The strength of the SQL injection has been demonstrated with an attack on a large internet service provider.