title: SQL Injection through mysql_query
body: <p>I'm working on a site that has been hacked through SQL Injection (at first glance only db entries are corrupted with cross-site scripting) the potential vulnerability I found after looking at the code is that there's a lot of mysql_query call whose inputs are not escaped at all.</p>
  
  <p>The good old :</p>
  
  <pre><code>$query = "SELECT * FROM mytable where name LIKE '%".$_GET['name']."%'"; /*HACK HERE*/
  mysql_query($query, $connection);
  </code></pre>
  
  <p>Nevertheless I can't find how can we do something cool from that injection vulnerability (by cool I mean something like an INSERT or an UPDATE). I've tried to build a statement like this one :</p>
  
  <pre><code>SELECT * FROM mytable where name LIKE '%' AND WHERE id IN (INSERT INTO secondtable (id,description) VALUES (15, 'Fifteenth description');--%'
  </code></pre>
  
  <p>No success. I guess that the INSERT has nothing to do here.</p>
  
  <p>I'm escaping all user's inputs in the code right now but I've not really get how hackers have penetrated this site, then I'm not 100% sure that my fix will do the job. Any brilliant suggestions ?</p>
  
  <p>Thanks</p>