Rewrite SQL-injection explanation and 2 references