you can login to any account use the password "' or 'a'='a'or'a'='a".
Fixed by 张小飞 in this branch: https://github.com/lanlab-org/EnglishPal/tree/SPM-Spring2021-2599-%E5%BC%A0%E5%B0%8F%E9%A3%9E201831990641 Jenkins: http://121.4.94.30:8080/job/%E5%A4%9A%E5%88%86%E6%94%AF%E6%B5%81%E6%B0%B4%E7%BA%BF-%E6%9C%B1%E6%96%87%E7%90%A6-%E5%BC%A0%E5%B0%8F%E9%A3%9E/job/SPM-Spring2021-2599-%E5%BC%A0%E5%B0%8F%E9%A3%9E201831990641/ -Hui