PHP code used to query the database should be written using prepared statements rather than simple variable concatenation in SQL statement creation. Using prepared statements protects against SQL code injection, and makes it nigh-impossible to occur. Currently, our database is vulnerable to code injection based on the code in https://github.com/jnick1/MyCollege/commit/3c708bdf39037e7988d3348147ad31efc86b7fd3.
PHP code used to query the database should be written using prepared statements rather than simple variable concatenation in SQL statement creation. Using prepared statements protects against SQL code injection, and makes it nigh-impossible to occur. Currently, our database is vulnerable to code injection based on the code in https://github.com/jnick1/MyCollege/commit/3c708bdf39037e7988d3348147ad31efc86b7fd3.