I broke it. I was the "DROP TABLES" guy, and you'll want to sanitize the text before it goes into the db.

I typed

     "; DROP TABLE `users`;

Which made every person stop moving, and then on page reload nothing happens. (So the `users` table is dropped.)

Sorry!! I didn't mean to break it, I wanted to test it.