Compromises that live in data.
WHY CHECK IT
Some compromises inject content into the database rather than files.
Replacing files alone does not remove those.
WHERE TO LOOK
Post and page content, for injected scripts or links Options and settings tables User accounts Anything added recently
WHAT TO LOOK FOR
Script tags in content Links to sites you do not recognise Encoded strings Administrator accounts you did not create
HOW TO SEARCH
phpMyAdmin allows searching across tables.
Search for common patterns: script tags, iframe tags, base64 references.
WHAT TO BE CAREFUL WITH
Some legitimate content contains scripts.
Check before deleting.
BEFORE ANY DATABASE CHANGE
Back up the database.
WHAT TO REMOVE
Unauthorised user accounts Injected content Anything clearly malicious
FOR WIDESPREAD INJECTION
A search and replace across the database, using a serialisation-aware tool.
Not a plain find and replace, which corrupts serialised data.
WHAT TO CHECK AFTERWARDS
That content displays correctly.
