SQL injection vulnerabilities