When working for a devshop a while back, one of our programmers discovered a SQL injection by using some non-alphabet characters in their health insurance password...

We informed them. Never checked to see if it was fixed :)