Hacking a SQL Server is always talking point when we discussed the implementation of a Sql Server Read this for more information which is written by Joel Scambray and Stuart McClure http://www.eeproductcenter.com/analog/review/showArticle.jhtml?articleID=162100375
The issue here is administrators and application programmers who have no concept of security. This is not a SQL Server issue. Build a non secure interface or use high privilige accounts with weak passwords and you are asking for trouble, be it SQL Server or any other database or backend system.
Dear Sir, If we dont have password for "SA" or a weak password and any single machine is accessing Internet outside then hacker can perform SQL INJECTION....so the best practice is to have a strong password and staying behind firewall and most important ristrict outbound connection from SQL Port(1433 or better change the port)outside lan. hsGoswami ghemant@gmail.com
not only that there are few more things to do http://vyaskn.tripod.com/sql_server_security_best_practices.htm for comprehensive security in SQL Server, look http://www.sqlsecurity.com/DesktopDefault.aspx