read about SQL Injection here:
SQL injection - Wikipedia, the free encyclopedia
In my POV:
SQL injection isn't that easy, since you need the SOURCE code of the program.
also, after having the source code, you must search for a vulnerable code inside the program.
for example the server crasher using the abc' =)
since private server file scripts have incorrectly filtered SQL Statements, so you can use it to inject your own SQL Statement to make your character a GM, but the RF Server Files have something to counter it, it disconnects all users from itself and avoids SQL Injection. :)