SQL injection vulnerability in WHERE clause allowing retrieval of hidden data