this one shouldn't lead to injection but isn't it a bit too "open"? e.g. should we ban users with login name "(Login failed):"?