fixed points of SQL injection