I realize I'm pulling a huge cop-out by expecting that there aren't malicious users in terms of input (especially since the text fields are entered by an admin who presumably doesn't want to destroy their database), passwords are stored in the clear, etc. For this reason all that's in this database is volunteer names and hours, as the coordinator and I agreed that the less personal information is present, the better. :)

I'd love to get others involved in the project whose needs are slightly different and thus might have a motivation for doing a security audit, etc.