add read note for SQL injection