SQL Injection in parameter REPORT