I want to learn how SQLInjection is working with the PostgresqlDb. I am using the Npgsql in C#.

So this is my Query, which is called, when I rename a folder:

```
cmd.CommandText = "UPDATE allfolder.folder SET folder_name = '" + foldernamenew + "'";
cmd.ExecuteNonQuery();

```

I now tried to pass the following value into the textfield:

```
abcdef; INSERT INTO allfolder.folder (id, folder_name) VALUES (56,"aaaaaaa");

```

Then AJAX is fired.

The output I assumed is, that all folders in the table has the folder\_name "abcdef" and that I have a new folder with the id "56" called "aaaaaa". This is not the case, because the semicolon is not recognized as delimiter and so the name of each folder\_name are "abcdef; INSERT INTO ....". I do not want to change it on DB side that multiqueries are allowed.

So my questions are:

How do I need to prepare the SQL statement, that I achieve a Injection?
Is an injection even possible, when you are not allowed to execute a second qry because the semicolon isn't recognized?

I am only talking about Npgsql and postgres.