[D7] SQL layer: $match_operator is vulnerable to injection attack