title: Writing database connection details in my index - security risks?
body: <p>My website was hacked and my host tells me that somebody is sending massive amounts of spam through my website.
  Recently I made these modifications:
  1) I deleted the include database_connection file and put its contents in my main page in the header like this:</p>
  
  <pre><code>$connect=mysql_connect("localhost","mydb","pass") or die(mysql_error());
  mysql_select_db("mydb", $connect) or die(mysql_error());
  </code></pre>
  
  <p>2) I included a search form like this:</p>
  
  <pre><code>&lt;form name="search_form" id="search_form" method="POST" action=""&gt;
  &lt;span&gt;Search:&lt;/span&gt; &lt;input type="text" name="search_box" value="" /&gt;
  &lt;input type="submit" name="search" value="search the data" /&gt;
  &lt;/form&gt;
  $sql="SELECT * FROM (SELECT * FROM table ORDER BY Name) table ";
      if (isset($_POST['search'])){
  
      $search_term=mysql_real_escape_string($_POST['search_box']);
      $sql .="WHERE Name LIKE '%{$search_term}%' ";
  }
  $query=mysql_query($sql) or die(mysql_error());
  </code></pre>
  
  <p>Can these two modifications let the hackers in?
  If yes, is it possible that they infected other files, or I can delete these files and be fine?
  Thanks!</p>
  
  <p>Edit: My host provider had to suspend my account several times because "huge amount of data" was sent through my site. I have to find the cause of this..</p>