为什么这个MySQL查询无法从PHP工作

Question

PHP code from registration procedure:

    $query="INSERT INTO `users`(`email`, `password`, `role`, `time_registration`) 
        VALUES ('".mysqli_real_escape_string($con, trim($_SESSION['reg']['email']))."',
                '".hash('SHA512',trim($_POST['password']))."',
                '".mysqli_real_escape_string($con, trim($_SESSION['rola']))."',
                NOW())";

    if(!mysqli_query($con, $query)){
        error(".....");
    }else{

Here is all good. First query is executed and data is stored to table "users". But here comes problem. Next php code generate new mysql query, which is never executed. But when I copy it to PHPmyAdmin, there it works...

        $last_id=$con->insert_id;
        $query='';
        foreach($_SESSION['reg'] as $key=>$value){
            if($value!=''){
                $query.=" INSERT INTO user_detail (id_user,id_item,value) VALUES ('".$last_id."', (SELECT id_item FROM profil_items WHERE name='".$key."'), '".mysqli_real_escape_string($con, $value)."');";
            }   
        }

        if(!mysqli_query($con, $query)){
            echo $query; 
        }else{
            header('Location: ...somewhere....');
        }           
    }

Mysqli error message: "You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'INSERT INTO user_detail (id_user,id_item,value) VALUES ('14', (SELECT id_po' at line 1".

I dont understand. If there is an error in syntax, how can by executed without errors in PHPmyAdmin?

Answer 1

There is never any reason to use mysqli_multi_query() . Starting a habit of using multi-query opens yourself up to new types of SQL injection vulnerabilities .

You should either execute each INSERT individually, with mysqli_query() inside the foreach loop.

Or else append multiple rows into one multi-row INSERT statement and execute it after the loop.

---

In this case, no (though you should use bound parameters instead of mysqli_real_escape_string() ), but I think once you start using mysqli_multi_query() you may use it elsewhere in an unsafe manner. Better to never use it.

You can execute a single INSERT by using multi-row syntax. But I wouldn't worry about the overhead of executing multiple statements, until you are doing it in such high volume that you can measure a significant performance problem. Don't worry about micro-optimizations.