Final countdown

[TheSkepticOverlord]

My initial opinion, reinforced by what I read about what happened, is that someone tried to use a code flaw to get access to the database. One way of trying things like that can, if not carefully done, change all records on a specific database table.

If that's possible, then it's likely that my global SQL-injection prevention script was disabled or altered. It was a simple method of limiting all post/get variables character length to only what was needed (along with trapping common injection commands). If a command was detected, or the variable exceeded a set length, then the script exited.