attempt to use SQL injection as well