From 56e0c7d30b0309fba97a0c8e47c75069dd8b2744 Mon Sep 17 00:00:00 2001
From: johnnyq <johnny@pittpc.com>
Date: Thu, 16 Feb 2023 14:54:49 -0500
Subject: [PATCH] Updated new models with santizeInput function to reduce
 clutter

---
 models/category.php |  6 +++---
 models/client.php   | 12 ++++++------
 models/company.php  | 20 ++++++++++----------
 models/event.php    | 10 +++++-----
 models/expense.php  |  6 +++---
 models/invoice.php  |  4 ++--
 models/product.php  |  4 ++--
 models/quote.php    |  4 ++--
 models/tag.php      |  6 +++---
 models/transfer.php |  4 ++--
 models/trip.php     |  8 ++++----
 models/user.php     |  4 ++--
 models/vendor.php   | 22 +++++++++++-----------
 post.php            | 12 ++++++------
 14 files changed, 61 insertions(+), 61 deletions(-)

diff --git a/models/category.php b/models/category.php
index a98cfe64..92b0c6ba 100644
--- a/models/category.php
+++ b/models/category.php
@@ -1,4 +1,4 @@
 <?php
-$name = trim(strip_tags(mysqli_real_escape_string($mysqli, $_POST['name'])));
-$type = trim(strip_tags(mysqli_real_escape_string($mysqli, $_POST['type'])));
-$color = trim(strip_tags(mysqli_real_escape_string($mysqli, $_POST['color'])));
+$name = sanitizeInput($_POST['name']);
+$type = sanitizeInput($_POST['type']);
+$color = sanitizeInput($_POST['color']);
diff --git a/models/client.php b/models/client.php
index d603d5dc..f0715d20 100644
--- a/models/client.php
+++ b/models/client.php
@@ -1,8 +1,8 @@
 <?php
-$name = trim(strip_tags(mysqli_real_escape_string($mysqli, $_POST['name'])));
-$type = trim(strip_tags(mysqli_real_escape_string($mysqli, $_POST['type'])));
-$website = trim(strip_tags(mysqli_real_escape_string($mysqli, $_POST['website'])));
-$referral = trim(strip_tags(mysqli_real_escape_string($mysqli, $_POST['referral'])));
-$currency_code = trim(strip_tags(mysqli_real_escape_string($mysqli, $_POST['currency_code'])));
+$name = sanitizeInput($_POST['name']);
+$type = sanitizeInput($_POST['type']);
+$website = sanitizeInput($_POST['website']);
+$referral = sanitizeInput($_POST['referral']);
+$currency_code = sanitizeInput($_POST['currency_code']);
 $net_terms = intval($_POST['net_terms']);
-$notes = trim(strip_tags(mysqli_real_escape_string($mysqli, $_POST['notes'])));
+$notes = sanitizeInput($_POST['notes']);
diff --git a/models/company.php b/models/company.php
index b03acaa0..49154caa 100644
--- a/models/company.php
+++ b/models/company.php
@@ -1,12 +1,12 @@
 <?php
-$name = trim(strip_tags(mysqli_real_escape_string($mysqli, $_POST['name'])));
-$address = trim(strip_tags(mysqli_real_escape_string($mysqli, $_POST['address'])));
-$city = trim(strip_tags(mysqli_real_escape_string($mysqli, $_POST['city'])));
-$state = trim(strip_tags(mysqli_real_escape_string($mysqli, $_POST['state'])));
-$zip = trim(strip_tags(mysqli_real_escape_string($mysqli, $_POST['zip'])));
-$country = trim(strip_tags(mysqli_real_escape_string($mysqli, $_POST['country'])));
+$name = sanitizeInput($_POST['name']);
+$address = sanitizeInput($_POST['address']);
+$city = sanitizeInput($_POST['city']);
+$state = sanitizeInput($_POST['state']);
+$zip = sanitizeInput($_POST['zip']);
+$country = sanitizeInput($_POST['country']);
 $phone = preg_replace("/[^0-9]/", '',$_POST['phone']);
-$email = trim(strip_tags(mysqli_real_escape_string($mysqli, $_POST['email'])));
-$website = trim(strip_tags(mysqli_real_escape_string($mysqli, $_POST['website'])));
-$locale = trim(strip_tags(mysqli_real_escape_string($mysqli, $_POST['locale'])));
-$currency_code = trim(strip_tags(mysqli_real_escape_string($mysqli, $_POST['currency_code'])));
+$email = sanitizeInput($_POST['email']);
+$website = sanitizeInput($_POST['website']);
+$locale = sanitizeInput($_POST['locale']);
+$currency_code = sanitizeInput($_POST['currency_code']);
