PL or SQL : Code injection