[FIX] SQL Level 5, variable should not be inside string single-quotes

[lacksfish]

Line 50 $query = "SELECT bookname,authorname FROM books WHERE number =".'$number';

in sql5.php will never work, as '$number' is a string.

Asuming this was an error, this PR fixes this issue.

[lacksfish]

I'm contemplating what that line should've looked like

Possible intentions could have been:

$query = "SELECT bookname,authorname FROM books WHERE number ="."'$number'"; or similarly $query = "SELECT bookname,authorname FROM books WHERE number =".$number;

I've also thought about this possibility: $query = "SELECT bookname,authorname FROM books WHERE number ='". $number . "'";

Either way, the current line is bugged, since it is taking $number as the literal string input each time. The value from $_POST['number'] is never used as of now.

[JonasPertschy]

Thank you 👍🏻 I encountered the same issue. None of my static/dynamic scanners were able to spot the vulnerability because there is none. '$number' is not user-controlled data.