why sql injection vulnerabilities still exist