added test for SQL injection