diff --git a/models/event.php b/models/event.php
index 3414035b..a55272c5 100644
--- a/models/event.php
+++ b/models/event.php
@@ -1,9 +1,9 @@
 <?php
 $calendar_id = intval($_POST['calendar']);
-$title = trim(strip_tags(mysqli_real_escape_string($mysqli, $_POST['title'])));
-$description = trim(strip_tags(mysqli_real_escape_string($mysqli, $_POST['description'])));
-$start = trim(strip_tags(mysqli_real_escape_string($mysqli, $_POST['start'])));
-$end = trim(strip_tags(mysqli_real_escape_string($mysqli, $_POST['end'])));
-$repeat = trim(strip_tags(mysqli_real_escape_string($mysqli, $_POST['repeat'])));
+$title = sanitizeInput($_POST['title']);
+$description = sanitizeInput($_POST['description']);
+$start = sanitizeInput($_POST['start']);
+$end = sanitizeInput($_POST['end']);
+$repeat = sanitizeInput($_POST['repeat']);
 $client = intval($_POST['client']);
 $email_event = intval($_POST['email_event']);
diff --git a/models/expense.php b/models/expense.php
index b560a2c7..dbf4bad6 100644
--- a/models/expense.php
+++ b/models/expense.php
@@ -1,8 +1,8 @@
 <?php
-$date = trim(strip_tags(mysqli_real_escape_string($mysqli, $_POST['date'])));
+$date = sanitizeInput($_POST['date']);
 $amount = floatval($_POST['amount']);
 $account = intval($_POST['account']);
 $vendor = intval($_POST['vendor']);
 $category = intval($_POST['category']);
-$description = trim(strip_tags(mysqli_real_escape_string($mysqli, $_POST['description'])));
-$reference = trim(strip_tags(mysqli_real_escape_string($mysqli, $_POST['reference'])));
+$description = sanitizeInput($_POST['description']);
+$reference = sanitizeInput($_POST['reference']);
diff --git a/models/invoice.php b/models/invoice.php
index 23f0c7a5..40fad24a 100644
--- a/models/invoice.php
+++ b/models/invoice.php
@@ -1,4 +1,4 @@
 <?php
-$date = trim(strip_tags(mysqli_real_escape_string($mysqli, $_POST['date'])));
+$date = sanitizeInput($_POST['date']);
 $category = intval($_POST['category']);
-$scope = trim(strip_tags(mysqli_real_escape_string($mysqli, $_POST['scope'])));
+$scope = sanitizeInput($_POST['scope']);
diff --git a/models/product.php b/models/product.php
index 01807345..61952a09 100644
--- a/models/product.php
+++ b/models/product.php
@@ -1,6 +1,6 @@
 <?php
-$name = trim(strip_tags(mysqli_real_escape_string($mysqli, $_POST['name'])));
-$description = trim(strip_tags(mysqli_real_escape_string($mysqli, $_POST['description'])));
+$name = sanitizeInput($_POST['name']);
+$description = sanitizeInput($_POST['description']);
 $price = floatval($_POST['price']);
 $category = intval($_POST['category']);
 $tax = intval($_POST['tax']);
diff --git a/models/quote.php b/models/quote.php
index 23f0c7a5..40fad24a 100644
--- a/models/quote.php
+++ b/models/quote.php
@@ -1,4 +1,4 @@
 <?php
-$date = trim(strip_tags(mysqli_real_escape_string($mysqli, $_POST['date'])));
+$date = sanitizeInput($_POST['date']);
 $category = intval($_POST['category']);
-$scope = trim(strip_tags(mysqli_real_escape_string($mysqli, $_POST['scope'])));
+$scope = sanitizeInput($_POST['scope']);
diff --git a/models/tag.php b/models/tag.php
index fbf16a5a..4fb87800 100644
--- a/models/tag.php
+++ b/models/tag.php
@@ -1,5 +1,5 @@
 <?php
-$name = trim(strip_tags(mysqli_real_escape_string($mysqli, $_POST['name'])));
+$name = sanitizeInput($_POST['name']);
 $type = intval($_POST['type']);
-$color = trim(strip_tags(mysqli_real_escape_string($mysqli, $_POST['color'])));
-$icon = trim(strip_tags(mysqli_real_escape_string($mysqli, $_POST['icon'])));
+$color = sanitizeInput($_POST['color']);
+$icon = sanitizeInput($_POST['icon']);
diff --git a/models/transfer.php b/models/transfer.php
index 355534b3..d787045a 100644
--- a/models/transfer.php
+++ b/models/transfer.php
@@ -1,6 +1,6 @@
 <?php
