diff --git a/CHANGELOG.md b/CHANGELOG.md
index 426ff3f7c..e4b9d3283 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,37 @@
 
 This file documents all notable changes made to ITFlow.
 
+## [26.08.1] Maint Release
+
+### Upgrading to 26.08.1
+
+Update the files from Settings > Update as normal. This release moves the database to 2.6.7 and the web updater completes it for you — the command line step that 26.08 required is not needed again.
+
+### Breaking Changes and Notes
+
+- Client access: agents with restricted client access now see records that have no client assigned. Previously this varied by page — unassigned tickets and projects were visible, unassigned expenses and credentials were not. It is now consistent everywhere.
+
+### Bug Fixes
+- Setup: fixed the wizard closing itself after the first user, which left new 26.08 installs stuck in a redirect loop between `/setup` and `/login.php`.
+- API: tightened client scoping on the expense read and record update endpoints.
+- Income: revenue rows now respect restricted client access.
+- Client PDF Export: fixed the export producing a CSV file, and each section is now gated on the module that owns it.
+- AI: fixed model creation, per-use-case model selection, configurable temperature, and error reporting.
+- Ticket: system-generated replies no longer record time worked that was never worked.
+- Ticket: fixed an error when scheduling a ticket.
+- Ticket: cancelling a schedule now cancels the calendar event on the recipient's calendar.
+- Ticket: history no longer records a status change when the status did not change.
+- Recurring Ticket: bulk priority changes no longer deny access to agents who are not administrators.
+- Contact: deleting a contact now removes the linked portal user, and anonymizing now redacts the phone number.
+- Calendar: fixed event deletion.
+
+### New Features & Updates
+- Performance: queries now select only the columns they use instead of `SELECT *`, cutting memory use and query time across the app and especially in the crons.
+- Performance: removed client joins that were only there for scoping — side nav badge counts are significantly faster.
+- Client scoping: added a `clientScopeSql()` helper so list queries scope on the owning column instead of a joined `clients.client_id`.
+- Contributing: documented the column-selection and client-scoping conventions.
+
+
 ## [26.08]
  
 ### Upgrading to 26.08
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 3e076677d..7ebf94f02 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -74,6 +74,10 @@ if (isset($_POST['edit_ticket_priority'])) {
 ### The `_model.php` pattern
  
 Files named `agent/post/*_model.php` hold shared field collection/sanitization logic used by both the create and edit blocks of a module (e.g. `asset_model.php` is included by both `add_asset` and `edit_asset`). If create and edit share more than a couple of fields, use this pattern rather than duplicating. Model files carry the same `FROM_POST_HANDLER` guard and are excluded from the dispatcher's auto-load.
+
+**`_model.php` is a reserved suffix.** The exclusion is a filename match, so a *handler* named `*_model.php` is silently never loaded — its form posts, nothing claims the request, and the user gets a blank page with no error anywhere. This is what happened to `admin/post/ai_model.php`, which is why the AI Models handler is now `admin/post/ai_models.php`. Name entity handlers around the suffix (`ai_models.php`, `users.php`, `api_keys.php`).
+
+A POST that reaches the end of `admin/post.php` or `agent/post.php` without a handler claiming it is logged to App Logs as a `Request` warning, which is the fastest way to spot this class of mistake.
  
 ---
  
@@ -171,7 +175,25 @@ Everywhere else — anything under `agent/post/` — the call belongs in the blo
  
 ### 4. Client scoping is enforced, not assumed.
  
-After loading a record, call `enforceClientAccess()` (optionally with the record's client ID) so technicians restricted to specific clients cannot touch other clients' data by editing an ID in the URL. Look at how `resolve_ticket` does it — including the "skip if the record has no client" case.
+A user can be restricted to a subset of clients through `user_client_permissions`. Enforcing that has two halves, and a page usually needs both.
+
+**One record — `enforceClientAccess()`.** After loading a record, call it (optionally with the record's client ID) so technicians restricted to specific clients cannot touch other clients' data by editing an ID in the URL. Look at how `resolve_ticket` does it.
+
+**A list — `clientScopeSql()`.** Any query returning more than one row appends the fragment for that resource's own client column:
+
+```php
+$sql = mysqli_query($mysqli, "SELECT expense_id, expense_date, expense_amount, expense_description
+    FROM expenses
+    WHERE expense_archived_at IS NULL
+    " . clientScopeSql('expense_client_id') . "
+    ORDER BY expense_date DESC");
+```
+
+It returns `" AND ..."` or `""`, so it needs a `WHERE` to hang off — add `WHERE 1=1` if the query has no other condition. It is column-aware and takes an alias fine (`clientScopeSql('t.ticket_client_id')`). The API calls the same helper through the `apiClientScopeSql()` wrapper.
+
+Scope on the resource's **own** column, not on a joined `clients.client_id`. Joining `clients` just to scope makes the filter depend on the join: with a `LEFT JOIN`, a row whose client column is `0` produces `NULL`, and `NULL IN (...)` is neither true nor false, so the row silently vanishes. If the query joins `clients` for `client_name`, keep the join for that — but still scope on the owning column.
+
+**Records with no client (`0`) stay visible to restricted users.** `clientScopeSql()` emits `IN (0,...)` deliberately. Client restrictions partition *client* data, and a record belonging to no client is not any client's data to withhold. Do not hand-roll a variant that drops the `0` — the tree had accumulated several before this helper existed, disagreeing with each other, and reconciling them is what surfaced the inconsistency.
  
 ### 5. Escape on output.
  
@@ -206,8 +228,29 @@ Per [SECURITY.md](SECURITY.md) — never in a public issue.
 ---
  
 ## Conventions
- 
-**Database naming.** Every column is prefixed with the singular name of the entity it belongs to: `tickets.ticket_id`, `tickets.ticket_subject`, `clients.client_name`. This makes JOIN results unambiguous and is why queries can `SELECT *` across joins safely. New tables must follow it.
+
+**Only technician-entered time is time worked.** `ticket_replies.ticket_reply_time_worked` is billable labour and feeds ticket totals, the technician and client time reports, project totals, invoicing and the API. A reply the *system* writes — assignment, priority change, merge, close, invoice/quote created, schedule edited, task completed or reopened — is an audit trail, not work, and records `'00:00:00'`. Only a value the technician actually typed goes in that column. Task completion estimates are planning information and stay on the task; they are never converted into time worked. `agent/ticket.php` hides the clock badge on a reply whose time is exactly `00:00:00`, so a zero renders as no time rather than as "0m".
+
+**Database naming.** Every column is prefixed with the singular name of the entity it belongs to: `tickets.ticket_id`, `tickets.ticket_subject`, `clients.client_name`. This makes JOIN results unambiguous, so a `SELECT *` across joins is never *wrong*. New tables must follow it.
+
+**Select the columns you use, not `*`.** Unambiguous is not the same as cheap. `SELECT *` across three joined tables fetches every column of all three, including the `*_notes` and `*_details` TEXT columns, and throws away whatever the page never renders. A search result list that shows five fields was pulling sixty. List the columns instead:
+
+```php
+$sql = mysqli_query($mysqli, "SELECT ticket_id, ticket_prefix, ticket_number, ticket_subject, client_name
+    FROM tickets
+    LEFT JOIN clients ON ticket_client_id = client_id
+    WHERE ticket_archived_at IS NULL
+    " . clientScopeSql('ticket_client_id') . "");
+```
+
+Two things follow from that:
+
+- A query whose result only feeds `mysqli_num_rows()` needs no columns at all — write `SELECT 1`. Do not select a primary key "just in case": if the query joins two tables that both carry that column name, an unqualified `SELECT ticket_template_id` is an ambiguous-column error.
+- Keep the join even when no column of the joined table survives into the `SELECT`, if the join is doing work — supplying a `WHERE` term, an `ORDER BY`, or the client column you scope on. Dropping a join is a separate decision from trimming the column list.
+
+The trade is real and worth stating: `SELECT *` picks up new columns for free, an explicit list does not. Add a column to a table and every query that needs it must be updated by hand, and the failure mode is a blank field or a PHP 8 undefined-key warning rather than an error. That is the price of not fetching data nobody reads, and the project has decided to pay it on anything that loops or touches a TEXT column.
+
+The exception is `api/v1/*/read.php`. Those endpoints hand the whole row to `read_output.php`, which serialises it straight into the JSON response — there the row *is* the output contract, so `SELECT *` is correct and trimming it would silently drop fields from every consumer.
 
 The prefix is the entity name, which is usually but not always the singular of the table name. Where a table is named for its container rather than its row, the prefix follows the row: `calendar_events` → `event_*`, `asset_interfaces` → `interface_*`, `invoice_items` / `quote_items` → `item_*`, `rack_units` → `unit_*`, `user_roles` → `role_*`, `product_stock` → `stock_*`. Pick the prefix your columns will read best as and use it for every column in the table.
 
@@ -224,6 +267,8 @@ A single update run applies every pending migration in order, stopping at the fi
 **After acting, log and notify.** State changes call `logAudit($type, $action, $description, $client_id, $entity_id)` for the audit trail. User-facing events may also call `appNotify()`. Fire `triggerCustomAction()` where a site might reasonably want a hook. Then call `flashAlert($message, $type)` and `redirect()` (defaults to the referer) rather than setting session keys or `header()` manually.
 
