SQL Injection exploits for with and without WAF