add image and text for SQL injection
add some comments