Administrator authentication bypass via unsanitized SQL query

SQL injection in Abdurrab5 online-makeup-store allows remote attackers to bypass administrator authentication with crafted login credentials. The index.php login handler embeds POST id and password values inside a SELECT statement without parameterization, then creates an administrator session whenever the query returns a row. The login form is network-accessible without prior authentication, and successful injection grants administrative access to the store.