Student Information Chatbot a0196ab allows SQL injection via the username to the login function in index.php.