SQL Injection vulnerability in WHERE clause allowing retrieval of hidden data