SQL injection attack to work