added a sql injection vulnerability