sql injection into a user agent header