PHP vurnabilities details.php

<?php
    require_once ("database_utils.php");
    initDB();

    $errors = array();
?>
<html>
    <head>
        <title>Bioskop | Detalji</title>
        <link rel="stylesheet" type="text/css" href="css/style.css">
        <link href="https://fonts.googleapis.com/css?family=Spectral+SC" rel="stylesheet">
    </head>
    <body>
        <h1>Detalji rezervacije</h1>
        <a href="./"><button>Povratak na početnu stranu</button></a>
        <!-- Nije direktno podlozan -->
        <?php
            $reservation_movie_id = "";
            $reservation_seat = "";
            if (isset($_GET["movie"])) {
                $reservation_movie_id = $_GET["movie"];
            }
            if (isset($_GET["seat"])) {
                $reservation_seat = $_GET["seat"];
            }

            $seat_exploded = explode("-", $reservation_seat);
            $row = "-";
            $col = "-";
            if (count($seat_exploded) == 2) {
                $row = $seat_exploded[0];
                $col = $seat_exploded[1];
            } else {
                $errors[] = "Format sedišta nije odgovarajući.";
            }

            $reservation = getReservation($reservation_movie_id, $reservation_seat);
            $reservation[COL_RES_NAME] = htmlspecialchars($reservation[COL_RES_NAME]);
            $reservation[COL_RES_PHONE] = htmlspecialchars($reservation[COL_RES_PHONE]);
            $reservation[COL_RES_EMAIL] = htmlspecialchars($reservation[COL_RES_EMAIL]);
            if ($reservation) {
                echo "<h2>Rezervacija za film {$reservation[COL_MOVIE_NAME]}, red $row, kolona $col</h2>";
                echo "<p>Ime: <b>{$reservation[COL_RES_NAME]}</b></p>";
                echo "<p>Telefon: <b>{$reservation[COL_RES_PHONE]}</b></p>";
                echo "<p>Email: <b>{$reservation[COL_RES_EMAIL]}</b></p>";
            } else {
                $errors[] = "Tražena rezervacija ne postoji.";
            }
        ?>
        <div class="errors">
            <?php
                foreach ($errors as $error) {
                    echo "<div>$error</div>";
                }
            ?>
        </div>
    </body>
</html>