Postgresql Json Contains String Sql Injection