Various XSS/SQL injection attacks

Just try

``` html
">'>alert(1)
```

in various input fields. Remember the basic mantra of filter input and escape output.

Just as any SQL administrator would be worried about SQL injection, they should be weary of other injections.

I imagine it's known that the basic search page is SQL injection vulnerable just taking the input to concat queries.

If you're thinking these are both trivial b/c why would you shoot yourself in the foot? Here is my use case.

As a DB Admin I would like to provide this tool to engineering teams to help identify problems. With sufficiently large userbase you still need to worry about the true evil actor, the innocently curious dev, or the troll that wants bragging rights.

I do greatly appreciate your effort in developing this but think addressing XSS concerns would go a long way to encourage wider adoption of your tool.

For the SQL injection potential I've made the webapp db account read only. (Crippling notes functionality but am ok with that).

Further still with no access controls and the "1=1" where to dump everything in a go, I've altered the schema for the samples to be char(0) to prevent any actual production data leakage.