Security evaluation of PHP and JS code

In the main webapp, an instructor runs a medical simulation scenario. A second webapp (the mirror monitor) shows the same numbers and waveforms on a second screen (another computer, tablet, or browser window). The attached image shows the main simulator in the foreground and the mirror monitor in the background. What gets sent to the mirror monitor is display data: heart rate, blood pressure, SpO2, gases, ventilator numbers, etc. This is training data only. It does include real patient names or clinical records. The main simulator issues a join code which is used connect to the mirror monitor. The main simulator POSTs data to the server and the mirror GETs and displays the data. The webapps are built using PHP and Javascript. I want an experienced programmer to review the code to make sure a hacker cannot inject malicious code.