Schoolmate 1.3 is vulnerable to SQL Injection in the variable $schoolname from Database at ~\header.php.