SQL Injection Isn't Dead: Smuggling Queries at the Protocol Level