-$date = trim(strip_tags(mysqli_real_escape_string($mysqli, $_POST['date'])));
+$date = sanitizeInput($_POST['date']);
 $amount = floatval($_POST['amount']);
 $account_from = intval($_POST['account_from']);
 $account_to = intval($_POST['account_to']);
-$notes = trim(strip_tags(mysqli_real_escape_string($mysqli, $_POST['notes'])));
+$notes = sanitizeInput($_POST['notes']);
diff --git a/models/trip.php b/models/trip.php
index 0d718ba8..a70f426a 100644
--- a/models/trip.php
+++ b/models/trip.php
@@ -1,9 +1,9 @@
 <?php
-$date = trim(strip_tags(mysqli_real_escape_string($mysqli, $_POST['date'])));
-$source = trim(strip_tags(mysqli_real_escape_string($mysqli, $_POST['source'])));
-$destination = trim(strip_tags(mysqli_real_escape_string($mysqli, $_POST['destination'])));
+$date = sanitizeInput($_POST['date']);
+$source = sanitizeInput($_POST['source']);
+$destination = sanitizeInput($_POST['destination']);
 $miles = floatval($_POST['miles']);
 $roundtrip = intval($_POST['roundtrip']);
-$purpose = trim(strip_tags(mysqli_real_escape_string($mysqli, $_POST['purpose'])));
+$purpose = sanitizeInput($_POST['purpose']);
 $user_id = intval($_POST['user']);
 $client_id = intval($_POST['client']);
diff --git a/models/user.php b/models/user.php
index edfbe562..1790a99e 100644
--- a/models/user.php
+++ b/models/user.php
@@ -1,5 +1,5 @@
 <?php
-$name = trim(strip_tags(mysqli_real_escape_string($mysqli, $_POST['name'])));
-$email = trim(strip_tags(mysqli_real_escape_string($mysqli, $_POST['email'])));
+$name = sanitizeInput($_POST['name']);
+$email = sanitizeInput($_POST['email']);
 $default_company = intval($_POST['default_company']);
 $role = intval($_POST['role']);
diff --git a/models/vendor.php b/models/vendor.php
index cb44a586..156ac53e 100644
--- a/models/vendor.php
+++ b/models/vendor.php
@@ -1,13 +1,13 @@
 <?php
-$name = trim(strip_tags(mysqli_real_escape_string($mysqli, $_POST['name'])));
-$description = trim(strip_tags(mysqli_real_escape_string($mysqli, $_POST['description'])));
-$account_number = trim(strip_tags(mysqli_real_escape_string($mysqli, $_POST['account_number'])));
-$contact_name = trim(strip_tags(mysqli_real_escape_string($mysqli, $_POST['contact_name'])));
+$name = sanitizeInput($_POST['name']);
+$description = sanitizeInput($_POST['description']);
+$account_number = sanitizeInput($_POST['account_number']);
+$contact_name = sanitizeInput($_POST['contact_name']);
 $phone = preg_replace("/[^0-9]/", '', $_POST['phone']);
-$extension = trim(strip_tags(mysqli_real_escape_string($mysqli, $_POST['extension'])));
-$email = trim(strip_tags(mysqli_real_escape_string($mysqli, $_POST['email'])));
-$website = trim(strip_tags(mysqli_real_escape_string($mysqli, $_POST['website'])));
-$hours = trim(strip_tags(mysqli_real_escape_string($mysqli, $_POST['hours'])));
-$sla = trim(strip_tags(mysqli_real_escape_string($mysqli, $_POST['sla'])));
-$code = trim(strip_tags(mysqli_real_escape_string($mysqli, $_POST['code'])));
-$notes = trim(strip_tags(mysqli_real_escape_string($mysqli, $_POST['notes'])));
+$extension = preg_replace("/[^0-9]/", '', $_POST['extension']);
+$email = sanitizeInput($_POST['email']);
+$website = sanitizeInput($_POST['website']);
+$hours = sanitizeInput($_POST['hours']);
+$sla = sanitizeInput($_POST['sla']);
+$code = sanitizeInput($_POST['code']);
+$notes = sanitizeInput($_POST['notes']);
diff --git a/post.php b/post.php
index 1534a58c..6379e28d 100644
--- a/post.php
+++ b/post.php
@@ -18,7 +18,7 @@ if(isset($_GET['switch_company'])){
     //Get Company Name
     $sql = mysqli_query($mysqli,"SELECT * FROM companies WHERE company_id = $company_id");
     $row = mysqli_fetch_array($sql);
-    $company_name = strip_tags(mysqli_real_escape_string($mysqli,$row['company_name']));
+    $company_name = sanitizeInput($row['company_name']);
 
