title: Website exploited, suspected SQL injection + PHP check bypassed, but can't explain how the latter was performed
body: <p><strong>Background</strong>:</p>
  
  <p>A website I made some year ago has been recently attacked; the exploiters managed to get access to the PHP front-end I made for the client, which is used to upload files, and they managed to upload some PHP files containing an exploit among other things like a PHP-based file manager. I can post the content of each uploaded PHP file if of interest, however the problem is of course that they managed to gain access to the client's front end.</p>
  
  <p>The site hasn't been updated since it was first made (it uses old and deprecated MySQL functions and no <code>mysql_real_escape_string()</code> to check the inputs in the login panel (I know)), however I'm not totally sure that it's through a SQL injection that they managed to gain access.</p>
  
  <p>The vhost runs on Windows / Parallels Plesk and I don't have neither SSH access nor access to the logs: I've opened a ticket with the hosting provider asking for the logs, however I'm not sure if they can provide them and how much it will take to do so, so to not risk anything more in the meantime I'm trying to exploit the suspected flaw myself.</p>
  
  <p>I'm able to perform an injection in the SQL statement used to retrieve the user's data to bypass the user check, however I'm unable to break the password check immediately after, which is done in PHP.</p>
  
  <p><strong>TL;DR</strong></p>
  
  <p>The following is the relevant snippet used to retrieve the user data and to check the password: I'm able to perform an injection in the SQL statement (e.g. using <code>" OR ""="</code> as the username), however I'm unable to break the password check immediately after:</p>
  
  <pre class="lang-php prettyprint-override"><code>&lt;?PHP
  // ...
  else {
      $query='SELECT * FROM users WHERE username="' . $username . '";';
      $query_result=mysql_query($query);
      if(!$query_result) {
          die (mysql_error());
      }
      else {
          $user_data=mysql_fetch_array($query_result);
          if($user_data &amp;&amp; $user_data['password']==$password) {
              session_start();
              $_SESSION['user_id']=$user_data['id'];
              $_SESSION['user_username']=$user_data['username'];
              $_SESSION['user_password']=$user_data['password'];
              $_SESSION['user_privileges']=$user_data['privileges'];
              session_write_close();
              $next_page='control_panel.php';
          }
          else {
              $next_page='login.php?notify=username_password_wrong';
          }
      }
  }
  mysql_close($mysql_connect);
  // ...
  ?&gt;
  </code></pre>
  
  <p>Is breaking such check feasible? Or am I totally wrong on my suspicions and I should look elsewhere to find the weak spot?</p>