Question about SQL injection and mysql_query

[svivian]

I keep hearing about SQL injection attacks where someone submits

'; DROP TABLE x;

in a form where the variable will be used as part of a WHERE clause.

 

But the mysql_query() function clearly states that it must have only one query - "multiple queries are not supported". So does this mean SQL injection attacks are not possible, even with unescaped data?

[fenway]

First, that is not the only example of sql injection.

Second, there are other functions that do support multiple queries (or so I am told).