     //Check to see if user has Permission to access the company
     if(in_array($company_id,$session_user_company_access_array)){
@@ -126,7 +126,7 @@ if(isset($_POST['edit_user'])){
     $user_id = intval($_POST['user_id']);
     $new_password = trim($_POST['new_password']);
 
-    $existing_file_name = trim(strip_tags(mysqli_real_escape_string($mysqli,$_POST['existing_file_name'])));
+    $existing_file_name = sanitizeInput($_POST['existing_file_name']);
     $extended_log_description = '';
     if(!empty($_POST['2fa'])) {
         $two_fa = $_POST['2fa'];
@@ -197,7 +197,7 @@ if(isset($_GET['activate_user'])){
     // Get User Name
     $sql = mysqli_query($mysqli,"SELECT * FROM users WHERE user_id = $user_id");
     $row = mysqli_fetch_array($sql);
-    $user_name = strip_tags(mysqli_real_escape_string($mysqli,$row['user_name']));
+    $user_name = sanitizeInput($row['user_name']);
 
     mysqli_query($mysqli,"UPDATE users SET user_status = 1 WHERE user_id = $user_id");
 
@@ -220,7 +220,7 @@ if(isset($_GET['disable_user'])){
     // Get User Name
     $sql = mysqli_query($mysqli,"SELECT * FROM users WHERE user_id = $user_id");
     $row = mysqli_fetch_array($sql);
-    $user_name = strip_tags(mysqli_real_escape_string($mysqli,$row['user_name']));
+    $user_name = sanitizeInput($row['user_name']);
 
     mysqli_query($mysqli,"UPDATE users SET user_status = 0 WHERE user_id = $user_id");
 
@@ -240,8 +240,8 @@ if(isset($_POST['edit_profile'])){
     validateCSRFToken($_POST['csrf_token']);
 
     $user_id = $session_user_id;
-    $name = trim(strip_tags(mysqli_real_escape_string($mysqli,$_POST['name'])));
-    $email = trim(strip_tags(mysqli_real_escape_string($mysqli,$_POST['email'])));
+    $name = sanitizeInput($_POST['name']);
+    $email = sanitizeInput($_POST['email']);
     $new_password = trim($_POST['new_password']);
     $existing_file_name = trim(strip_tags(mysqli_real_escape_string($mysqli,$_POST['existing_file_name'])));
     $logout = false;