I found out my company, years ago, had a public facing web page that executed a MySQL query, on a primary server with no backup, sent in the url string. (?query=xxx)