I'm currently a student in college. First semester of first year for the first 'real' programming course the school has offered, and we realized that they have told everyone to store their server login info in a connectvars.php file. 45 minutes and three tests later we had a script that was capable of outputting the username / password combo for any account on the schools server who had taken that course, ever.