query, executed on a standard LAMP server.

```
SELECT field1, field2, field3
FROM some_table
WHERE some_table.field1 = 123
ORDER BY field2 DESC
LIMIT 0, 15

```

Now let's assume the limit clause is vulnerable to SQL injection.

```
LIMIT [insert anything here], [also insert anything here]

```

The point of my coworker is that there is no way to exploit this injection, so there's no need to escape it (since it take more processing power and stuff).

I think her reasoning is stupid, but I can't figure out how to prove her wrong by finding an example.

I can't use `UNION` since the query is using an `ORDER BY` clause, and the MySQL user running the query doesn't have the `FILE` priviledge so using `INTO OUTFILE` is also out of the question.

So, can anyone tell us who is right on this case?

**Edit**: the query is executed using PHP, so adding a second query using a semicolon won't work.