Fix SQL injection in the rest of the passman

passman-dev/php/passman/register.php

@@ -29,11 +29,19 @@ if ($_SERVER["REQUEST_METHOD"] === "POST") {
 		//}
 		require_once __DIR__ . "/config.php";
 
-		// Insert a new user
-		$sql_query = "INSERT INTO login_users (username,password) VALUES ('{$new_username}','{$new_password}');";
-		//echo $sql_query;
+		// Insert a new user using a prepared statement to prevent SQL injection.
+		$sql_query = "INSERT INTO login_users (username, password) VALUES (?, ?)";
+
+		$stmt = $conn->prepare($sql_query);
+		if ($stmt === false) {
+			$login_message = "Database error (prepare failed).";
+			$result = false;
+		} else {
+			$stmt->bind_param("ss", $new_username, $new_password);
+			$result = $stmt->execute();
+			$stmt->close();
+		}
 
-		$result = $conn->query($sql_query);
 
 		unset($_POST['new_username']);
 		unset($_POST['new_password']);