Mysql用户无法更新临时表(具有所有权限)

Question

我尝试通过 php 执行以下查询:

            CREATE TEMPORARY TABLE temp_table 
            AS 
            SELECT * FROM vacancies WHERE vacancyid = '22207';
            UPDATE temp_table SET vacancyid='22216' WHERE vacancyid='22207';
            INSERT INTO newdatabase.vacancies SELECT * FROM temp_table;
            DROP TEMPORARY TABLE temp_table;

这会产生错误:

Errormessage: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'UPDATE temp_table SET vacancyid='22216' WHERE vacancyid='22207';

如果我直接在 PMA 中执行查询，它就可以正常工作。我在 PHP 中连接的用户具有以下权限:

GRANT ALL PRIVILEGES ON firstdatabase.* TO 'username'@'%' WITH GRANT OPTION;

GRANT ALL PRIVILEGES ON newdatabase.* TO 'username'@'%' WITH GRANT OPTION;

有人知道吗？

PHP 代码:

            //Get the new autoincrement id of the vacancy of individual jobboard
            $iNewId = $db->lookup("SELECT vacancyid FROM ".$aBoardInfo['username'].".vacancies ORDER BY vacancyid DESC LIMIT 1");
            $iNewId = $iNewId + 1;  

            $db->query("                                
        CREATE TEMPORARY TABLE temp_table 
        AS 
        SELECT * FROM vacancies WHERE vacancyid = '". $iVacancyid ."' ; 

        UPDATE temp_table SET vacancyid=". $iNewId ." WHERE vacancyid='". $iVacancyid ."' ; 

        INSERT INTO ".$aBoardInfo['username'].".vacancies SELECT * FROM temp_table ; 

        DROP TEMPORARY TABLE temp_table ;   
        ");

Answer 1

正如 documentation 中所述在示例 2 中

示例 #2 SQL 注入(inject)

<?php
$mysqli = new mysqli("example.com", "user", "password", "database");
$res    = $mysqli->query("SELECT 1; DROP TABLE mysql.user");
if (!$res) {
    echo "Error executing query: (" . $mysqli->errno . ") " . $mysqli->error;
}
?>

The above example will output:

Error executing query: (1064) You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'DROP TABLE mysql.user' at line 1

Prepared statements

Use of the multiple statement with prepared statements is not supported.