Not only injected, but they may also steal all your database data by dumping it.