Question: I'm trying to make a list of images, 2 per row. 

The uneven rows (1, 3, 5, etc.) should have a small image first, and a wide one second. The even rows (2, 4, 6, 8, etc.) should have the wide image first and the smaller one second.

I'm now at row 3, and I cannot get the small image to the left for whatever reason. As you can see in the image below it floats to the right.

My code is very basic, and Dreamweaver displays it correctly in its Split function.

HTML:

```
<div id="portfolio-screen"></a>
    <ul>
            <li><img src="images/portfolio-jaar1.png" width="228"/></li>
            <li><img src="images/portfolio-pr1_2.png" width="500"/></li>
            <li><img src="images/portfolio-pr1_4.png" width="500"/></li>
            <li><img src="images/portfolio-pvs1.png" width="228"/></li>     
            <li><img src="images/portfolio-jaar2.png" width="228"/></li>
            <li><img src="images/portfolio-pr2_2.png" width="500"/></li>
    </ul>                   
</div>

```

CSS

```
#portfolio-screen       {margin-top: 8px; width: 768px; height: 602px; background-color:#37322d; overflow: auto;}
#portfolio-screen li    {margin-top: 8px; margin-left: 8px; float: left;}

```

For some reason it is not allowed to post images, so I have supplied a link to one: <http://oi51.tinypic.com/b63vkk.jpg>

Answer: 
mysql's PHP driver does NOT allow multiple queries in a single ->query() call, exactly for this reason. It's an anti-injection defense, to prevent the classic [Bobby Tables](http://bobby-tables.com) attack. This true for all PHP db interfaces (mysql, mysqli, pdo), as they all use the same underlying mysql C api library to actually talk to the db. Any attempt to run 2+ queries in a single query call results in the syntax error.

Note that it does NOT protect against your `' or 1=1` injection, however.
In order for your stacked query injection technique to work, you will need to use the "mysqli\_multi\_query()" function:

<http://php.net/manual/en/mysqli.multi-query.php>
<http://www.websec.ca/kb/sql_injection#MySQL_Stacked_Queries>

MsSQL is the only database that supports stacked queries by default.

Also possibly a better injection technique, and a more reliable one, would be a UNION attack, and then dump the MySQL credentials from the "mysql.user" table, then use these to compromise the database.