Will browsing through my attendance on my schools registration system, I started playing with the URL so I could see the data I wanted, through doing this I noticed so major SQL injection vulnerabilities that gave me the ability to alter the data and view other students.
Given the cases of this backfiring on the person who reports it; what should I do?
Speaking from the vantage point of someone who tests applications for a living and helps manage many tens of concurrent projects: it is surprisingly easy to crash a site by dicking around with URLs trying to find SQL injections (here's a classic example: some other part of the system you weren't aware of caches every hit to the URL you're testing and displays a result based on it to users elsewhere; your query generates an exception, bang, feature dead).
If you noodle around with someone's application just to see how riddled with SQL injections it is, and you blow up their app, there's a decent change your actions were tortious. You can get sued. Nobody will care about your intentions; everyone (at least, everyone who matters) will tell you you shouldn't have been testing to begin with.
I think you're in a bit of a pickle, because I think it's also unethical to sit on your hands if you know a firm is putting its users at risk by fielding a comically insecure application. I'm on the side of "report anonymously". It's obviously possible to do this safely if you try hard enough, but I don't even think you need to try that hard.
A growing number of US companies, most notably Google and Facebook, now reward people who find vulnerabilities on their sites. They've deliberately made it much harder to grief people who test them for vulnerabilities. This is a trend you could reward by giving them more of your business.