null injections means null injection string