Started writing parametrized queries in some places, stored a password hash instead of a password.