Security issues in string inputs for database