in this case it was supposedly done using SQL injections: http://en.wikipedia.org/wiki/SQL_injection#Incorrectly_filte...