"...if you go around trying to SQL inject a bunch of sites, you'll more than likely be getting a call from your ISP."

I seriously doubt any ISP monitors their customers' POST data for SQL-like text.

For the accreditation-minded this great vid was assembled by Jeff Crouse, currently a fellow at Eyebeam: http://www.jeffcrouse.info/