Uhm, concatenating user controlled content into SQL queries? Do black marketeers today learn nothing at code school?

It is a good thing he took the site down promptly, else it would have been exploited in no time.