A client of mine keeps getting hacked by seemingly SQL injection where a script tag containing a link to an
in.js file is added. Sometimes from a domain called sportserve.co.uk, other times from exeterpress.co.uk.
I have been unable to find out where the injection is taking place, but I am suspecting their ad provider. Another possibility is that their sysadmin has an infected computer. Changing the database credentials and not alerting ANYONE of the change does not stop this. I implemented a PDO library everywhere a insert/update query is run on that table within their system (unfortunately not all insert/update queries are done yet - the site is HUGE - but will get there...).
My question is: Anyone else seen this in.js injection before, and if you solved it, how?