title: Site has been hacked via SQL Injection
body: <p>Recently my site was hacked via SQL injection. The hacker used the following query 
  to get my DB name. I cannot understand this query they wrote.</p>
  
  <p>Query:</p>
  
  <pre><code>=-999.9%20UNION%20ALL%20SELECT%20concat(0x7e,0x27,Hex(cast(database()%20as%20char)),0x27,0x7e),0x31303235343830303536,0x31303235343830303536,0x31303235343830303536--
  </code></pre>
  
  <p>After the query was ran it showed an integer result, something like "<code>74545883</code>".</p>
  
  <p>Can you explain how the query works?</p>