Javascript Where In Array Sql Injection