I know that other places in the code use $_POST or $_GET but this is a very unsafe method of getting variables and a security hole.

Please use http://de2.php.net/manual/en/function.filter-input.php to sanitize the inputs.

For example
```php
$challengeId  = filter_input(INPUT_POST, "challengeId", FILTER_SANITIZE_NUMBER_INT);
```