I feel like I just watched the original first presentation of SQL injection - this is that big a deal. (I can't find the link, but the guy who gave that presentation thought it bombed because people started getting up and walking out five minutes into his talk - it turned out they were trying to get to the pay phones first so they could call back to their offices and alert them that the world had just been lit on fire).