test for sql injection prevention using parameterized queries