Given the cases of this backfiring on the person who reports it; what should I do?
Speaking from the vantage point of someone who tests applications for a living and helps manage many tens of concurrent projects: it is surprisingly easy to crash a site by dicking around with URLs trying to find SQL injections (here's a classic example: some other part of the system you weren't aware of caches every hit to the URL you're testing and displays a result based on it to users elsewhere; your query generates an exception, bang, feature dead).
If you noodle around with someone's application just to see how riddled with SQL injections it is, and you blow up their app, there's a decent change your actions were tortious. You can get sued. Nobody will care about your intentions; everyone (at least, everyone who matters) will tell you you shouldn't have been testing to begin with.
I think you're in a bit of a pickle, because I think it's also unethical to sit on your hands if you know a firm is putting its users at risk by fielding a comically insecure application. I'm on the side of "report anonymously". It's obviously possible to do this safely if you try hard enough, but I don't even think you need to try that hard.
A growing number of US companies, most notably Google and Facebook, now reward people who find vulnerabilities on their sites. They've deliberately made it much harder to grief people who test them for vulnerabilities. This is a trend you could reward by giving them more of your business.
I found something similar on one of my schools internal sites, there was even a disclaimer that said something along the lines of 'Please don't enter any semicolons or quotation marks...'. I just walked away from it. It's not worth getting in trouble because, for some reason, schools hire incredibly shitty web developers.
http://bugcrowd.com/list-of-bug-bounty-programs/
If you can't find it there you should send them an email and suggest they add it.