 **Function names (post-rename).** Helpers were renamed for clarity in 2026; the old names **no longer exist** — code calling them fatals. If you're rebasing an old PR or following an old tutorial, translate: `sanitizeInput` → `escapeSql`, `nullable_htmlentities` → `escapeHtml`, `logAction` → `logAudit`, `flash_alert` → `flashAlert`, `customAction` → `triggerCustomAction`, `encryptLoginEntry`/`decryptLoginEntry` → `encryptCredentialEntry`/`decryptCredentialEntry`, `strtoAZaz09` → `toAlphanumeric`, `fetchUpdates` → `checkForUpdates`, `sanitize_url` → `escapeUrl`.
+
+One removed **variable** deserves its own warning: the old `$access_permission_query` global is gone, replaced by `clientScopeSql()` (security rule 4). Unlike a removed function, it does not fatal — an undefined variable interpolates as an empty string, so a rebased query keeps running with **no client scoping at all**. Grep for it before rebasing anything that touches a list query.
  
 **Helpers that fetch data return it raw.** If you add a `getXById()`-style helper, return the column value untouched and let callers escape it (security rule 1). Validating what the helper interpolates into its *own* query — table and column names, the id — is still the helper's job; that is query construction, not output escaping, and the two are not the same thing.
 
diff --git a/admin/ai_models.php b/admin/ai_models.php
index e30dc6db3..db8f96d81 100644
--- a/admin/ai_models.php
+++ b/admin/ai_models.php
@@ -6,7 +6,8 @@ $order = "ASC";
 
 require_once "includes/inc_all_admin.php";
 
-$sql = mysqli_query($mysqli, "SELECT * FROM ai_models LEFT JOIN ai_providers ON ai_model_ai_provider_id = ai_provider_id ORDER BY $sort $order");
+$sql = mysqli_query($mysqli, "SELECT ai_model_id, ai_model_name, ai_model_prompt, ai_model_use_case, ai_provider_id,
+    ai_provider_name FROM ai_models LEFT JOIN ai_providers ON ai_model_ai_provider_id = ai_provider_id ORDER BY $sort $order");
 
 $num_rows = mysqli_num_rows($sql);
 
diff --git a/admin/ai_providers.php b/admin/ai_providers.php
index 3bb6b5729..b9b728314 100644
--- a/admin/ai_providers.php
+++ b/admin/ai_providers.php
@@ -6,7 +6,7 @@ $order = "ASC";
 
 require_once "includes/inc_all_admin.php";
 
-$sql = mysqli_query($mysqli, "SELECT * FROM ai_providers ORDER BY $sort $order");
+$sql = mysqli_query($mysqli, "SELECT ai_provider_api_key, ai_provider_api_url, ai_provider_id, ai_provider_name FROM ai_providers ORDER BY $sort $order");
 
 $num_rows = mysqli_num_rows($sql);
 
diff --git a/admin/api_keys.php b/admin/api_keys.php
index 1d6173b81..c0ed6cae9 100644
--- a/admin/api_keys.php
+++ b/admin/api_keys.php
@@ -8,7 +8,7 @@ require_once "includes/inc_all_admin.php";
 
 $sql = mysqli_query(
     $mysqli,
-    "SELECT SQL_CALC_FOUND_ROWS * FROM api_keys
+    "SELECT SQL_CALC_FOUND_ROWS api_key_created_at, api_key_expire, api_key_id, api_key_name, api_key_secret, user_name FROM api_keys
     LEFT JOIN users on api_key_user_id = user_id
     WHERE (api_key_name LIKE '%$q%')
     ORDER BY $sort $order LIMIT $record_from, $record_to"
diff --git a/admin/app_logs.php b/admin/app_logs.php
index cf95b9478..2a1f7dce6 100644
--- a/admin/app_logs.php
+++ b/admin/app_logs.php
@@ -28,7 +28,7 @@ if (isset($_GET['category']) & !empty($_GET['catergory'])) {
 
 $sql = mysqli_query(
     $mysqli,
-    "SELECT SQL_CALC_FOUND_ROWS * FROM app_logs
+    "SELECT SQL_CALC_FOUND_ROWS app_log_category, app_log_created_at, app_log_details, app_log_id, app_log_type FROM app_logs
     WHERE (app_log_type LIKE '%$q%' OR app_log_category LIKE '%$q%' OR app_log_details LIKE '%$q%')
     AND DATE(app_log_created_at) BETWEEN '$dtf' AND '$dtt'
     $log_type_query
diff --git a/admin/audit_logs.php b/admin/audit_logs.php
index fd91cd8f6..0ce0d9709 100644
--- a/admin/audit_logs.php
+++ b/admin/audit_logs.php
@@ -48,7 +48,8 @@ if (isset($_GET['action']) & !empty($_GET['action'])) {
 
 $sql = mysqli_query(
     $mysqli,
-    "SELECT SQL_CALC_FOUND_ROWS * FROM logs
+    "SELECT SQL_CALC_FOUND_ROWS client_id, client_name, log_action, log_created_at, log_description, log_entity_id, log_id,
+        log_ip, log_type, log_user_agent, user_id, user_name FROM logs
     LEFT JOIN users ON log_user_id = user_id
     LEFT JOIN clients ON log_client_id = client_id
     WHERE (log_type LIKE '%$q%' OR log_action LIKE '%$q%' OR log_description LIKE '%$q%' OR log_ip LIKE '%$q%' OR log_user_agent LIKE '%$q%' OR user_name LIKE '%$q%' OR client_name LIKE '%$q%')
@@ -87,7 +88,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                                 <option value="">- All Clients -</option>
 
                                 <?php
-                                $sql_clients_filter = mysqli_query($mysqli, "SELECT * FROM clients ORDER BY client_name ASC");
+                                $sql_clients_filter = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients ORDER BY client_name ASC");
                                 while ($row = mysqli_fetch_assoc($sql_clients_filter)) {
                                     $client_id = intval($row['client_id']);
                                     $client_name = escapeHtml($row['client_name']);
@@ -107,7 +108,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                                 <option value="">- All Users -</option>
 
                                 <?php
-                                $sql_users_filter = mysqli_query($mysqli, "SELECT * FROM users ORDER BY user_name ASC");
+                                $sql_users_filter = mysqli_query($mysqli, "SELECT user_id, user_name FROM users ORDER BY user_name ASC");
                                 while ($row = mysqli_fetch_assoc($sql_users_filter)) {
                                     $user_id = intval($row['user_id']);
                                     $user_name = escapeHtml($row['user_name']);
diff --git a/admin/backup.php b/admin/backup.php
index 574da3bbc..209531cfa 100644
--- a/admin/backup.php
+++ b/admin/backup.php
@@ -19,7 +19,8 @@ $cron_is_running = $cron_last_dispatch_at !== null && (time() - strtotime($cron_
 
 $backup_job = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT cron_job_enabled, cron_job_daily_at FROM cron_jobs WHERE cron_job_name = 'backup'"));
 
-$backups = mysqli_query($mysqli, "SELECT * FROM backups ORDER BY backup_created_at DESC LIMIT 100");
+$backups = mysqli_query($mysqli, "SELECT backup_created_at, backup_error, backup_id, backup_size, backup_source, backup_status,
+    backup_type FROM backups ORDER BY backup_created_at DESC LIMIT 100");
 
 $pending_count = intval(mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT(*) AS c FROM backups WHERE backup_status IN ('Pending','Running')"))['c']);
 
diff --git a/admin/backup_download.php b/admin/backup_download.php
index b7411f121..daa3af7b1 100644
--- a/admin/backup_download.php
+++ b/admin/backup_download.php
@@ -23,7 +23,7 @@ if (!isset($_GET['backup_id'])) {
 
 $backup_id = intval($_GET['backup_id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM backups WHERE backup_id = $backup_id AND backup_status = 'Complete' LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT backup_file_name FROM backups WHERE backup_id = $backup_id AND backup_status = 'Complete' LIMIT 1");
 
 if (mysqli_num_rows($sql) !== 1) {
     http_response_code(404);
diff --git a/admin/categories.php b/admin/categories.php
index ca549e0a0..99910572d 100644
--- a/admin/categories.php
+++ b/admin/categories.php
@@ -15,7 +15,7 @@ if (isset($_GET['category'])) {
 
 $sql = mysqli_query(
     $mysqli,
-    "SELECT SQL_CALC_FOUND_ROWS * FROM categories
+    "SELECT SQL_CALC_FOUND_ROWS category_color, category_description, category_id, category_name FROM categories
     WHERE category_name LIKE '%$q%'
     AND category_type = '$category'
     AND category_$archive_query
diff --git a/admin/contract_templates.php b/admin/contract_templates.php
index 76fb13247..674fd599d 100644
--- a/admin/contract_templates.php
+++ b/admin/contract_templates.php
@@ -63,15 +63,15 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                             $id = intval($row['contract_template_id']);
                             $name = escapeHtml($row['contract_template_name']);
                             $type = escapeHtml($row['contract_template_type']);
-                            $freq = escapeHtml($row['contract_template_update_frequency']);
-                            $sla_low_resp = escapeHtml($row['sla_low_response_time']);
-                            $sla_med_resp = escapeHtml($row['sla_medium_response_time']);
-                            $sla_high_resp = escapeHtml($row['sla_high_response_time']);
-                            $sla_low_res = escapeHtml($row['sla_low_resolution_time']);
-                            $sla_med_res = escapeHtml($row['sla_medium_resolution_time']);
-                            $sla_high_res = escapeHtml($row['sla_high_resolution_time']);
-                            $hourly_rate = escapeHtml($row['contract_template_hourly_rate']);
-                            $after_hours = escapeHtml($row['contract_template_after_hours_hourly_rate']);
+                            $freq = escapeHtml($row['contract_template_renewal_frequency']);
+                            $sla_low_resp = escapeHtml($row['contract_template_sla_low_response_time']);
+                            $sla_med_resp = escapeHtml($row['contract_template_sla_medium_response_time']);
+                            $sla_high_resp = escapeHtml($row['contract_template_sla_high_response_time']);
+                            $sla_low_res = escapeHtml($row['contract_template_sla_low_resolution_time']);
+                            $sla_med_res = escapeHtml($row['contract_template_sla_medium_resolution_time']);
+                            $sla_high_res = escapeHtml($row['contract_template_sla_high_resolution_time']);
+                            $hourly_rate = escapeHtml($row['contract_template_rate_standard']);
+                            $after_hours = escapeHtml($row['contract_template_rate_after_hours']);
                             $support_hours = escapeHtml($row['contract_template_support_hours']);
                             $net_terms = escapeHtml($row['contract_template_net_terms']);
                             $created = escapeHtml($row['contract_template_created_at']);
diff --git a/admin/cron.php b/admin/cron.php
index 4bf71af64..620c6e528 100644
--- a/admin/cron.php
+++ b/admin/cron.php
@@ -22,7 +22,7 @@ foreach (cronJobRegistry() as $job) {
     $cron_jobs[$job['name']]['row'] = null;
 }
 
