[Sithlord]

I like Java and when it comes to PHP and SQL I'm not exactly the greatest developer so I do apologize in advance if this seems somewhat silly.

I know the basics of PHP and SQL long story short I've hacked a university using a manual UNION injection on one of their $_GET lines of code ... why this this still an issue, why don't people just use $_POST? What developer is really that bad especially considering this place is a prestige and well known Australian university. It just seems insane that this security flaw would even exist.

[Hooded Robin]

$_POST wouldn't make it any safer, so securing this would potentially elude even you :p

You need to implement some type of sanitizing routine before using any user supplied data, and how you sanitize depends on how you're using said data (db, rendered view, commands, etc)...

[Kyle1995]

This made me laugh lol

$_GET is just as insecure as $_POST, it isn't where the vulnerability comes in, it's the actual sql part. Keep it up though, it's good you're actually getting familiar with the code, even if it's new to you.

[Viktory]

$_GET is just as insecure as $_POST

neither are "insecure" per se, they're just methods to exchange data. It's the incorrect implementation of these is where vulnerabilities are introduced.