SQL injection in external database enrol plugin?