-$sql = mysqli_query($mysqli, "SELECT * FROM cron_jobs");
+$sql = mysqli_query($mysqli, "SELECT cron_job_name FROM cron_jobs");
 while ($job_row = mysqli_fetch_assoc($sql)) {
     if (isset($cron_jobs[$job_row['cron_job_name']])) {
         $cron_jobs[$job_row['cron_job_name']]['row'] = $job_row;
diff --git a/admin/custom_links.php b/admin/custom_links.php
index 6baf7fa1c..038dc318d 100644
--- a/admin/custom_links.php
+++ b/admin/custom_links.php
@@ -8,7 +8,8 @@ require_once "includes/inc_all_admin.php";
 
 $sql = mysqli_query(
     $mysqli,
-    "SELECT SQL_CALC_FOUND_ROWS * FROM custom_links
+    "SELECT SQL_CALC_FOUND_ROWS custom_link_icon, custom_link_id, custom_link_location, custom_link_name,
+        custom_link_new_tab, custom_link_order, custom_link_uri FROM custom_links
     WHERE custom_link_name LIKE '%$q%'
     ORDER BY $sort $order LIMIT $record_from, $record_to"
 );
diff --git a/admin/database_updates/2.3.1.php b/admin/database_updates/2.3.1.php
index 5b0389b5b..a42f889b6 100644
--- a/admin/database_updates/2.3.1.php
+++ b/admin/database_updates/2.3.1.php
@@ -8,7 +8,7 @@
 defined('FROM_DB_UPDATER') || die("Direct file access is not allowed");
 
     // Migrate Payment Methods from Categories Table to new payment_methods table
-    $sql_categories = mysqli_query($mysqli, "SELECT * FROM categories WHERE category_type = 'Payment Method' AND category_name != 'Stripe' AND category_archived_at IS NULL");
+    $sql_categories = mysqli_query($mysqli, "SELECT category_name FROM categories WHERE category_type = 'Payment Method' AND category_name != 'Stripe' AND category_archived_at IS NULL");
 
     while ($row = mysqli_fetch_assoc($sql_categories)) {
         $category_name = escapeSql($row['category_name']);
diff --git a/admin/database_updates/2.6.7.php b/admin/database_updates/2.6.7.php
new file mode 100644
index 000000000..b56a4114f
--- /dev/null
+++ b/admin/database_updates/2.6.7.php
@@ -0,0 +1,18 @@
+<?php
+
+/*
+ * ITFlow - Database update to version 2.6.7 (from 2.6.6)
+ * Included by admin/database_updates.php - do not access directly
+ */
+
+defined('FROM_DB_UPDATER') || die("Direct file access is not allowed");
+
+    // The AI endpoints used to send a hardcoded temperature (0.5, or 0.3 for ticket
+    // summaries). Newer OpenAI models accept nothing but their own default and reject
+    // the request outright, which surfaced as "Failed to get a response from the AI API".
+    //
+    // Temperature is now per-model and optional: NULL means don't send the parameter
+    // at all, which is the setting that works on every provider. Existing rows get
+    // NULL so they stop sending it.
+
+    mysqli_query($mysqli, "ALTER TABLE `ai_models` ADD COLUMN IF NOT EXISTS `ai_model_temperature` decimal(3,2) DEFAULT NULL AFTER `ai_model_use_case`");
diff --git a/admin/document_template.php b/admin/document_template.php
index f90c025f0..3a8dea489 100644
--- a/admin/document_template.php
+++ b/admin/document_template.php
@@ -15,7 +15,8 @@ if (isset($_GET['document_template_id'])) {
     $document_template_id = intval($_GET['document_template_id']);
 }
 
-$sql_document = mysqli_query($mysqli, "SELECT * FROM document_templates WHERE document_template_id = $document_template_id LIMIT 1");
+$sql_document = mysqli_query($mysqli, "SELECT document_template_content, document_template_created_at, document_template_description,
+    document_template_name, document_template_updated_at FROM document_templates WHERE document_template_id = $document_template_id LIMIT 1");
 
 if (mysqli_num_rows($sql_document) == 0) {
     echo "<center><h1 class='text-secondary mt-5'>Nothing to see here</h1><a class='btn btn-lg btn-secondary mt-3' href='javascript:history.back()'><i class='fa fa-fw fa-arrow-left'></i> Go Back</a></center>";
diff --git a/admin/document_templates.php b/admin/document_templates.php
index 74692ca63..a09cba04a 100644
--- a/admin/document_templates.php
+++ b/admin/document_templates.php
@@ -8,7 +8,8 @@
 
     $sql = mysqli_query(
         $mysqli,
-        "SELECT SQL_CALC_FOUND_ROWS * FROM document_templates
+        "SELECT SQL_CALC_FOUND_ROWS document_template_content, document_template_created_at, document_template_description,
+            document_template_id, document_template_name, document_template_updated_at, user_name FROM document_templates
         LEFT JOIN users ON document_template_created_by = user_id
         WHERE user_name LIKE '%$q%' OR document_template_name LIKE '%$q%'
         ORDER BY $sort $order LIMIT $record_from, $record_to"
diff --git a/admin/includes/side_nav.php b/admin/includes/side_nav.php
index fe2ba5465..48636100a 100644
--- a/admin/includes/side_nav.php
+++ b/admin/includes/side_nav.php
@@ -314,7 +314,7 @@
                 </li>
 
                 <?php
-                $sql_custom_links = mysqli_query($mysqli, "SELECT * FROM custom_links
+                $sql_custom_links = mysqli_query($mysqli, "SELECT custom_link_icon, custom_link_name, custom_link_new_tab, custom_link_uri FROM custom_links
                     WHERE custom_link_location = 4 AND custom_link_archived_at IS NULL
                     ORDER BY custom_link_order ASC, custom_link_name ASC"
                 );
diff --git a/admin/mail_queue.php b/admin/mail_queue.php
index 09457cefe..b801c5f23 100644
--- a/admin/mail_queue.php
+++ b/admin/mail_queue.php
@@ -8,7 +8,8 @@ require_once "includes/inc_all_admin.php";
 
 $sql = mysqli_query(
     $mysqli,
-    "SELECT SQL_CALC_FOUND_ROWS * FROM email_queue
+    "SELECT SQL_CALC_FOUND_ROWS email_attempts, email_failed_at, email_from, email_from_name, email_id, email_queued_at,
+        email_recipient, email_recipient_name, email_sent_at, email_status, email_subject FROM email_queue
     WHERE (email_id LIKE '%$q%' OR email_from LIKE '%$q%' OR email_from_name LIKE '%$q%' OR email_recipient LIKE '%$q%' OR email_recipient_name LIKE '%$q%' OR email_subject LIKE '%$q%')
     AND DATE(email_queued_at) BETWEEN '$dtf' AND '$dtt'
     ORDER BY $sort $order LIMIT $record_from, $record_to"
diff --git a/admin/modals/ai/ai_model_add.php b/admin/modals/ai/ai_model_add.php
index 13ea0cf95..66819e3cc 100644
--- a/admin/modals/ai/ai_model_add.php
+++ b/admin/modals/ai/ai_model_add.php
@@ -26,7 +26,7 @@ ob_start();
                 <select class="form-control select2" name="provider" required>
                     <option value="">- Select an AI Provider -</option>
                     <?php
-                        $sql_ai_providers = mysqli_query($mysqli, "SELECT * FROM ai_providers");
+                        $sql_ai_providers = mysqli_query($mysqli, "SELECT ai_provider_id, ai_provider_name FROM ai_providers");
                         while ($row = mysqli_fetch_assoc($sql_ai_providers)) {
                             $ai_provider_id = intval($row['ai_provider_id']);
                             $ai_provider_name = escapeHtml($row['ai_provider_name']);
@@ -62,6 +62,17 @@ ob_start();
             </div>
         </div>
 
