I wonder how vulnerable this setup is to sql-injection attacks and similar stuff.