SQL injection vulnerability

[oxguy3]

In getData.php, data is passed directly from the $_GET array to an SQL query. If the user were to pass something malicious in as GET input, they would have complete control of the database. The user input should be passed in a parameters; see http://bobby-tables.com/php for more info about avoiding SQL injection vulnerabilities in PHP.

[northlandiguana]

And how exactly would a user do that, since the only things passed to getdata.php are variables hard-coded in the JavaScript? There's no form data here.

[oxguy3]

They could simply edit the source code of the web page to allow other values, or even manually build a malicious request with cURL or Postman or some other HTTP utility. You can't trust that the user is going to load your HTML and JS without modifying it; you have to check everything they send you on the server-side.