Category testing for sql injection vulnerabilities