Postgres Find In String Sql Injection