Is this a hacker? What does this mean?

[vmusic]

Hi,
I have a web site in php with a mySQL database. I have one script that runs all my queries.
Upon error the script emails me there was an error.

I received an error and the last part of the SQL statement was

ayer_id AND e.event_id = http://217.59.104.226/ ORDER BY er.role_nm

Well of course, there's NO IP addresses in my queries...

I went to this IP address 217.59.104.226 and there's a php statement there <? echo "\nbl3" . 'bl3 ' ; passthru("uname -a") ; ?>

Can somebody tell me what this is trying to do?

Thanks!!!

[Mordecai]

Looks like an attempt at SQL injection, but not a very good one. I'm guessing they're assuming that, for whatever reason, you'll include the file on that site and run it, which hopefully you wouldn't be doing.

I would do a bit more error checking on what's being sent into your database in case there were any attempts that have succeeded.