If SQL injection is picking a lock, this is entering through an unlocked door.

Not sophisticated at all, authentication on API routes is way earlier on the security checklist than SQL query sanitisation. This site is amateur work.