+        <div class="form-group">
+            <label>Temperature</label>
+            <div class="input-group">
+                <div class="input-group-prepend">
+                    <span class="input-group-text"><i class="fa fa-fw fa-thermometer-half"></i></span>
+                </div>
+                <input type="number" class="form-control" name="temperature" step="0.1" min="0" max="2" value="" placeholder="Provider default">
+            </div>
+            <small class="form-text text-muted">Optional. Leave blank to let the provider use its default - some newer models reject every other value.</small>
+        </div>
+
         <div class="form-group">
             <textarea class="form-control" rows="8" name="prompt" placeholder="Enter a model prompt:"></textarea>
         </div>
diff --git a/admin/modals/ai/ai_model_edit.php b/admin/modals/ai/ai_model_edit.php
index d624ea62a..05413b98a 100644
--- a/admin/modals/ai/ai_model_edit.php
+++ b/admin/modals/ai/ai_model_edit.php
@@ -4,13 +4,14 @@ require_once '../../includes/modal_header.php';
 
 $model_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM ai_models WHERE ai_model_id = $model_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT ai_model_ai_provider_id, ai_model_id, ai_model_name, ai_model_prompt, ai_model_use_case, ai_model_temperature FROM ai_models WHERE ai_model_id = $model_id LIMIT 1");
 
 $row = mysqli_fetch_assoc($sql);
 $ai_model_ai_provider_id = intval($row['ai_model_ai_provider_id']);
 $model_id = intval($row['ai_model_id']);
 $model_name = escapeHtml($row['ai_model_name']);
 $use_case = escapeHtml($row['ai_model_use_case']);
+$temperature = escapeHtml($row['ai_model_temperature']);
 $prompt = escapeHtml($row['ai_model_prompt']);
 
 // Generate the HTML form content using output buffering.
@@ -38,7 +39,7 @@ ob_start();
                 <select class="form-control select2" name="provider" required>
                     <option value="">- Select an AI Provider -</option>
                     <?php
-                        $sql_ai_providers = mysqli_query($mysqli, "SELECT * FROM ai_providers");
+                        $sql_ai_providers = mysqli_query($mysqli, "SELECT ai_provider_id, ai_provider_name FROM ai_providers");
                         while ($row = mysqli_fetch_assoc($sql_ai_providers)) {
                             $ai_provider_id = intval($row['ai_provider_id']);
                             $ai_provider_name = escapeHtml($row['ai_provider_name']);
@@ -74,6 +75,16 @@ ob_start();
             </div>
         </div>
 
+        <div class="form-group">
+            <label>Temperature</label>
+            <div class="input-group">
+                <div class="input-group-prepend">
+                    <span class="input-group-text"><i class="fa fa-fw fa-thermometer-half"></i></span>
+                </div>
+                <input type="number" class="form-control" name="temperature" step="0.1" min="0" max="2" value="<?= $temperature ?>" placeholder="Provider default">
+            </div>
+            <small class="form-text text-muted">Optional. Leave blank to let the provider use its default - some newer models reject every other value.</small>
+        </div>
         <div class="form-group">
             <textarea class="form-control" rows="8" name="prompt" placeholder="Enter a model prompt:"><?= $prompt ?></textarea>
         </div>
diff --git a/admin/modals/ai/ai_provider_edit.php b/admin/modals/ai/ai_provider_edit.php
index 9973be998..933834477 100644
--- a/admin/modals/ai/ai_provider_edit.php
+++ b/admin/modals/ai/ai_provider_edit.php
@@ -4,7 +4,7 @@ require_once '../../includes/modal_header.php';
 
 $provider_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM ai_providers WHERE ai_provider_id = $provider_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT ai_provider_api_key, ai_provider_api_url, ai_provider_name FROM ai_providers WHERE ai_provider_id = $provider_id LIMIT 1");
 
 $row = mysqli_fetch_assoc($sql);
 $provider_name = escapeHtml($row['ai_provider_name']);
diff --git a/admin/modals/api/api_key_edit.php b/admin/modals/api/api_key_edit.php
index 7429342dc..4b773aa08 100644
--- a/admin/modals/api/api_key_edit.php
+++ b/admin/modals/api/api_key_edit.php
@@ -4,7 +4,7 @@ require_once '../../includes/modal_header.php';
 
 $api_key_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM api_keys WHERE api_key_id = $api_key_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT api_key_expire, api_key_name, api_key_user_id FROM api_keys WHERE api_key_id = $api_key_id LIMIT 1");
 $row = mysqli_fetch_assoc($sql);
 $api_key_name = escapeHtml($row['api_key_name']);
 $api_key_expire = escapeHtml($row['api_key_expire']);
diff --git a/admin/modals/category/category_edit.php b/admin/modals/category/category_edit.php
index 23c053650..f9141baa6 100644
--- a/admin/modals/category/category_edit.php
+++ b/admin/modals/category/category_edit.php
@@ -4,7 +4,7 @@ require_once '../../includes/modal_header.php';
 
 $category_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM categories WHERE category_id = $category_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT category_color, category_description, category_name, category_type FROM categories WHERE category_id = $category_id LIMIT 1");
 
 $row = mysqli_fetch_assoc($sql);
 $category_name = escapeHtml($row['category_name']);
diff --git a/admin/modals/contract_template/contract_template_edit.php b/admin/modals/contract_template/contract_template_edit.php
index 2eda674fe..302db896a 100644
--- a/admin/modals/contract_template/contract_template_edit.php
+++ b/admin/modals/contract_template/contract_template_edit.php
@@ -7,7 +7,13 @@ $contract_types_array = ['Fully Managed', 'Partialy Managed', 'Break/Fix'];
 $update_frequency_array = ['Manual', 'Annually', '2 Year', '3 Year', '5 Year', '7 Year'];
 
 // Fetch existing template
-$sql = mysqli_query($mysqli, "SELECT * FROM contract_templates WHERE contract_template_id = $contract_template_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT contract_template_description, contract_template_details, contract_template_name,
+    contract_template_net_terms, contract_template_rate_after_hours,
+    contract_template_rate_standard, contract_template_renewal_frequency,
+    contract_template_sla_high_resolution_time, contract_template_sla_high_response_time,
+    contract_template_sla_low_resolution_time, contract_template_sla_low_response_time,
+    contract_template_sla_medium_resolution_time, contract_template_sla_medium_response_time,
+    contract_template_support_hours, contract_template_type FROM contract_templates WHERE contract_template_id = $contract_template_id LIMIT 1");
 $row = mysqli_fetch_assoc($sql);
 
 // Assign locals
diff --git a/admin/modals/cron/cron_edit.php b/admin/modals/cron/cron_edit.php
index d2cc429b0..d0e817a4b 100644
--- a/admin/modals/cron/cron_edit.php
+++ b/admin/modals/cron/cron_edit.php
@@ -5,7 +5,8 @@ require_once '../../../includes/cron_jobs.php';
 
 $cron_job_id = intval($_GET['id']);
 
-$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT * FROM cron_jobs WHERE cron_job_id = $cron_job_id LIMIT 1"));
+$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT cron_job_daily_at, cron_job_enabled, cron_job_interval_minutes, cron_job_name,
+    cron_job_schedule FROM cron_jobs WHERE cron_job_id = $cron_job_id LIMIT 1"));
 
 $registry = cronJobRegistryByName();
 $job = $registry[$row['cron_job_name']] ?? null;
diff --git a/admin/modals/custom_link/custom_link_edit.php b/admin/modals/custom_link/custom_link_edit.php
index 395a8c919..eb5fb035d 100644
--- a/admin/modals/custom_link/custom_link_edit.php
+++ b/admin/modals/custom_link/custom_link_edit.php
@@ -4,7 +4,8 @@ require_once '../../includes/modal_header.php';
 
 $custom_link_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM custom_links WHERE custom_link_id = $custom_link_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT custom_link_icon, custom_link_location, custom_link_name, custom_link_new_tab,
+    custom_link_order, custom_link_uri FROM custom_links WHERE custom_link_id = $custom_link_id LIMIT 1");
 $row = mysqli_fetch_assoc($sql);
 $custom_link_name = escapeHtml($row['custom_link_name']);
 $custom_link_uri = escapeHtml($row['custom_link_uri']);
diff --git a/admin/modals/document_template/document_template_edit.php b/admin/modals/document_template/document_template_edit.php
index 18ef24d04..387f547f2 100644
--- a/admin/modals/document_template/document_template_edit.php
+++ b/admin/modals/document_template/document_template_edit.php
@@ -4,7 +4,7 @@ require_once '../../includes/modal_header.php';
 
 $document_template_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM document_templates WHERE document_template_id = $document_template_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT document_template_content, document_template_description, document_template_name FROM document_templates WHERE document_template_id = $document_template_id LIMIT 1");
 $row = mysqli_fetch_assoc($sql);
 $document_template_name = escapeHtml($row['document_template_name']);
 $document_template_description = escapeHtml($row['document_template_description']);
diff --git a/admin/modals/mail_queue/mail_queue_message_view.php b/admin/modals/mail_queue/mail_queue_message_view.php
index 141555d10..025cbdf62 100644
--- a/admin/modals/mail_queue/mail_queue_message_view.php
+++ b/admin/modals/mail_queue/mail_queue_message_view.php
@@ -12,7 +12,9 @@ $purifier_config->set('Cache.DefinitionImpl', null); // Disable cache by setting
 $purifier_config->set('URI.AllowedSchemes', ['data' => true, 'src' => true, 'http' => true, 'https' => true]);
 $purifier = new HTMLPurifier($purifier_config);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM email_queue WHERE email_id = $email_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT email_attempts, email_content, email_failed_at, email_from, email_from_name,
+    email_queued_at, email_recipient, email_recipient_name, email_sent_at, email_status,
+    email_subject FROM email_queue WHERE email_id = $email_id LIMIT 1");
 $row = mysqli_fetch_assoc($sql);
 
