SQL injection vulnerability in WHERE clause with multiple conditions