Hacker News Reader

It's perfectly possible to accidentally stumble across SQL injection.

E.g. my street address growing up was 1901 Mayor's Road.

Yeah, I had a hard time with my street address: 5987 O'Drop Table users; Go

Did he do anything that wasn't simply a GET/POST/PUT?

The article supposed that's what he did, and it probably is.