SQL Injection flaws discovery