title: How to Perform SQL Injection making a SELECT statement UPDATE or INSERT rows?
body: <blockquote>
    <p><strong>Possible Duplicate:</strong><br>
    <a href="https://stackoverflow.com/questions/5759603/mysql-injection-use-select-query-to-update-delete">MySQL Injection - Use SELECT query to UPDATE/DELETE</a>  </p>
  </blockquote>
  
  
  
  <p>So I have found in my site bug that allows to perform sql injection
  <code>http://mysite.com/script.php?id=1 union select 1,2,3</code> will output all fields that has Id property equal to one plus one additional row with 1,2,3. I know that I have to validate user input to close my bug.</p>
  
  <p>However my question is quite another. Is it possible to perform update query or insert query? I am able to comment query using --, however I cannot use multiple statements that are delimited by <code>;</code>. So is it possible to perform update query in my case. I can show PHP code and SQL query if needed.</p>
  
  <pre><code>$sql    = "SELECT id, title, text from table where cId=$val";
  $result = mysql_query($sql);
  $array  = mysql_fetch_array($result);
  //echo rows in table
  </code></pre>