This question already has an answer here:
A chap I'm bidding to do some development for has a social network he wrote himself. Not the next facebook by any stretch. But a few thousand local users.
I went to have a look at it to see what level of knowledge he had so I knew how to position myself for this potential job.
I tapped a single quote into the login box on the front page and up pops a SQL error. So I tried a simple " a' or 'a'='a " in each box and was immediately logged in as the administrator.
He had written a fairly comprehensive administration site by the looks of things. At the bottom of the page a "Download SQL Backup" button. This is where I stopped.
My question is this. What do I do?
As a developer myself I would appreciate the heads up. But as someone who's hopefully going to be paid to do some work for him I wouldn't want to throw all sorts of trust issues into the mix.