add inf leakage and sql inject