SQL injection, tile ID

How it was found

The tile ID parameter to the tile image script is vulnerable to SQL injection.

The following will cause the script to run a benchmark, returning 8-10 seconds later:

https://staging.uzbey.com/tiles1600/693/sleep(10)