sql injection through search field how to validate it