1) mysqli_multi_query function is used to execute sql file (instead of exec insecure command).
2) I have removed hardcoded credentials from the code.