 $email_from = escapeHtml($row['email_from']);
diff --git a/admin/modals/payment_method/payment_method_edit.php b/admin/modals/payment_method/payment_method_edit.php
index 1c0415f74..23c0f5e42 100644
--- a/admin/modals/payment_method/payment_method_edit.php
+++ b/admin/modals/payment_method/payment_method_edit.php
@@ -4,7 +4,7 @@ require_once '../../includes/modal_header.php';
 
 $payment_method_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM payment_methods WHERE payment_method_id = $payment_method_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT payment_method_description, payment_method_id, payment_method_name FROM payment_methods WHERE payment_method_id = $payment_method_id LIMIT 1");
 
 $row = mysqli_fetch_assoc($sql);
 $payment_method_id = intval($row['payment_method_id']);
diff --git a/admin/modals/payment_provider/payment_provider_edit.php b/admin/modals/payment_provider/payment_provider_edit.php
index fb188b3f2..0e9aa0bd9 100644
--- a/admin/modals/payment_provider/payment_provider_edit.php
+++ b/admin/modals/payment_provider/payment_provider_edit.php
@@ -4,7 +4,9 @@ require_once '../../includes/modal_header.php';
 
 $provider_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM payment_providers WHERE payment_provider_id = $provider_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT payment_provider_account, payment_provider_expense_category,
+    payment_provider_expense_vendor, payment_provider_name, payment_provider_private_key,
+    payment_provider_public_key, payment_provider_threshold FROM payment_providers WHERE payment_provider_id = $provider_id LIMIT 1");
 
 $row = mysqli_fetch_assoc($sql);
 $provider_name = escapeHtml($row['payment_provider_name']);
diff --git a/admin/modals/project_template/project_template_edit.php b/admin/modals/project_template/project_template_edit.php
index a9f48f3a8..ac77eed8a 100644
--- a/admin/modals/project_template/project_template_edit.php
+++ b/admin/modals/project_template/project_template_edit.php
@@ -4,7 +4,7 @@ require_once '../../includes/modal_header.php';
 
 $project_template_id = intval($_GET['project_template_id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM project_templates WHERE project_template_id = $project_template_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT project_template_description, project_template_name FROM project_templates WHERE project_template_id = $project_template_id LIMIT 1");
 $row = mysqli_fetch_assoc($sql);
 $project_template_name = escapeHtml($row['project_template_name']);
 $project_template_description = escapeHtml($row['project_template_description']);
diff --git a/admin/modals/role/role_add.php b/admin/modals/role/role_add.php
index f22e2a942..abc8f6061 100644
--- a/admin/modals/role/role_add.php
+++ b/admin/modals/role/role_add.php
@@ -79,7 +79,7 @@ ob_start();
 
                 <?php
                 // Enumerate modules
-                $sql_modules = mysqli_query($mysqli, "SELECT * FROM modules");
+                $sql_modules = mysqli_query($mysqli, "SELECT module_description, module_id, module_name FROM modules");
                 while ($row_modules = mysqli_fetch_assoc($sql_modules)) {
 
                     $module_id = intval($row_modules['module_id']);
diff --git a/admin/modals/role/role_edit.php b/admin/modals/role/role_edit.php
index 171bad0af..621813463 100644
--- a/admin/modals/role/role_edit.php
+++ b/admin/modals/role/role_edit.php
@@ -15,7 +15,7 @@ $role_admin = intval($row['role_is_admin']);
 $sql_role_user_count = mysqli_query($mysqli, "SELECT COUNT(user_id) FROM users WHERE user_role_id = $role_id AND user_archived_at IS NULL");
 $role_user_count = mysqli_fetch_row($sql_role_user_count)[0];
 
-$sql_users = mysqli_query($mysqli, "SELECT * FROM users WHERE user_role_id = $role_id AND user_archived_at IS NULL");
+$sql_users = mysqli_query($mysqli, "SELECT user_name FROM users WHERE user_role_id = $role_id AND user_archived_at IS NULL");
 // Initialize an empty array to hold user names
 $user_names = [];
 
@@ -113,7 +113,7 @@ ob_start();
                 <?php
 
                 // Enumerate modules
-                $sql_modules = mysqli_query($mysqli, "SELECT * FROM modules");
+                $sql_modules = mysqli_query($mysqli, "SELECT module_description, module_id, module_name FROM modules");
                 while ($row_modules = mysqli_fetch_assoc($sql_modules)) {
                     $module_id = intval($row_modules['module_id']);
                     $module_name = escapeHtml($row_modules['module_name']);
diff --git a/admin/modals/sla/sla_edit.php b/admin/modals/sla/sla_edit.php
index a485b43a9..85705227b 100644
--- a/admin/modals/sla/sla_edit.php
+++ b/admin/modals/sla/sla_edit.php
@@ -3,7 +3,7 @@ require_once '../../includes/modal_header.php';
 
 $sla_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM slas WHERE sla_id = $sla_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT sla_description, sla_name, sla_resolution_minutes, sla_response_minutes FROM slas WHERE sla_id = $sla_id LIMIT 1");
 $row = mysqli_fetch_assoc($sql);
 $sla_name = escapeHtml($row['sla_name']);
 $sla_description = escapeHtml($row['sla_description']);
diff --git a/admin/modals/software_template/software_template_edit.php b/admin/modals/software_template/software_template_edit.php
index 875195374..7e61c6690 100644
--- a/admin/modals/software_template/software_template_edit.php
+++ b/admin/modals/software_template/software_template_edit.php
@@ -4,7 +4,8 @@ require_once '../../includes/modal_header.php';
 
 $software_template_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM software_templates WHERE software_template_id = $software_template_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT software_template_description, software_template_license_type, software_template_name,
+    software_template_notes, software_template_type, software_template_version FROM software_templates WHERE software_template_id = $software_template_id LIMIT 1");
 $row = mysqli_fetch_assoc($sql);
 $software_name = escapeHtml($row['software_template_name']);
 $software_version = escapeHtml($row['software_template_version']);
diff --git a/admin/modals/tag/tag_edit.php b/admin/modals/tag/tag_edit.php
index 5f7316df9..8b1fb4896 100644
--- a/admin/modals/tag/tag_edit.php
+++ b/admin/modals/tag/tag_edit.php
@@ -4,7 +4,7 @@ require_once '../../includes/modal_header.php';
 
 $tag_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM tags WHERE tag_id = $tag_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT tag_color, tag_icon, tag_name, tag_type FROM tags WHERE tag_id = $tag_id LIMIT 1");
 
 $row = mysqli_fetch_assoc($sql);
 $tag_name = escapeHtml($row['tag_name']);
diff --git a/admin/modals/tax/tax_edit.php b/admin/modals/tax/tax_edit.php
index 8c03558a1..c293bd8fd 100644
--- a/admin/modals/tax/tax_edit.php
+++ b/admin/modals/tax/tax_edit.php
@@ -4,7 +4,7 @@ require_once '../../includes/modal_header.php';
 
 $tax_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM taxes WHERE tax_id = $tax_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT tax_name, tax_percent FROM taxes WHERE tax_id = $tax_id LIMIT 1");
 $row = mysqli_fetch_assoc($sql);
 $tax_name = escapeHtml($row['tax_name']);
 $tax_percent = floatval($row['tax_percent']);
diff --git a/admin/modals/ticket_status/ticket_status_edit.php b/admin/modals/ticket_status/ticket_status_edit.php
index c5f0939ae..a43aaeeb3 100644
--- a/admin/modals/ticket_status/ticket_status_edit.php
+++ b/admin/modals/ticket_status/ticket_status_edit.php
@@ -4,7 +4,8 @@ require_once '../../includes/modal_header.php';
 
 $ticket_status_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM ticket_statuses WHERE ticket_status_id = $ticket_status_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT ticket_status_active, ticket_status_color, ticket_status_name, ticket_status_order,
+    ticket_status_pauses_sla FROM ticket_statuses WHERE ticket_status_id = $ticket_status_id LIMIT 1");
 $row = mysqli_fetch_assoc($sql);
 $ticket_status_name = escapeHtml($row['ticket_status_name']);
 $ticket_status_color = escapeHtml($row['ticket_status_color']);
diff --git a/admin/modals/ticket_template/ticket_template_add.php b/admin/modals/ticket_template/ticket_template_add.php
index f05b75d31..40d1297a4 100644
--- a/admin/modals/ticket_template/ticket_template_add.php
+++ b/admin/modals/ticket_template/ticket_template_add.php
@@ -60,7 +60,7 @@ ob_start();
                     <option value="0">- No -</option>
                     <?php
 
-                    $sql_project_templates = mysqli_query($mysqli, "SELECT * FROM project_templates WHERE project_template_archived_at IS NULL ORDER BY project_template_name ASC");
+                    $sql_project_templates = mysqli_query($mysqli, "SELECT project_template_id, project_template_name FROM project_templates WHERE project_template_archived_at IS NULL ORDER BY project_template_name ASC");
                     while ($row = mysqli_fetch_assoc($sql_project_templates)) {
                         $project_template_id_select = intval($row['project_template_id']);
                         $project_template_name_select = escapeHtml($row['project_template_name']); ?>
diff --git a/admin/modals/ticket_template/ticket_template_task_edit.php b/admin/modals/ticket_template/ticket_template_task_edit.php
index 24e1874fe..467e217f0 100644
--- a/admin/modals/ticket_template/ticket_template_task_edit.php
+++ b/admin/modals/ticket_template/ticket_template_task_edit.php
@@ -4,7 +4,7 @@ require_once '../../includes/modal_header.php';
 
