There is a website (still) out there I created many years ago. I won't tell which, but I'm pretty sure it's totally easy to SQL inject (haven't looked at the code for a while). Also it's one single, unindented PHP script powering the whole site. Admin auth is done via IP address.
But even back then, one thing I did was not store plain-text passwords. Okay, they're MD5'd, unsalted -- but at least not plain-text.