mysql - SQL insert query inside select or where clause

Maybe my question above may be could be stupid , but I just want to know if is it possible to have insert query inside select or where.

The reason that I want to know that is if someone hack website or any application database, can the hacker input data to hacked database without my knowledge ?

the following example of SQL injection I see in other sites

http://www.example.com/empsummary.php?id=1 AND 1=-1 union select 1,group_concat(name,0x3a,email,0x3a,phone,0x2a),3,4,5,6,7,8,9 from employee

I know what exactly that above query does, but can the hacker input (use insert query) on the database or on any table ?

Answer

Yes, it can happen, if the database interface is configured to allow multiple statements in a query.

An INSERT can't run as part of a SELECT statement. But it's possible that the exploit of a vulnerability could finish a SELECT and then execute a separate insert.

Say you have a vulnerable statement like this:

 SELECT foo FROM bar WHERE fee = '$var'

Consider the SQL text when $var contains:

 1'; INSERT INTO emp (id) VALUES (999); -- 

The SQL text could be something like this:

 SELECT foo FROM bar WHERE fee = '1'; INSERT INTO emp (id) VALUES (999); --'

If multi-statement queries are enabled in the database interface library, it's conceivable that an INSERT statement could be executed.

See: https://www.owasp.org/index.php/SQL_Injection