title: Are there URL-level SQL injection protections built into PHP?
body: <p>I'm working with AJAX and trying to send a multi-command SQL query and I'm being stopped, as near as I can tell, at a very low level.</p>
  
  <p>I have a simple PHP file:</p>
  
  <pre><code>&lt;?
  header('Content-Type: text/xml');
  print("&lt;?xml version=\"1.0\" encoding=\"UTF-8\"?&gt;&lt;root&gt;&lt;/root&gt;");
  ?&gt;
  </code></pre>
  
  <p>With this setup, as near as I can tell, sending a request which contains:</p>
  
  <ul>
  <li>a semicolon, followed by</li>
  <li>the word INSERT, followed by</li>
  <li>two or more characters</li>
  </ul>
  
  <p>...will result in a 403 Forbidden response. <em>ANY</em> deviation from that goes through without any trouble. So this:</p>
  
  <pre><code>http://my.server.com/myfile.php?x=%3BINSERTXX
  </code></pre>
  
  <p>...returns a 403 error. But all of these:</p>
  
  <pre><code>http://my.server.com/myfile.php?x=%3CINSERTXX
  http://my.server.com/myfile.php?x=%3BINSERTX
  http://my.server.com/myfile.php?x=%3BINSERQXX
  </code></pre>
  
  <p>...go through just fine.</p>
  
  <p>This is such a specific thing (and one that's taken me all morning to narrow down) that it seems obviously oriented toward preventing SQL injection. That's fine, I appreciate the protection from <a href="https://xkcd.com/327/" rel="nofollow noreferrer">Bobby Tables' mom</a>.* But supposing I'm taking appropriate precautions in my code, how can I send a multi-part SQL command via AJAX? Is there some PHP setting I need to change on the server to allow this, or some other way I can send multiple INSERT commands in a single AJAX transaction?</p>
  
  <p>Thanks!</p>
  
  <p>EDIT: Here's what I'm talking about. I've placed the exact PHP file above on my server. Try the following URLs:</p>
  
  <ul>
  <li><a href="http://tobyrush.com/sql.php?x=%3BINSERTXX" rel="nofollow noreferrer">http://tobyrush.com/sql.php?x=%3BINSERTXX</a></li>
  <li><a href="http://tobyrush.com/sql.php?x=%3CINSERTXX" rel="nofollow noreferrer">http://tobyrush.com/sql.php?x=%3CINSERTXX</a></li>
  <li><a href="http://tobyrush.com/sql.php?x=%3BINSERTX" rel="nofollow noreferrer">http://tobyrush.com/sql.php?x=%3BINSERTX</a></li>
  <li><a href="http://tobyrush.com/sql.php?x=%3BINSERQXX" rel="nofollow noreferrer">http://tobyrush.com/sql.php?x=%3BINSERQXX</a></li>
  </ul>
  
  <p>*It's worth mentioning, however, that replacing "INSERT" with "DROP" <em>doesn't</em> return a 403...</p>