added notes regarding parameterized staments and SQL injection