The Dial() application lets you specify two or more destinations, separated by “&” characters. When you execute an application call of this sort in your dialplan, Asterisk dials all of the destinations in parallel. If they’re SIP clients, each will receive an INVITE at the same time.

http://lists.digium.com/pipermail/asterisk-users/2005-April/094621.html

If you use the “dial in parallel” technique I just described, when one client answers the call, Asterisk sends out a “cancel invite” to each of the other clients it had dialed.

This *should* result in each of those other clients stopping their ring promptly… but that’s up to the client.

The question of which clients are called in response to a Dial() in your dial-plan, depends entirely on which clients are named in that Dial(). If you have five clients, and only include three of them in a particular Dial(), only those three will ring.

If you have a client which is never named in a Dial() anywhere in your dialplan, Asterisk will never call it. It will be an “outbound calls only” client.

In principle, a client could “dial” a URI which includes parameters for a SIP query. Asterisk’s dialplan would recognize this URI (for example, it might start with *888* or some other such string), parse it, and feed the bits to an SQL query.

With this approach (or any approach which accepts an SQL query or parameters from a client) you must be *EXTREMELY* careful to avoid “SQL
injection” attacks.

The story of little Bobby Tables is what I’m talking about here:
https://xkcd.com/327/

https://wiki.asterisk.org/wiki/display/AST/Secure+Calling+Tutorial