SQL Injection may be possible

[oEscal]

At this moment, most database queries are made using string concatenation without escaping the user input, which might allow an attacker to achieve SQL Injection.
Since ReLiS is using CodeIgniter to access the database, it is probably more recommended to use its query bindings, which automatically escape the introduced query values.