 $task_template_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM task_templates WHERE task_template_id = $task_template_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT task_template_completion_estimate, task_template_name, task_template_order FROM task_templates WHERE task_template_id = $task_template_id LIMIT 1");
 
 $row = mysqli_fetch_assoc($sql);
 $task_template_name = escapeHtml($row['task_template_name']);
diff --git a/admin/modals/user/user_add.php b/admin/modals/user/user_add.php
index e89fe85eb..211f76aa1 100644
--- a/admin/modals/user/user_add.php
+++ b/admin/modals/user/user_add.php
@@ -75,7 +75,7 @@ ob_start();
                         <select class="form-control select2" name="role" required>
                             <option value="">- Role -</option>
                             <?php
-                                $sql_user_roles = mysqli_query($mysqli, "SELECT * FROM user_roles WHERE role_archived_at IS NULL");
+                                $sql_user_roles = mysqli_query($mysqli, "SELECT role_id, role_name FROM user_roles WHERE role_archived_at IS NULL");
                                 while ($row = mysqli_fetch_assoc($sql_user_roles)) {
                                     $role_id = intval($row['role_id']);
                                     $role_name = escapeHtml($row['role_name']);
@@ -138,7 +138,7 @@ ob_start();
                         <tbody>
 
                         <?php
-                        $sql_client_select = mysqli_query($mysqli, "SELECT * FROM clients WHERE client_archived_at IS NULL ORDER BY client_name ASC");
+                        $sql_client_select = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients WHERE client_archived_at IS NULL ORDER BY client_name ASC");
                         while ($row = mysqli_fetch_assoc($sql_client_select)) {
                             $client_id = intval($row['client_id']);
                             $client_name = escapeHtml($row['client_name']);
diff --git a/admin/modals/user/user_archive.php b/admin/modals/user/user_archive.php
index 29a795b73..f93205894 100644
--- a/admin/modals/user/user_archive.php
+++ b/admin/modals/user/user_archive.php
@@ -4,7 +4,7 @@ require_once '../../includes/modal_header.php';
 
 $user_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM users WHERE users.user_id = $user_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT user_avatar, user_email, user_name FROM users WHERE users.user_id = $user_id LIMIT 1");
 
 $row = mysqli_fetch_assoc($sql);
 $user_name = escapeHtml($row['user_name']);
@@ -12,13 +12,13 @@ $user_email = escapeHtml($row['user_email']);
 $user_avatar = escapeHtml($row['user_avatar']);
 $user_initials = escapeHtml(initials($user_name));
 
-$sql_related_tickets = mysqli_query($mysqli, "SELECT * FROM tickets
+$sql_related_tickets = mysqli_query($mysqli, "SELECT 1 FROM tickets
     WHERE ticket_assigned_to = $user_id AND ticket_resolved_at IS NULL AND ticket_closed_at IS NULL");
 
 $ticket_count = mysqli_num_rows($sql_related_tickets);
 
 // Related Recurring Tickets Query
-$sql_related_recurring_tickets = mysqli_query($mysqli, "SELECT * FROM recurring_tickets WHERE recurring_ticket_assigned_to = $user_id");
+$sql_related_recurring_tickets = mysqli_query($mysqli, "SELECT 1 FROM recurring_tickets WHERE recurring_ticket_assigned_to = $user_id");
 
 $recurring_ticket_count = mysqli_num_rows($sql_related_recurring_tickets);
 
@@ -59,7 +59,7 @@ ob_start();
                 <select class="form-control select2" name="ticket_assign" required>
                     <option value="0">No one</option>
                     <?php
-                    $sql_users = mysqli_query($mysqli, "SELECT * FROM users WHERE user_type = 1 AND user_archived_at IS NULL");
+                    $sql_users = mysqli_query($mysqli, "SELECT user_id, user_name FROM users WHERE user_type = 1 AND user_archived_at IS NULL");
                     while ($row = mysqli_fetch_assoc($sql_users)) {
                         $user_id_select = intval($row['user_id']);
                         $user_name_select = escapeHtml($row['user_name']);
diff --git a/admin/modals/user/user_edit.php b/admin/modals/user/user_edit.php
index 2a81f5784..437b54f81 100644
--- a/admin/modals/user/user_edit.php
+++ b/admin/modals/user/user_edit.php
@@ -4,7 +4,7 @@ require_once '../../includes/modal_header.php';
 
 $user_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM users
+$sql = mysqli_query($mysqli, "SELECT user_avatar, user_config_force_mfa, user_email, user_name, user_role_id, user_token FROM users
     LEFT JOIN user_settings ON users.user_id = user_settings.user_id
     WHERE users.user_id = $user_id LIMIT 1"
 );
@@ -119,7 +119,7 @@ ob_start();
                         </div>
                         <select class="form-control select2" name="role" required>
                             <?php
-                            $sql_user_roles = mysqli_query($mysqli, "SELECT * FROM user_roles WHERE role_archived_at IS NULL");
+                            $sql_user_roles = mysqli_query($mysqli, "SELECT role_id, role_name FROM user_roles WHERE role_archived_at IS NULL");
                             while ($row = mysqli_fetch_assoc($sql_user_roles)) {
                                 $role_id = intval($row['role_id']);
                                 $role_name = escapeHtml($row['role_name']);
@@ -190,7 +190,7 @@ ob_start();
                         <tbody>
 
                         <?php
-                        $sql_client_select = mysqli_query($mysqli, "SELECT * FROM clients WHERE client_archived_at IS NULL ORDER BY client_name ASC");
+                        $sql_client_select = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients WHERE client_archived_at IS NULL ORDER BY client_name ASC");
                         while ($row = mysqli_fetch_assoc($sql_client_select)) {
                             $client_id_select = intval($row['client_id']);
                             $client_name_select = escapeHtml($row['client_name']);
diff --git a/admin/modals/user/user_restore.php b/admin/modals/user/user_restore.php
index 6efe66798..0bab5b299 100644
--- a/admin/modals/user/user_restore.php
+++ b/admin/modals/user/user_restore.php
@@ -4,7 +4,7 @@ require_once '../../includes/modal_header.php';
 
 $user_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM users WHERE user_id = $user_id AND user_archived_at IS NOT NULL LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT user_avatar, user_email, user_name, user_role_id FROM users WHERE user_id = $user_id AND user_archived_at IS NOT NULL LIMIT 1");
 
 $row = mysqli_fetch_assoc($sql);
 $user_name = str_replace(" (archived)", "", $row['user_name']); //Removed (archived) from user_name
@@ -63,7 +63,7 @@ ob_start();
                 </div>
                 <select class="form-control select2" name="role" required>
                     <?php
-                    $sql_user_roles = mysqli_query($mysqli, "SELECT * FROM user_roles WHERE role_archived_at IS NULL");
+                    $sql_user_roles = mysqli_query($mysqli, "SELECT role_id, role_name FROM user_roles WHERE role_archived_at IS NULL");
                     while ($row = mysqli_fetch_assoc($sql_user_roles)) {
                         $role_id = intval($row['role_id']);
                         $role_name = escapeHtml($row['role_name']);
diff --git a/admin/modals/vendor_template/vendor_template_edit.php b/admin/modals/vendor_template/vendor_template_edit.php
index bcc989576..13a6b2a42 100644
--- a/admin/modals/vendor_template/vendor_template_edit.php
+++ b/admin/modals/vendor_template/vendor_template_edit.php
@@ -4,7 +4,10 @@ require_once '../../includes/modal_header.php';
 
 $vendor_template_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM vendor_templates WHERE vendor_template_id = $vendor_template_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT vendor_template_account_number, vendor_template_code, vendor_template_contact_name,
+    vendor_template_description, vendor_template_email, vendor_template_extension,
+    vendor_template_hours, vendor_template_name, vendor_template_notes, vendor_template_phone,
+    vendor_template_phone_country_code, vendor_template_sla, vendor_template_website FROM vendor_templates WHERE vendor_template_id = $vendor_template_id LIMIT 1");
 $row = mysqli_fetch_assoc($sql);
 $vendor_name = escapeHtml($row['vendor_template_name']);
 $vendor_description = escapeHtml($row['vendor_template_description']);
diff --git a/admin/modules.php b/admin/modules.php
index 03ad24819..88f09b2e6 100644
--- a/admin/modules.php
+++ b/admin/modules.php
@@ -8,7 +8,7 @@ require_once "includes/inc_all_admin.php";
 
 $sql = mysqli_query(
     $mysqli,
-    "SELECT SQL_CALC_FOUND_ROWS * FROM modules
+    "SELECT SQL_CALC_FOUND_ROWS module_description, module_id, module_name FROM modules
     WHERE (module_name LIKE '%$q%' OR module_description LIKE '%$q%')
     ORDER BY $sort $order LIMIT $record_from, $record_to"
 );
diff --git a/admin/payment_methods.php b/admin/payment_methods.php
index 3edafa971..ddfaf83c3 100644
--- a/admin/payment_methods.php
+++ b/admin/payment_methods.php
@@ -6,7 +6,8 @@ $order = "ASC";
 
 require_once "includes/inc_all_admin.php";
 
-$sql = mysqli_query($mysqli, "SELECT * FROM payment_methods ORDER BY $sort $order");
+$sql = mysqli_query($mysqli, "SELECT payment_method_created_at, payment_method_description, payment_method_id,
+    payment_method_name FROM payment_methods ORDER BY $sort $order");
 
