I am testing SQL injection in PHP and want to test a simple scenario. My query looks like this

select `name` from `users` order by name

My URL looks like this 127.0.0.1/api?sort=name, when I visit this URL the above mentioned query is generated.

Now assume that the sort parameter is vulnerable, means that if attacker visits 127.0.0.1/api?sort=name UNION ALL SELECT HELLO, then the query generated would be

select `name` from `users` order by name UNION ALL SELECT HELLO

The important point here is that the attacker can only append his query at the end. My question is that, is the SQL injection possible in this case?

The attacker cannot use UNION ALL because it requires the SELECT query in parenthesis.

The attacker cannot insert anything like ;drop table abc, as multi statement are not allowed in this case.