Implement a best-practice and a worst-practice version to demonstrate the importance of CORS.

In order to properly present CORS as a vulnerability, it makes sense to have a dead-simple third-party web app running on a different port, calling a protected and an unprotected endpoint of the main app.

To do so, the repo structure needs to be restructured, to give place for multiple modules.

Goals

Create a worst and a best practice example on database querying. The former should not sanitize user input at all and should be vulnerable to arbitrary SQL execution while the latter should be safe.