diff --git a/core/lib/Drupal/Core/Database/Connection.php b/core/lib/Drupal/Core/Database/Connection.php
index 18283ce..00b91b8 100644
--- a/core/lib/Drupal/Core/Database/Connection.php
+++ b/core/lib/Drupal/Core/Database/Connection.php
@@ -79,6 +79,13 @@
   protected $transactionSupport = TRUE;
 
   /**
+   * Whether this database connection allows the delimiter inside statements.
+   *
+   * @var bool
+   */
+  public $allowDelimiter = FALSE;
+
+  /**
    * Whether this database connection supports transactional DDL.
    *
    * Set to FALSE by default because few databases support this feature.
@@ -491,7 +498,7 @@ public function makeComment($comments) {
       return '';
 
     // Flatten the array of comments.
-    $comment = implode('; ', $comments);
+    $comment = implode('. ', $comments);
 
     // Sanitize the comment string so as to avoid SQL injection attacks.
     return '/* ' . $this->filterComment($comment) . ' */ ';
@@ -529,7 +536,8 @@ public function makeComment($comments) {
    *   A sanitized version of the query comment string.
    */
   protected function filterComment($comment = '') {
-    return strtr($comment, ['*' => ' * ']);
+    // Change semicolons to period to avoid triggering multi-statement check.
+    return strtr($comment, ['*' => ' * ', ';' => '.']);
   }
 
   /**
@@ -593,6 +601,13 @@ public function query($query, array $args = array(), $options = array()) {
       }
       else {
         $this->expandArguments($query, $args);
+        // To protect against SQL injection, Drupal only supports executing one
+        // statement at a time.  Thus, the presence of a SQL delimiter is not
+        // allowed. Trim any trailing delimiter to avoid false positives.
+        $query = rtrim($query, ";  \t\n\r\0\x0B");
+        if (strpos($query, ';') !== FALSE && !$this->allowDelimiter) {
+          throw new \PDOException('; is not supported in SQL strings.  Use only one statement at a time');
+        }
         $stmt = $this->prepareQuery($query);
         $stmt->execute($args, $options);
       }
diff --git a/core/lib/Drupal/Core/Database/Driver/mysql/Schema.php b/core/lib/Drupal/Core/Database/Driver/mysql/Schema.php
index 8c1f51d..f153c45 100644
--- a/core/lib/Drupal/Core/Database/Driver/mysql/Schema.php
+++ b/core/lib/Drupal/Core/Database/Driver/mysql/Schema.php
@@ -540,7 +540,8 @@ public function prepareComment($comment, $length = NULL) {
       // Add table prefixes before truncating.
       $comment = Unicode::truncate($this->connection->prefixTables($comment), $length, TRUE, TRUE);
     }
-
+    // Remove semicolons to avoid triggering multi-statement check.
+    $comment = strtr($comment, array(';' => '.'));
     return $this->connection->quote($comment);
   }
 
diff --git a/core/lib/Drupal/Core/Database/Driver/sqlite/Schema.php b/core/lib/Drupal/Core/Database/Driver/sqlite/Schema.php
index 404cbb2..6799dcb 100644
--- a/core/lib/Drupal/Core/Database/Driver/sqlite/Schema.php
+++ b/core/lib/Drupal/Core/Database/Driver/sqlite/Schema.php
@@ -48,7 +48,7 @@ public function fieldExists($table, $column) {
    */
   public function createTableSql($name, $table) {
     $sql = array();
-    $sql[] = "CREATE TABLE {" . $name . "} (\n" . $this->createColumnsSql($name, $table) . "\n);\n";
+    $sql[] = "CREATE TABLE {" . $name . "} (\n" . $this->createColumnsSql($name, $table) . "\n)\n";
     return array_merge($sql, $this->createIndexSql($name, $table));
   }
 
