added test case to verify that malicious SQL can be executed