title: SQL Injection issue. (Passed email validation?)
body: <p>I was recently been hacked and hackers retrieved all my mailing_list data
  and I wondered how did they passed the "Validate_email" function and managed to do sql injection?</p>
  
  <p>this is my code:</p>
  
  <pre><code>function validate_email($address)
  {
              return (ereg('^[-!#$%&amp;\'*+\\./0-9=?A-Z^_`a-z{|}~]+'. '@'. '[-!#$%&amp;\'*+\\/0-9=?A-Z^_`a-z{|}~]+\.' . '[-!#$%&amp;\'*+\\./0-9=?A-Z^_`a-z
  {|}~]+$', $address));
  }
  
  if (empty($_REQUEST['email']) || !validate_email($_REQUEST['email'])) {
      die('INVALID EMAIL');
  }
  
  mysql_query("
      REPLACE INTO mailing_list
      SET email='".strtolower($_REQUEST['email'])."'
  ") or die('Unable to insert email to database');
  
  die(header('Location: http://www.***'));
  </code></pre>
  
  <p>I was wondering how they did it with the validate email function..
  and if this is the place they managed to hacked really or i'm just mistaking and I need to search more..</p>