The Admission Form That Trusted the Browser

O'Brien. In the concatenated string the apostrophe in O'Brien closes the SQL string literal early, so MySQL receives ... VALUES ('12', 'O'Brien', '85') and reports a syntax error near 'Brien'. The query never runs. The PHP side is no better: because the literal uses double quotes, PHP also interpolates $name directly, so there is no layer at all between user text and SQL grammar.

The injection. ' OR '1'='1 in the roll box turns the WHERE clause (or the VALUES list) into a tautology, so the SELECT behind the results page returns every row. The same trick with '; DROP TABLE applicants; -- would be destructive. Note this only 'worked' because the tester typed it - an attacker does not need the form, only an HTTP POST, which is why the JavaScript check is irrelevant here.

Fix:

$stmt = $pdo->prepare('INSERT INTO applicants (roll, name, marks) VALUES (?, ?, ?)');
$stmt->execute([$roll, $name, $marks]);

With a prepared statement MySQL compiles the statement structure first - the placeholders are fixed - and then binds the values separately. The value O'Brien is never re-parsed as SQL, so the apostrophe is just a character; the same binding makes ' OR '1'='1 an ordinary string that matches no roll number. Use the same pattern for the merit-list SELECT, and never interpolate a value into a string, even for numbers.

Claim is wrong. JavaScript runs in the applicant's browser, on a page the applicant controls. It is skipped by disabling JavaScript, by saving the page and editing it, or by sending a POST with curl or Postman - none of which ever load the script. Its only real value is convenience: fast feedback before the round trip. Anything that affects the database must be re-checked on the server, because the server is the only place the school controls.

Server-side check:

$raw   = $_POST['marks'] ?? '';
$marks = filter_input(INPUT_POST, 'marks', FILTER_VALIDATE_INT,
                      ['options' => ['min_range' => 0, 'max_range' => 100]]);
if ($marks === false) {
    $errors[] = 'Marks must be a whole number between 0 and 100.';
}

Reasoning behind each choice: filter_input reads the POST source directly and returns false for '85abc', ' 85 ' with letters, an empty string, or 101, so one call covers type and range; the strict === false test is essential because a valid 0 is falsy and if (!$marks) would wrongly reject it; the raw value is kept only so the form can be re-displayed. On failure the script must not execute the INSERT - it should re-render the form with the previous values escaped through htmlspecialchars() and the error messages shown to the applicant. Validation and output escaping are separate jobs: validation keeps bad data out, escaping keeps stored data from breaking the page.

The column is VARCHAR(10), so MySQL sorts it as text, comparing character by character. '100' and '9' both start with different characters; '1' has a lower code than '9', so '100' sorts before '9'. Likewise '9' sorts after '87' because '9' > '8'. The list is alphabetically ordered, not numerically ordered - the numbers are being stored as words.

Quick fix (query level):

SELECT roll, name, marks FROM applicants ORDER BY CAST(marks AS UNSIGNED) DESC;

This works for display, but the CAST runs on every row, so an index on marks cannot be used, and any other query (averages, filters marks > 80, comparisons with pass marks) has to remember the cast. It also lets '85 ' and '85' both exist, and lets '82abc' exist at all.

Correct fix (schema level):

ALTER TABLE applicants MODIFY marks TINYINT UNSIGNED NOT NULL;

TINYINT UNSIGNED holds 0–255, exactly the required range, in one byte, sorts numerically and indexes properly, and rejects non-numeric text at the database boundary - a second line of defence behind the PHP filter. The general principle for the exam: choose the column type from the meaning of the data, not from what happens to type easily into the form. Zero-padding to three digits ('085') would also make text sorting look correct, but it is cosmetic and breaks the moment a value exceeds three digits.