novslugger / scoreboard Goto Github PK

Hi, was checking out your scoreboard code and wanted to let you know, in case you didn't know, that your code is succeptible to SQL injections.

Your SQL statements uses raw input from forms that users submit and they can then be hijacked to pretty much whatever they want with it.

Example here:

You should avoid doing it this way, and rather using prepared statements for building SQL statements where user submitted data is accepted.

Check out this video about SQL injections by Tom Scott: https://www.youtube.com/watch?v=_jKylhJtPmI
Tutorial on how to use prepared statements: https://www.tutorialrepublic.com/php-tutorial/php-mysql-prepared-statements.php

Hope this is helpful.