Update routes.py

routes.py

@@ -50,6 +50,11 @@ def register():
         if existing_user:
             return render_template('register.html', error='Username already taken')
 
+### Implementing fix for broken access control:
+#        cursor.execute("INSERT INTO users (username, password, guest) VALUES (?, ?, ?)",
+#                      (username, password, guest))
+###
+
         cursor.execute("INSERT INTO users (username, password) VALUES (?, ?)",
                        (username, password))
         connection.commit()