NOTE on SQL injection vulnerability in 1.2.6 (thanks to @ebeigarts)