title: Sqlite Injection with Update Subquery
body: <p>I am trying to run the following query:</p>
  
  <pre><code> query = """SELECT id, password_hash, salt FROM users
             WHERE username = '{0}' LIMIT 1""".format(username)
  </code></pre>
  
  <p>with this 'username'</p>
  
  <pre><code> ' OR username IN ((SELECT 
  (UPDATE users SET password_hash="hash") FROM users)) -- 
  </code></pre>
  
  <p>but i am getting this error:</p>
  
  <pre><code>OperationalError: near "UPDATE": syntax error
  </code></pre>
  
  <p><strong>What am I doing wrong?</strong></p>
  
  <p>its not because of prepared statements or anything, because that query works:</p>
  
  <pre><code> ' OR username IN ((SELECT username FROM users)) -- 
  </code></pre>
  
  <p>I am doing this legally on a website called stripe-ctf.com and for learning purposes.</p>