mark small sqli in form of 1-- .. sp_password