title: Is there a way to demonstrate SQL injection with mysqli?
body: <p>I want to make a quick and easy demonstration about how SQL injection work. And I've solved some of my problems. I have a table with random usernames, passwords and emails in, and I'm able to "inject" SQL code to view all of the users in a search with this injection:</p>
  
  <pre><code>' OR '1'='1
  </code></pre>
  
  <p>This is how my PHP code looks for searching for "members":</p>
  
  <pre><code>if (isset($_POST['search'])) {
      $searchterm = $_POST['searchterm'];
      echo $searchterm . '&lt;br&gt;';
  
      /* SQL query for searching in database */
      $sql = "SELECT username, email FROM Members where username = '$searchterm'";
      if ($stmt = $conn-&gt;prepare($sql)) {
          /* Execute statement */
          $stmt-&gt;execute();
  
          /* Bind result variables */
          $stmt-&gt;bind_result($name, $email);
  
          /* Fetch values */
          while ($stmt-&gt;fetch()) {
              echo "Username: " . $name . " E-mail: " . $email . "&lt;br&gt;";
          }
      } 
      else {
          die($conn-&gt;error);
      }
  }
  </code></pre>
  
  <p>Now I want to demonstrate some more fatal problems, like someone truncating your whole table. So I tried this code in the search bar:</p>
  
  <pre><code>'; TRUNCATE TABLE Members; -- 
  </code></pre>
  
  <p>But I get this error message:</p>
  
  <pre><code>You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near 'TRUNCATE TABLE Members; -- '' at line 1
  </code></pre>
  
  <p>It seems like I get an extra <code>'</code>, but I don't know how to get rid of it, though the <code>--</code> would comment that out. First I thought that the problem was that I had no whitespace behind the <code>--</code> but adding a whitespace didn't make any difference.</p>
  
  <p>I have tried switching to PDO, because I thought there was a problem with mysqli not accepting multiple queries, but then I somewhere read that PDO doesn't support that either, but I don't know.</p>
  
  <p>Is there a way I can make it work?</p>
  
  <p>I later found that PDO supports multi-querying by default, but when I tried it it didn't work. Maybe I bound the parameters wrong. But I couldn't even make a simple select query to work.</p>