When parameterization fails: SQL injection in Nim using parameterized queries