> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/web-appsec/injections/sqli/double-query-injection.md).

# Double Query Injection

Double Query Injection, commonly known as **Stacked Query SQL Injection**, occurs when an application allows an attacker to inject and execute multiple SQL statements within a single request.

In this type of SQL injection, the attacker is not limited to modifying the original query. If the database and application support stacked queries, additional SQL statements may be executed after the original query, potentially allowing database modification, data deletion, or other unauthorized actions.

This vulnerability occurs when user input is directly incorporated into SQL statements without proper validation or parameterization.

***

### Vulnerable PHP Code Example

```php
<?php

$conn = mysqli_connect("localhost", "root", "password", "shop");

$id = $_GET['id'];

$query = "SELECT * FROM products WHERE id = '$id'";

$result = mysqli_query($conn, $query);

while ($row = mysqli_fetch_assoc($result)) {
    echo $row['name'];
}

?>
```

***

### Code Explanation

The application retrieves the `id` parameter from the URL:

```php
$id = $_GET['id'];
```

The value is then directly concatenated into the SQL query:

```php
$query = "SELECT * FROM products WHERE id = '$id'";
```

Because the application does not validate or parameterize user input, an attacker may be able to alter the intended SQL statement.

The database interprets the final query exactly as it is received, which can lead to the execution of unintended SQL commands if multiple statements are allowed.

***

### How to Exploit

1. Identify a parameter that is used in a database query.
2. Confirm that user input is directly affecting the SQL statement.
3. Determine whether the application or database supports the execution of multiple SQL statements within a single request.
4. Attempt to terminate the original query and append an additional SQL statement.
5. Observe whether the second statement is executed independently of the original query.
6. If multiple statements are processed successfully, an attacker may be able to perform additional database operations beyond the application's intended functionality.
7. Depending on database permissions, the attacker may be able to read, modify, insert, or delete data.

The success of this technique depends on the database platform, database configuration, application framework, and the privileges assigned to the database account.