 $num_rows = mysqli_num_rows($sql);
 
diff --git a/admin/payment_providers.php b/admin/payment_providers.php
index e80a62ea3..0f7545f03 100644
--- a/admin/payment_providers.php
+++ b/admin/payment_providers.php
@@ -6,7 +6,8 @@ $order = "ASC";
 
 require_once "includes/inc_all_admin.php";
 
-$sql = mysqli_query($mysqli, "SELECT * FROM payment_providers
+$sql = mysqli_query($mysqli, "SELECT account_name, category_name, payment_provider_description, payment_provider_id,
+    payment_provider_name, payment_provider_threshold, vendor_name FROM payment_providers
     LEFT JOIN accounts ON payment_provider_account = account_id
     LEFT JOIN vendors ON payment_provider_expense_vendor = vendor_id
     LEFT JOIN categories ON payment_provider_expense_category = category_id
diff --git a/admin/post.php b/admin/post.php
index 272b8564e..6802e4bfb 100644
--- a/admin/post.php
+++ b/admin/post.php
@@ -10,7 +10,11 @@ require_once __DIR__ . "/../includes/check_login.php";
 // Only allow running post files via inclusion (prevents people/bots poking them directly)
 define('FROM_POST_HANDLER', true);
 
-// Load all admin module POST logic
+// Load all admin module POST logic.
+// *_model.php is a RESERVED suffix: those files are not handlers, they are inline
+// field-parsing fragments that read $_POST at include time, so the glob must not
+// pull them in. A handler named *_model.php is silently never loaded - name entity
+// handlers around it (admin/post/ai_models.php, not ai_model.php).
 if (!empty($session_is_admin)) {
     foreach (glob(__DIR__ . "/post/*.php") as $admin_module) {
         if (!str_ends_with($admin_module, '_model.php')) {
@@ -22,3 +26,11 @@ if (!empty($session_is_admin)) {
 // Logout is shared between portals
 require_once __DIR__ . "/../post/logout.php";
 require_once __DIR__ . "/../post/misc.php";
+
+// Every handler above exits or redirects, so getting here means no handler claimed
+// the request - a blank page and no trace of why. Log it; the usual cause is a
+// handler file that never loaded.
+if ($_SERVER['REQUEST_METHOD'] === 'POST') {
+    $unhandled = implode(', ', array_slice(array_keys($_POST), 0, 10));
+    logApp('Request', 'warning', "Unhandled POST to admin/post.php - no handler matched. Fields: $unhandled");
+}
diff --git a/admin/post/ai_model.php b/admin/post/ai_models.php
similarity index 60%
rename from admin/post/ai_model.php
rename to admin/post/ai_models.php
index f6ceaddce..cf927ff51 100644
--- a/admin/post/ai_model.php
+++ b/admin/post/ai_models.php
@@ -1,7 +1,7 @@
 <?php
 
 /*
- * ITFlow - GET/POST request handler for AI Models ('ai_model')
+ * ITFlow - GET/POST request handler for AI Models ('ai_models')
  */
 
 defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
@@ -15,9 +15,17 @@ if (isset($_POST['add_ai_model'])) {
     $prompt = escapeSql($_POST['prompt']);
     $use_case = escapeSql($_POST['use_case']);
 
-    mysqli_query($mysqli,"INSERT INTO ai_models SET ai_model_name = '$model', ai_model_prompt = '$prompt', ai_model_use_case = '$use_case', ai_model_ai_provider_id = $provider_id");
+    // Blank means "send no temperature at all" - the only setting that works on every
+    // provider. Anything else rides as a numeric literal, so no quoting.
+    $temperature = ($_POST['temperature'] ?? '') === '' ? 'NULL' : floatval($_POST['temperature']);
 
-    $ai_model_id = mysqli_insert_id($mysqli);
+    mysqli_query($mysqli,"INSERT INTO ai_models SET ai_model_name = '$model', ai_model_prompt = '$prompt', ai_model_use_case = '$use_case', ai_model_temperature = $temperature, ai_model_ai_provider_id = $provider_id");
+
+    if (!mysqli_affected_rows($mysqli)) {
+        logApp('AI', 'error', 'Failed to create AI Model ' . $model . ': ' . mysqli_error($mysqli));
+        flashAlert("AI Model <strong>$model</strong> could not be created - see Admin > App Logs", 'error');
+        redirect();
+    }
 
     logAudit("AI Model", "Create", "$session_name created AI Model $model");
 
@@ -36,7 +44,11 @@ if (isset($_POST['edit_ai_model'])) {
     $prompt = escapeSql($_POST['prompt']);
     $use_case = escapeSql($_POST['use_case']);
 
-    mysqli_query($mysqli,"UPDATE ai_models SET ai_model_name = '$model', ai_model_prompt = '$prompt', ai_model_use_case = '$use_case' WHERE ai_model_id = $model_id");
+    // Blank means "send no temperature at all" - the only setting that works on every
+    // provider. Anything else rides as a numeric literal, so no quoting.
+    $temperature = ($_POST['temperature'] ?? '') === '' ? 'NULL' : floatval($_POST['temperature']);
+
+    mysqli_query($mysqli,"UPDATE ai_models SET ai_model_name = '$model', ai_model_prompt = '$prompt', ai_model_use_case = '$use_case', ai_model_temperature = $temperature WHERE ai_model_id = $model_id");
 
     logAudit("AI Model", "Edit", "$session_name edited AI Model $model");
 
diff --git a/admin/post/users.php b/admin/post/users.php
index 418263fc0..b670ed8b3 100644
--- a/admin/post/users.php
+++ b/admin/post/users.php
@@ -54,7 +54,7 @@ if (isset($_POST['add_user'])) {
     // Create Settings
     mysqli_query($mysqli, "INSERT INTO user_settings SET user_id = $user_id, user_config_force_mfa = $force_mfa");
 
-    $sql = mysqli_query($mysqli,"SELECT * FROM companies WHERE company_id = 1");
+    $sql = mysqli_query($mysqli,"SELECT company_name FROM companies WHERE company_id = 1");
     $row = mysqli_fetch_assoc($sql);
     $company_name = escapeSql($row['company_name']);
 
@@ -328,7 +328,7 @@ if (isset($_POST['restore_user'])) {
 
 }
 
-if (isset($_POST['export_users'])) {
+if (isExportRequest('export_users')) {
 
     validateCSRFToken();
 
@@ -355,7 +355,7 @@ if (isset($_POST['export_users'])) {
 
     $sql = mysqli_query(
         $mysqli,
-        "SELECT * FROM users
+        "SELECT user_status FROM users
         LEFT JOIN user_roles ON user_role_id = role_id
         WHERE (user_name LIKE '%$q%' OR user_email LIKE '%$q%')
         AND user_type = 1
@@ -402,7 +402,7 @@ if (isset($_POST['ir_reset_user_password'])) {
 
     // Confirm logged-in user password, for security
     $admin_password = $_POST['admin_password'];
-    $sql = mysqli_query($mysqli, "SELECT * FROM users WHERE user_id = $session_user_id");
+    $sql = mysqli_query($mysqli, "SELECT user_password FROM users WHERE user_id = $session_user_id");
     $userRow = mysqli_fetch_assoc($sql);
 
     if (!password_verify($admin_password, $userRow['user_password'])) {
@@ -411,7 +411,7 @@ if (isset($_POST['ir_reset_user_password'])) {
     }
 
     // Get agents/users, other than the current user
-    $sql_users = mysqli_query($mysqli, "SELECT * FROM users WHERE (user_archived_at IS NULL AND user_id != $session_user_id)");
+    $sql_users = mysqli_query($mysqli, "SELECT user_email, user_id FROM users WHERE (user_archived_at IS NULL AND user_id != $session_user_id)");
 
     // Reset passwords
     while ($row = mysqli_fetch_assoc($sql_users)) {
diff --git a/admin/project_template.php b/admin/project_template.php
index 569598ae2..10ab24e78 100644
--- a/admin/project_template.php
+++ b/admin/project_template.php
@@ -8,7 +8,8 @@ if (isset($_GET['project_template_id'])) {
 
     $sql_project_templates = mysqli_query(
         $mysqli,
-        "SELECT * FROM project_templates
+        "SELECT project_template_created_at, project_template_description, project_template_name,
+            project_template_updated_at FROM project_templates
         WHERE project_template_id = $project_template_id LIMIT 1"
     );
 
@@ -27,7 +28,9 @@ if (isset($_GET['project_template_id'])) {
     $project_template_updated_at = escapeHtml($row['project_template_updated_at']);
 
     // Get Associated Ticket Templates
-    $sql_ticket_templates = mysqli_query($mysqli, "SELECT * FROM ticket_templates, project_template_ticket_templates
+    $sql_ticket_templates = mysqli_query($mysqli, "SELECT ticket_template_created_at, ticket_template_description,
+        project_template_ticket_templates.ticket_template_id, ticket_template_name,
+        ticket_template_order, ticket_template_subject, ticket_template_updated_at FROM ticket_templates, project_template_ticket_templates
         WHERE ticket_templates.ticket_template_id = project_template_ticket_templates.ticket_template_id
         AND project_template_ticket_templates.project_template_id = $project_template_id
         ORDER BY ticket_template_order ASC, ticket_template_name ASC");
@@ -35,7 +38,7 @@ if (isset($_GET['project_template_id'])) {
 
