title: Someone has hacked my database - how?
body: <p>Someone has hacked my database and has dropped the table.</p>
  
  <p>In my PHP page there is one single query where I am using mysql_real_escape_string:</p>
  
  <pre><code>$db_host="sql2.netsons.com";
  $db_name="xxx";
  $username="xxx";
  $password="xxx";    
  
  $db_con=mysql_connect($db_host,$username,$password);    
  
  $connection_string=mysql_select_db($db_name);
  mysql_connect($db_host,$username,$password);    
  mysql_set_charset('utf8',$db_con); 
  
  $email= mysql_real_escape_string($_POST['email']);
  $name= mysql_real_escape_string($_POST['name']);
  $sex= mysql_real_escape_string($_POST['sex']);    
  
  if($_POST['M']!=""){  $sim = 1;  }else {  $sim = 0;   }
  
  $query = "INSERT INTO `users` (`email`, `name`, `sex`, `M`) VALUES
  ( '".$email."', '".ucwords(strtolower($name))."', '".$sex."','".$sim."')";    
  
  $res = mysql_query($query) or die("Query fail: " . mysql_error() );
  
  mysql_close($db_con);
  </code></pre>
  
  <p>And <code>register_globals</code> is <strong>disabled</strong>.</p>
  
  <p>So, how was my database hacked?</p>