This question already has an answer here:
Somebody emailed me this morning informing me that they gained access to my clients MySQL database and offered to fix the issue in exchange for money. I've been doing some testing with a real estate listing site. The way the site is set-up it currently has
property.php?estateID=103 and doing
property.php?estateID=103 union select 1,useraccounts(),3,4,5,6,7 pulls an error back
FUNCTION database_table.useraccounts does not exist and I am assuming that is what is helping this hacker gain access to my database. How can I prevent this? Will simple sanitize help? The database is MySQL 5.5.