- separate controller for good/bad
- initiated SQL injection sample