Mid String Sql Injection Attack