Sqldatareader Get Number From String Sql Injection Attack