The project has multiple SQL injection vulnerabilities

[toothless-c]

This code has an SQL injection vulnerability because the user-supplied input (i.e. 'username' and 'password') is directly concatenated into the SQL statement when the SQL query is constructed without adequate filtering and escaping. This allows a malicious user to tamper with the original SQL statement by entering specific characters, as shown in the following methods.

Vulnerability exploitation：

Repair suggestion：
The best way to fix SQL injection vulnerabilities is to use parameterized queries (Prepared Statements) to build SQL statements.