SQL injection protection in API