title: SQL Injection using PHP multi_query to DROP TABLE
body: <p>I am trying to drop a table within a database using SQL injection through PHP. </p>
  
  <p>The PHP code submits a form to the Database with the following command and multi_query($sql):</p>
  
  <pre><code>$sql = "INSERT INTO Student (StdNumber, FName, LName, DOB, PhoneNumber) 
  VALUES ('$input1', '$input2', '$input3', '$input4', '$input5')";
  </code></pre>
  
  <p>So I thought, I can SQL Inject input5. So I use:</p>
  
  <pre><code>');"; $sql .= "DROP TABLE IF EXISTS Student;";-- -
  </code></pre>
  
  <p>This closes the previous sql statement, then I start another statement with 'sql .=' and then I comment off the rest of it with -- -</p>
  
  <p>However the table isn't dropping. I am not seeing my injection command within input5 (PhoneNumber) in the database, so it is successfully closing the previous statement I would believe. </p>
  
  <p>So I am not sure what is wrong, am I using multi_query incorrectly? or is my injection incorrect? </p>
  
  <p>Thank you</p>
  
  <p>Edit 1:
  Additionally, when I submit the form it accepts it and makes another entry into the database. </p>