add some small sqli using @variables