test injecting sql from stdin