title: Hackable sql query
body: <p>I was running a site I purchased that I thought was fairly unhackable. However, after having an attack, I found it was not. He informed me of the vulnerability, however my question is what user input could have been done to get all the users usernames like he did? Here is the code...</p>
  
  <pre><code>$un=$_GET['username'];
  $q=$db-&gt;query("SELECT * FROM users WHERE login_name='$un' OR username='$un'");
  </code></pre>
  
  <p>I realize that this is highley hackable. Therefore, I changed the site over to prepared statements to prevent this from happening again. I just want to know what he could have entered to get all the users usernames.</p>
  
  <p>Someone posted the script on github, you can find it here:
  <a href="https://github.com/sat312/Mafia-Game-Script/blob/master/checkun.php" rel="nofollow">https://github.com/sat312/Mafia-Game-Script/blob/master/checkun.php</a></p>