why sql injection doesn't work now?