Good day,
I am aware of the importance of protecting MySQL from SQL injections and using strong passwords to prevent unauthorized access. Recently, an old friend informed me that his website was down and upon investigating,
I discovered that his database had been hacked and replaced with a demand for payment.

Thankfully, my friend had a backup and was able to restore his database. However, this incident caused me to research more about database hacking and I found information suggesting that it is advisable to close port 3306 to prevent such incidents.

 My question now is whether it is possible to hack through this port and what the real risks are. I have read interesting discussions on this topic and appreciate the valuable insights shared by the contributors.

The issue at hand is not related to the port, but rather the fact that the database will be accessible to any user who views the site. In addition to allowing users to view posts and comments, it is important to take measures to prevent injection attacks.

To prevent such security risks, it is recommended to implement query checks and to organize the query system in such a way that it is difficult for hackers to exploit. Public files should be kept separate from private ones, and all scripts used for working and processing databases should be stored in a private folder. User information should be kept in a public folder, as well.

It is possible to hack through an open port that has no protection against brute force and is secured with basic passwords.

However, professional hosters usually do not allow MySQL to be accessed by everyone outside their network. If they do, they often have protections configured against brute force attacks.
 It is worth noting that allowing public access through port 3306 is uncommon today. Those who do so usually have a good understanding of the risks involved and why it may be necessary (or they have no knowledge about server administration).

The system has been breached through an insecure phpmyadmin, which can be accessed via site.com/phpmyadmin.

It is recommended to modify the default address and prevent root user access (which is often enabled by default), or alternatively remove phpmyadmin altogether. It is possible that searching for the specified bitcoin wallet will yield evidence of additional victims.

The instance you recounted highlights the peril of SQL injection attacks, which are commonly utilized by malicious actors to exploit vulnerabilities in web applications and gain illicit access to databases. It's heartening that your friend had a backup in place to restore the compromised database, but it underscores the necessity of addressing the fundamental security weaknesses.
Shutting down port 3306, the default port for MySQL, does indeed contribute to bolstering the overall security posture of the database server. By doing so, external access to the MySQL service is curtailed, thereby reducing the potential attack surface. This serves as a preemptive step to mitigate the risk of unauthorized entry and further exploitation.

It's crucial to understand that merely closing the port may not suffice as a comprehensive security measure. Adversaries are adept at identifying and exploiting vulnerabilities through various means such as social engineering, phishing, and advanced network reconnaissance. While closing port 3306 is an essential security practice, it should be integrated within a broader security strategy encompassing regular security updates, robust authentication mechanisms, encryption of data both in transit and at rest, and stringent access control policies.

Implementing additional security measures such as intrusion detection systems, employing firewalls, and conducting routine security audits can further fortify the defenses against potential threats. Remaining abreast of the latest security developments and best practices is imperative to adapt and reinforce defenses against evolving threats.