As to the SQL injections I've seen examples of people making themselves registered as admins when they register a new (user) account. They need to know how you structure your tables though, but appending admin=1 to the sql injection would often do the trick.
that is why you rarely use admin as a column name it is better to use status and have a general settin 1 = normal users 5 = admin, 2 = moderators, 3= banned, 4= what ever else.