Read this today on a developer thread. I was horrified, but then I realized he was working on his local machine - so no issue there. But, then I read the rest of his email/question, and in his signature, it said "Senior PHP Developer." NNNOOOOOO

SQLInjection.php

<?php

mysql_connect("localhost", "uname", "pass@3") or die(mysql_error());

echo "Connected to MySQL<br />"; // working fine

mysql_select_db("dbname") or die(mysql_error());

echo "Connected to Database"; // working fine

extract($_POST);

$result = mysql_query("SELECT * FROM admin_users WHERE admin_email='" . $user_email .
        "' AND password='" . md5($password) . "' AND status=1") or die(mysql_error()); // not working returns null

while($row = mysql_fetch_array( $result )) {
    print_r ($row);
}