SQL injection attack

[eluser]frederico[/eluser]
The initial query for forgot password i found out wasn't checking if the email address is registered so it was sending a new password regardless.

The query was actually a simple:

$this->db->where('col_name','val');
$this->db->update('table_name',array);

The array has the values to be updated in the db...


I tried to do some injections myself but none went through. I have changed my cpanel password. It most likely was a brute force attack as it was characterised by denial of service.