security mistake in mysql