find or create user. sql security patch