Mid String Sql Injection Vulnerability