this codebase is riddled with sql injection vulnerabilities; fix some of the key vulnerabilities in login/session code