sql injection retrieving multiple values in a single column