Issue 30: fix one case of small sqli