@@ -60,12 +60,12 @@ protected function createIndexSql($tablename, $schema) {
     $info = $this->getPrefixInfo($tablename);
     if (!empty($schema['unique keys'])) {
       foreach ($schema['unique keys'] as $key => $fields) {
-        $sql[] = 'CREATE UNIQUE INDEX ' . $info['schema'] . '.' . $info['table'] . '_' . $key . ' ON ' . $info['table'] . ' (' . $this->createKeySql($fields) . "); \n";
+        $sql[] = 'CREATE UNIQUE INDEX ' . $info['schema'] . '.' . $info['table'] . '_' . $key . ' ON ' . $info['table'] . ' (' . $this->createKeySql($fields) . ")\n";
       }
     }
     if (!empty($schema['indexes'])) {
       foreach ($schema['indexes'] as $key => $fields) {
-        $sql[] = 'CREATE INDEX ' . $info['schema'] . '.' . $info['table'] . '_' . $key . ' ON ' . $info['table'] . ' (' . $this->createKeySql($fields) . "); \n";
+        $sql[] = 'CREATE INDEX ' . $info['schema'] . '.' . $info['table'] . '_' . $key . ' ON ' . $info['table'] . ' (' . $this->createKeySql($fields) . ")\n";
       }
     }
     return $sql;
diff --git a/core/lib/Drupal/Core/Database/Install/Tasks.php b/core/lib/Drupal/Core/Database/Install/Tasks.php
index fed2c5e..40d0072 100644
--- a/core/lib/Drupal/Core/Database/Install/Tasks.php
+++ b/core/lib/Drupal/Core/Database/Install/Tasks.php
@@ -134,6 +134,10 @@ public function minimumVersion() {
   public function runTasks() {
     // We need to establish a connection before we can run tests.
     if ($this->connect()) {
+      $connection = Database::getConnection();
+      // During tasks we may need to run complex SQL like creating functions
+      // where a delimiter occurs in the query.
+      $connection->allowDelimiter = TRUE;
       foreach ($this->tasks as $task) {
         if (!isset($task['function'])) {
           $task['function'] = 'runTestQuery';
diff --git a/core/lib/Drupal/Core/Database/Schema.php b/core/lib/Drupal/Core/Database/Schema.php
index bd65330..5282f14 100644
--- a/core/lib/Drupal/Core/Database/Schema.php
+++ b/core/lib/Drupal/Core/Database/Schema.php
@@ -640,6 +640,8 @@ public function fieldNames($fields) {
    *   The prepared comment.
    */
   public function prepareComment($comment, $length = NULL) {
+    // Remove semicolons to avoid triggering multi-statement check.
+    $comment = strtr($comment, array(';' => '.'));
     return $this->connection->quote($comment);
   }
 
diff --git a/core/modules/system/src/Tests/Database/SelectTest.php b/core/modules/system/src/Tests/Database/SelectTest.php
index 6b45e84..5b53762 100644
--- a/core/modules/system/src/Tests/Database/SelectTest.php
+++ b/core/modules/system/src/Tests/Database/SelectTest.php
@@ -58,7 +58,7 @@ function testVulnerableComment() {
     $records = $result->fetchAll();
 
     $query = (string) $query;
-    $expected = "/* Testing query comments  * / SELECT nid FROM {node}; -- */ SELECT test.name AS name, test.age AS age\nFROM \n{test} test";
+    $expected = "/* Testing query comments  * / SELECT nid FROM {node}. -- */ SELECT test.name AS name, test.age AS age\nFROM \n{test} test";
 
     $this->assertEqual(count($records), 4, 'Returned the correct number of rows.');
     $this->assertNotIdentical(FALSE, strpos($query, $expected), 'The flattened query contains the sanitised comment string.');
diff --git a/core/tests/Drupal/Tests/Core/Database/ConnectionTest.php b/core/tests/Drupal/Tests/Core/Database/ConnectionTest.php
index 4f4c803..08a2a5d 100644
--- a/core/tests/Drupal/Tests/Core/Database/ConnectionTest.php
+++ b/core/tests/Drupal/Tests/Core/Database/ConnectionTest.php
@@ -254,11 +254,11 @@ public function providerMakeComments() {
         array(''),
       ),
       array(
-        '/* Exploit  *  / DROP TABLE node; -- */ ',
+        '/* Exploit  *  / DROP TABLE node. -- */ ',
         array('Exploit * / DROP TABLE node; --'),
       ),
       array(
-        '/* Exploit  *  / DROP TABLE node; --; another comment */ ',
+        '/* Exploit  *  / DROP TABLE node. --; another comment */ ',
         array('Exploit * / DROP TABLE node; --', 'another comment'),
       ),
     );
@@ -286,8 +286,8 @@ public function testMakeComments($expected, $comment_array) {
   public function providerFilterComments() {
     return array(
       array('', ''),
-      array('Exploit  *  / DROP TABLE node; --', 'Exploit * / DROP TABLE node; --'),
-      array('Exploit  * / DROP TABLE node; --', 'Exploit */ DROP TABLE node; --'),
+      array('Exploit  *  / DROP TABLE node; --', 'Exploit * / DROP TABLE node. --'),
+      array('Exploit  * / DROP TABLE node; --', 'Exploit */ DROP TABLE node. --'),
     );
   }