How to find a vulnerability in a custom bike?

Question

PHP

In my free time from my main work (SEO-optimizer) I study the back-end and saw a self-made bicycle: walkweb.ru/cms (so far only for educational purposes, this scooter does not pretend to be anything serious) I
posted links on php-forums, and today found that one visitor was able to:
1) post as a user that cannot be logged in (I won't go into details why);
2) place posts in such a way that his account does not receive experience and gold, although in the code this functionality is on adjacent lines (adding a post -> checking for a successful response -> adding gold and experience to the account).
One gets the feeling that direct access to the MySQL database was obtained, but: 1) how? 2) why not just delete the database?
What has been done on the site in terms of security:
1) signs < > are escaped
2) all requests to the database go through prepare
It would be great if someone can do a similar "feint with their ears" and tell how he did it.

Answer 1

One gets the feeling that direct access to the MySQL database was obtained, but: 1) how?

Obviously, somewhere you have sql injection possible .

Answer 2

No, no and NO.
You need to filter everything, absolutely all the data that can come from the user. Imagine that your website visitors are exclusively hackers. Write code exclusively with this condition.

Answer 3

See request logs

Answer 4

1) post on behalf of a user who cannot be logged in (I will not go into details why);
The author id field in the form of adding an article does not tell you about the possibility of manually putting down the author's id?

Answer 5

Of the non-critical errors, you have insufficient filtering of incoming data, for example:
http://walkweb.ru/cms/post.php?p[]
http://walkweb.ru/cms/profile.php?user[]
http: //walkweb.ru/cms/profile.php?list[]
and so on

Answer 6

Look here