I think the best way to go about that kind of thing would be to manually post your own values to the page in an attempt to break it with invalid input or test for SQL injection. See if you can make the server return sensitive information and work from there.

-Maestr0