Suppose I had a vulnerable query like this:
var q = 'SELECT x FROM y WHERE id = ' + req.body.id + ' ORDER BY date DESC;';
For the purposes of this question, req.body.id
could be any integer parameter that isn't type-checked as everything over HTTP is a string.
Since the MySQL extension disables multi-statement queries by default, I can't do something like:
http://example.net/foo?id=1;INSERT INTO y VALUES (things...);--
Is it possible to execute a data manipulation statement (such as INSERT, UPDATE, DELETE) with this vulnerable query?