Fixing mysql injection attacks

api/REST.api.php

 <?php
+    require_once($_SERVER['DOCUMENT_ROOT']."/api/lib/Database.class.php");
     class REST {
 
         public $_allow = array();
@@ -103,6 +104,7 @@
             }else{
                 $data = trim(stripslashes($data));
                 $data = strip_tags($data);
+                $data = mysqli_real_escape_string(Database::getConnection(), $data);
                 $clean_input = trim($data);
             }
             return $clean_input;

api/index.php

@@ -52,8 +52,7 @@ class API extends REST {
         $st = microtime(true);
         if(isset($this->_request['pass'])){
             $cost = (int)$this->_request['cost'];
-            $s = new Signup("", $this->_request['pass'], "");
-            $hash = $s->hashPassword($cost);
+            $hash = password_hash($this->_request['pass'], PASSWORD_BCRYPT);
             $data = [
                 "hash" => $hash,
                 "info" => password_get_info($hash),

verify.php

 <?php
 
 require_once $_SERVER['DOCUMENT_ROOT'].'/api/lib/Signup.class.php';
+require_once($_SERVER['DOCUMENT_ROOT']."/api/lib/Database.class.php");
 
-$token = $_GET['token'];
+$token = mysqli_real_escape_string(Database::getConnection(), $_GET['token']);
 try{
     if(Signup::verifyAccount($token)){
         ?>