I thought of something useful last night - a script that checks for SQL injection.
I have to mark this with a caveat - preventing that sort of stuff is best done by only allowing certain types of characters (ie, no symbols, only letters, as a basic example...), but attempting to write something like that to check it after the fact would be good experience parsing strings checking for symbols, encoded symbols in hex or other ways, etc..., and would highlight/reinforce how much better it is to only allow a set character base.