Spam Database with PHP code - php

Question

A friend of mine has made a website for his computer science class. He made a php script with which you can add a steamgame with it's ID (example, CS:GO with ID 730). My question is, is it possible to make a script.
Here is his code.
<?php
//$gamesxml = file_get_contents("http://api.steampowered.com/ISteamApps/GetAppList/v0001");
//$gamesjson = json_decode($gamesxml);
//$gamesarray = $gamesjson->applist->apps->app; //["applist"]["apps"]["app"];
set_time_limit(999999);
// Create mysql connection
$conn = mysqli_connect("", "", "", "");
#mysqli_select_db($conn, "gamereviews") or die("Unable to select database");
if(!array_key_exists("steamid", $_POST)){
echo "Er is geen steamid gegeven.";
return;
}
$steamid = htmlspecialchars($_POST["steamid"]);
$gamexml = file_get_contents("http://store.steampowered.com/api/appdetails?appids=" . $steamid);
$gamejson = json_decode($gamexml);
if ($gamejson->$steamid->success != "true") {
return;
}
$gamedata = $gamejson->$steamid->data;
if ($gamedata->type != "game") {
return;
}
//Data
$name = $gamedata->name;
$date = $gamedata->release_date->date;
$genres = "";
$genrefirst = true;
foreach ($gamedata->genres as $genre) {
if (!$genrefirst) {
$genres .= ", ";
}
$genrefirst = false;
$genres .= $genre->description;
}
$shortdescription = $gamedata->short_description;
$description = $gamedata->detailed_description;
$about = $gamedata->about_the_game;
$price = array_key_exists("price_overview", $gamedata) ? $gamedata->price_overview->initial : 0;
$languages = $gamedata->supported_languages;
$headerimage = $gamedata->header_image;
$website = $gamedata->website;
$metacritic_score = array_key_exists("metacritic", $gamedata) ? $gamedata->metacritic->score : -1;
$metacritic_url = array_key_exists("metacritic", $gamedata) ? $gamedata->metacritic->url : "";
$videourl = array_key_exists("movies", $gamedata) ? $gamedata->movies[0]->webm->max : "";
$recommendations = $gamedata->recommendations->total;
$backgroundimg = $gamedata->background;
//Statement 1: Verwijder alle games met hetzelfde appid
$stmt = mysqli_prepare($conn, "DELETE FROM games WHERE steamid=?");
$stmt->bind_param("s", $steamid);
if (!$stmt->execute()) {
echo "SQL 1 gefaald voor $steamid<br>";
return;
}
//Statement 2: Voeg nieuwe game toe
$stmt = mysqli_prepare($conn, "INSERT INTO games (name, steamid, date, genre, shortdescription, description, aboutthegame, price, languages, headerimg, website, metacritic_score,
metacritic_url, videourl, recommendations, backgroundimg) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)");
$stmt->bind_param("sisssssssssissis", $name, $steamid, $date, $genres, $shortdescription, $description, $about, $price, $languages, $headerimage, $website,
$metacritic_score, $metacritic_url, $videourl, $recommendations, $backgroundimg);
if (!$stmt->execute()) {
echo "SQL 2 gefaald voor $steamid<br>";
echo mysqli_error($conn);
return;
}
//
$result = #mysqli_query($conn, $stmt);
echo "true";
?>
This code will add it to the database. This is not the post script, which I can send too if you want.