Wrapping up – (No-)SQL injection in theory