moba avoid sql injection