added oracle sql inj support