Adding string sql injection