test for sql injection