I have a PHP based website with a MySQL database. A few days ago I received an email containing all the users in the database along with their decoded passwords (the passwords were encoded using MD5).
After changing all passwords (ftp, database and the passwords from all the users), I received an email with the new info of the users.
I have used mysql_real_escape_string
and htmlentities
to sanitize the user inputs. Don't know what else to do in order to protect the site from another intrusion.
Does anyone have any ideas on how could this have happened and what I can do to prevent it?
Your help is greatly appreciated!