The code is bad and it contains security vulnerabilities intentionally. Shouldn't be used for other purpose than the workshop.
Workshop book: https://visualitypl.github.io/web-apps-security-workshop/
Workshop repo: https://github.com/visualitypl/web-apps-security-workshop