https://www.junookyo.com/2012/10/jcore-10pre-cross-site-scripting-sql.html