SQL injection testing methodology