Question: someone sql inject my Project and filled a on my site.
How it works? 
I mean, i found the break where he comes in.

I have this, in one file. And i forgot to save it.

```
mysql_query("UPDATE info SET `value`='".$_POST["chat"]."' WHERE `name`='chatactive'");

```

The "chat" Post can easy set in a input field. And the Value is variable.
But the guy who breaks into my site changes the 

But the guy changes the value of WHERE name = infotitle
and not chatactive

How he do this?
The only value he can changed was the "POST chat". But he dont changed anything there, only in name = "infotitle"

I tried things like 

`"1', value='<script> WHERE name='infotitle'`

as value. But it dont work cause mysql says error cause there is 

`"WHERE name='chatactive'");"`

behind the POST value

Answer: 
A quote is the key part to make a SQL injection

He typed this in the chat:

> 
> anything' WHERE name='chatactive';
> 
> 
> 

Your query becomes

```
UPDATE info SET `value`='anything' WHERE name='chatactive';' WHERE `name`='infotitle'

```

MySQL first executes

```
UPDATE info SET `value`='anything' WHERE name='infotitle';

```

Then tries to execute:

```
WHERE `name`='chatactive

```

The first query succeed. The second fails, but it doesn't matter as the goal is achieved.

I guess he was a very gentle aka ethical hacker.
If you are using PHP, then you *must* move away from the `mysql_*` interface. Go to `mysqli_*` or `PDO`.

Then you *must* escape or "bind" all arguments before building SQL. In particular, `$_POST[]`, `$_GET[]`, and `$_REQUEST[]` are the doors through which hackers try to get into your database.

Once in, an evil hacker can literally destroy all the data on your disk.