My friend said he did a SQL injection and it gave all the users passwords, he showed me mines aswell so I know he wasn't lieing.Would help if we knew what kind:
In-game?
On the site?
If it's on the site, What is it? Can you give us the code to fix it?