Ultimate Peter demonstrates how easy it is to find a vulnerable to SQL injection website and uses SQLmap to quickly find the users and passwords.
Remember, it is against the law to perform this type of testing on systems you do not own or have written permission to attack.