how to identify sql injection point