Hi, author here. I have no doubt you’re right. My only lines of defense are that (1) I didn’t use MySQL directly and I didn’t open myself up to injection attacks, and (2) I stopped being a PHP dev years before 2013. This is custom, legacy code still powering my humble personal site after over a decade.