fix sql injection specs for passing multiple arguments