added a note on SQL injections as well