Fix reflected XSS in server PHP endpoints

[devin-ai-integration]

Summary

Security scan of the repo. The only server-side attack surface is server/*.php; the rest is static tutorial content and a client-side helper library. This PR fixes the critical, unambiguous issues found: reflected XSS in the two PHP endpoints that echo request parameters straight into HTML.

Fixed (critical — reflected XSS):

• server/profile.php — $_POST['name'] / $_GET['name'] were concatenated into the HTML response unescaped. Now wrapped:

  $name = htmlspecialchars($_POST['name'], ENT_QUOTES, 'UTF-8');
  // ... "Name Is : "'.$name.'"

  (same for the GET branch). Previously ?name=<script>alert(1)</script> executed in the victim's browser.
• server/about.php — echo "ABOUT PAGE ".$_GET['p'] now escapes p with htmlspecialchars(..., ENT_QUOTES, 'UTF-8').

Findings not changed here (reported, not fixed)

• Outdated dependency: asset/jquery.js is jQuery 3.2.1, affected by CVE-2019-11358 (prototype pollution) and CVE-2020-11022/11023 (XSS, fixed in 3.5.0). Recommend bumping to a current 3.x (e.g. 3.7.1). Left out of this PR since it's a vendored minified file and could affect the tutorial behavior — happy to do it in a follow-up.
• No hardcoded secrets: the token values throughout code/ and page/ are demo values generated by _randomStr(...), not real credentials.
• No SQL injection: there is no database access anywhere in the repo.
• No CORS misconfig / no exposed debug endpoints. server/json.php returns a static mock (status_login:false, id_user:12) — demo data, not a real auth endpoint.

No PHP linter available in the environment; edits are minimal htmlspecialchars wraps around existing string concatenation.

Link to Devin session: https://app.devin.ai/sessions/74b1ccef57234e81ab5e85dbbdd6a08e
Requested by: @lamhotsimamora

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring