SQL? does rfO PH uses SQL as their database?
and who the heck would code a password table without encryption to the database.
also i think that the character database is not linked with the map and chat database, and maybe in the account database,(character DB hold char info while Account db holds user pass info)
sql command injection?
query password where username = user of the person im trading now?
well i can't really say but i think that such thing has low percentage of becoming true.
but still not impossible
but if you are knowledgable enough, you may say that the information that you can get from the "trade/deal" is the same from the information that you can get from his name. i.e.
grab from charactertable
where charname=name
or
grab from accounttable
where tradeid=userid
just my opinion