Notification system and SQL injection