SQL injection vulnerable. Use placeholder PDO queries.

[prashnts]

In functions.php, the params are not quoted/escaped. This is a severe issue, vulnerable to most basic SQL injection attacks.

For a demo, try a POST req with $bill_id = "10\"); DROP TABLE purchase_list;--", which, er, deletes the table. :)

Pointers:

• http://php.net/manual/en/security.database.sql-injection.php
• http://php.net/manual/en/book.pdo.php

PDO looks intimidating at first, I used to drop a mixin for making it slightly less awkward. https://github.com/prashnts/TwoDotSeven/blob/96dba39439cb6cef601a46e89f8a3bca125bedd3/TwoDotSeven/database.php

[Ridhwanluthra]

it does not accept multiple queries, as in i cannot give anything after ;