SQL injection: Understanding mysql command