php - How to turn off multiple statements in postgres? -

i think idea turn off multiple statements prevent type of sql-injection. example of multiple statements:

$query = "update authors set author=upper(author) where id=1;"; $query .= "update authors set author=lower(author) where id=2;"; $query .= "update authors set author=null where id=3;";  pg_query($conn, $query); 

is possible prevent multiple statements in posgresql settings or example using posgre's related php code?

or maybe there way of parsing sql queries before passing them pg_query in order detect queries consists of more 1 statement?

no, there no way disable multi-statements in postgresql. nor, far know, there way in php pg or pdo postgresql drivers.

they aren't problem anyway. disabling multi-statements might (slight) sql injection harm mitigation, wouldn't real protection. consider writeable ctes, example, or qualifier removal attacks.

instead, protect code in first place. rigorously use parameterized statements instead of string concatenation, there's no sql injection opportunity in first place. it's not hard avoid sql injection, have little bit sensible coding practices.

use pdo or pg_query_params queries, , make sure don't concatenate text that's come outside immediate scope directly sql text, use parameter. if comes elsewhere in application , considered "trusted" ... later refactoring might change that.