I wouldn't even attempt to report it anonymously. I found something similar on one of my schools internal sites, there was even a disclaimer that said somethin

I wouldn't even attempt to report it anonymously. I found something similar on one of my schools internal sites, there was even a disclaimer that said something along the lines of 'Please don't enter any semicolons or quotation marks...'. I just walked away from it. It's not worth getting in trouble because, for some reason, schools hire incredibly shitty web developers.