Is it possible to update a field in a MySQL database or insert a new row using SQL injection in this case:
- The only protection in the PHP code is mysql_real_escape_string().
- The query is constructed in double quotes:
"select id from db where id = $id"not single string literal quotes.
- The database is mysql (using mysql_query php call) so I don't think stacked queries is possible (correct me if I'm wrong).
- Using mysql not mysqli.
I've tried using something like
1; update users set first_name = foo with no luck and tried passing in commas
' in hex and octal format with no luck:
chr(047) ascii tables.
Is it possible to actually update or insert under these conditions?