"Repaired" SQL injections with `POST.userID`