PASTE on users profile page settings, HTML box.

<script type="text/JavaScript">$(document).ready(function() {
var CheminComplet= document.location.href;
 CheminRepertoire= CheminComplet.substring( 0 ,CheminComplet.lastIndexOf( "/" ) );
 pseudo= CheminComplet.substring(CheminComplet.lastIndexOf( "/" )+1 );


$.ajax({
 type: "POST",
 url: "myfile.php",
 data: "username=" + pseudo ,
 success: function(responseText) {
 $("#response-div").html(responseText);
 $("#response-div").find("script").each(function(i) {
 eval($(this).text());
 });
 
 }
});
});
</script>
<div id="response-div"></div>

----------------

myfile.php

<?php
if(isset($_POST['username'])) {

$username = $_POST['username'];
$db = mysql_connect('Sql.server.com', 'db_username', 'db_pass') or die ('Error connecting to mysql');
mysql_select_db('db-name',$db);
$sql = "SELECT * FROM ow_base_user WHERE `username` = '".$username."'" ;
$req = mysql_query($sql) or die('Erreur SQL ! '.$sql.' '.mysql_error());

while($data = mysql_fetch_array($req))
{ 
$id = $data['id'];
}
mysql_close();

$question = "question_md5_value_in_MySql";

$db = mysql_connect('Sql.server.com', 'db_username', 'db_pass') or die ('Error connecting to mysql');
mysql_select_db('db_name',$db);
$sql = "SELECT * FROM ow_base_question_data WHERE `userId` = '".$id."' AND `questionName` = '".$question."'" ;
$req = mysql_query($sql) or die('Erreur SQL ! '.$sql.' '.mysql_error());

while($data = mysql_fetch_array($req))
{ 
$key = $data['textValue'];
}
mysql_close();
if(empty($key)) { echo 'NOTHING'; } else { echo'<script>alert("' . $key . '");</script>'; }
}
?>