     // Get All Task Templates
     $sql_task_templates = mysqli_query($mysqli,
-        "SELECT * FROM ticket_templates, task_templates, project_template_ticket_templates
+        "SELECT task_template_id, task_template_name FROM ticket_templates, task_templates, project_template_ticket_templates
         WHERE ticket_templates.ticket_template_id = project_template_ticket_templates.ticket_template_id
         AND project_template_ticket_templates.project_template_id = $project_template_id
         AND ticket_templates.ticket_template_id = task_template_ticket_template_id
diff --git a/admin/project_templates.php b/admin/project_templates.php
index 09204da3c..bef84f25a 100644
--- a/admin/project_templates.php
+++ b/admin/project_templates.php
@@ -8,7 +8,8 @@ require_once "includes/inc_all_admin.php";
 
 $sql = mysqli_query(
     $mysqli,
-    "SELECT SQL_CALC_FOUND_ROWS * FROM project_templates
+    "SELECT SQL_CALC_FOUND_ROWS project_template_created_at, project_template_description, project_template_id,
+        project_template_name FROM project_templates
     WHERE (project_template_name LIKE '%$q%' OR project_template_description LIKE '%$q%')
     AND project_template_archived_at IS NULL
     ORDER BY $sort $order LIMIT $record_from, $record_to"
@@ -68,7 +69,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                     $project_template_created_at = escapeHtml($row['project_template_created_at']);
 
                     // Get Ticket Template Count
-                    $sql_ticket_templates = mysqli_query($mysqli, "SELECT * FROM ticket_templates, project_template_ticket_templates
+                    $sql_ticket_templates = mysqli_query($mysqli, "SELECT 1 FROM ticket_templates, project_template_ticket_templates
                         WHERE ticket_templates.ticket_template_id = project_template_ticket_templates.ticket_template_id
                         AND project_template_ticket_templates.project_template_id = $project_template_id
                         ORDER BY ticket_template_order ASC, ticket_template_name ASC");
@@ -76,7 +77,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
 
                     // Get Tasks Template Count
                     $sql_task_templates = mysqli_query($mysqli,
-                        "SELECT * FROM ticket_templates, task_templates, project_template_ticket_templates
+                        "SELECT 1 FROM ticket_templates, task_templates, project_template_ticket_templates
                         WHERE ticket_templates.ticket_template_id = project_template_ticket_templates.ticket_template_id
                         AND project_template_ticket_templates.project_template_id = $project_template_id
                         AND ticket_templates.ticket_template_id = task_template_ticket_template_id
diff --git a/admin/roles.php b/admin/roles.php
index ffcfca265..5ba2ed820 100644
--- a/admin/roles.php
+++ b/admin/roles.php
@@ -75,7 +75,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                         $sql_role_user_count = mysqli_query($mysqli, "SELECT COUNT(user_id) FROM users WHERE user_role_id = $role_id AND user_archived_at IS NULL");
                         $role_user_count = mysqli_fetch_row($sql_role_user_count)[0];
 
-                        $sql_users = mysqli_query($mysqli, "SELECT * FROM users WHERE user_role_id = $role_id AND user_archived_at IS NULL");
+                        $sql_users = mysqli_query($mysqli, "SELECT user_name FROM users WHERE user_role_id = $role_id AND user_archived_at IS NULL");
                         // Initialize an empty array to hold user names
                         $user_names = [];
 
diff --git a/admin/settings_company.php b/admin/settings_company.php
index 0fbe14d72..bd297ea0e 100644
--- a/admin/settings_company.php
+++ b/admin/settings_company.php
@@ -2,7 +2,9 @@
 require_once "includes/inc_all_admin.php";
 
 
-$sql = mysqli_query($mysqli,"SELECT * FROM companies, settings WHERE companies.company_id = settings.company_id AND companies.company_id = 1");
+$sql = mysqli_query($mysqli,"SELECT company_address, company_city, company_country, company_currency, company_email,
+    settings.company_id, company_locale, company_logo, company_name, company_phone,
+    company_phone_country_code, company_state, company_tax_id, company_website, company_zip FROM companies, settings WHERE companies.company_id = settings.company_id AND companies.company_id = 1");
 
 $row = mysqli_fetch_assoc($sql);
 $company_id = intval($row['company_id']);
diff --git a/admin/settings_default.php b/admin/settings_default.php
index d0912d8a6..a9add9673 100644
--- a/admin/settings_default.php
+++ b/admin/settings_default.php
@@ -59,7 +59,7 @@ $net_terms_array = array (
                         <option value="0">- None -</option>
                         <?php
 
-                        $sql = mysqli_query($mysqli, "SELECT * FROM calendars ORDER BY calendar_name ASC");
+                        $sql = mysqli_query($mysqli, "SELECT calendar_id, calendar_name FROM calendars ORDER BY calendar_name ASC");
                         while ($row = mysqli_fetch_assoc($sql)) {
                             $calendar_id = intval($row['calendar_id']);
                             $calendar_name = escapeHtml($row['calendar_name']); ?>
@@ -82,7 +82,7 @@ $net_terms_array = array (
                         <option value="0">- None -</option>
                         <?php
 
-                        $sql = mysqli_query($mysqli, "SELECT * FROM accounts WHERE account_archived_at IS NULL ORDER BY account_name ASC");
+                        $sql = mysqli_query($mysqli, "SELECT account_id, account_name FROM accounts WHERE account_archived_at IS NULL ORDER BY account_name ASC");
                         while ($row = mysqli_fetch_assoc($sql)) {
                             $account_id = intval($row['account_id']);
                             $account_name = escapeHtml($row['account_name']); ?>
@@ -105,7 +105,7 @@ $net_terms_array = array (
                         <option value="0">- None -</option>
                         <?php
 
-                        $sql = mysqli_query($mysqli, "SELECT * FROM accounts WHERE account_archived_at IS NULL ORDER BY account_name ASC");
+                        $sql = mysqli_query($mysqli, "SELECT account_id, account_name FROM accounts WHERE account_archived_at IS NULL ORDER BY account_name ASC");
                         while ($row = mysqli_fetch_assoc($sql)) {
                             $account_id = intval($row['account_id']);
                             $account_name = escapeHtml($row['account_name']); ?>
@@ -128,7 +128,7 @@ $net_terms_array = array (
                         <option value="0">- None -</option>
                         <?php
 
-                        $sql = mysqli_query($mysqli, "SELECT * FROM accounts WHERE account_archived_at IS NULL ORDER BY account_name ASC");
+                        $sql = mysqli_query($mysqli, "SELECT account_id, account_name FROM accounts WHERE account_archived_at IS NULL ORDER BY account_name ASC");
                         while ($row = mysqli_fetch_assoc($sql)) {
                             $account_id = intval($row['account_id']);
                             $account_name = escapeHtml($row['account_name']); ?>
@@ -153,7 +153,7 @@ $net_terms_array = array (
                         <option value="0">- None -</option>
                         <?php
 
-                        $sql = mysqli_query($mysqli, "SELECT * FROM accounts WHERE account_archived_at IS NULL ORDER BY account_name ASC");
+                        $sql = mysqli_query($mysqli, "SELECT account_id, account_name FROM accounts WHERE account_archived_at IS NULL ORDER BY account_name ASC");
                         while ($row = mysqli_fetch_assoc($sql)) {
                             $account_id = intval($row['account_id']);
                             $account_name = escapeHtml($row['account_name']); ?>
@@ -176,7 +176,7 @@ $net_terms_array = array (
                         <option value="">- None -</option>
                         <?php
 
-                        $sql = mysqli_query($mysqli, "SELECT * FROM categories WHERE category_type = 'Payment Method' ORDER BY category_name ASC");
+                        $sql = mysqli_query($mysqli, "SELECT category_name FROM categories WHERE category_type = 'Payment Method' ORDER BY category_name ASC");
                         while ($row = mysqli_fetch_assoc($sql)) {
                             $payment_method = escapeHtml($row['category_name']); ?>
                             <option <?php if ($config_default_payment_method == $payment_method) {
@@ -198,7 +198,7 @@ $net_terms_array = array (
                         <option value="">- None -</option>
                         <?php
 
-                        $sql = mysqli_query($mysqli, "SELECT * FROM categories WHERE category_type = 'Payment Method' ORDER BY category_name ASC");
+                        $sql = mysqli_query($mysqli, "SELECT category_name FROM categories WHERE category_type = 'Payment Method' ORDER BY category_name ASC");
                         while ($row = mysqli_fetch_assoc($sql)) {
                             $payment_method = escapeHtml($row['category_name']); ?>
                             <option <?php if ($config_default_expense_payment_method == $payment_method) {
diff --git a/admin/settings_localization.php b/admin/settings_localization.php
index c0c8212d7..bb4ddd532 100644
--- a/admin/settings_localization.php
+++ b/admin/settings_localization.php
@@ -2,7 +2,7 @@
 require_once "includes/inc_all_admin.php";
 
 
-$sql = mysqli_query($mysqli,"SELECT * FROM companies, settings WHERE companies.company_id = settings.company_id AND companies.company_id = 1");
+$sql = mysqli_query($mysqli,"SELECT company_currency, company_locale FROM companies, settings WHERE companies.company_id = settings.company_id AND companies.company_id = 1");
 
 $row = mysqli_fetch_assoc($sql);
 $company_locale = escapeHtml($row['company_locale']);
diff --git a/admin/sla.php b/admin/sla.php
index dbdf76296..b23d90bac 100644
--- a/admin/sla.php
+++ b/admin/sla.php
@@ -12,7 +12,8 @@ $config_sla_warning_percent = intval($row['config_sla_warning_percent']);
 $config_sla_notification_email = escapeHtml($row['config_sla_notification_email']);
 
 // SLA plans (active first)
-$sql_slas = mysqli_query($mysqli, "SELECT * FROM slas ORDER BY sla_archived_at IS NOT NULL, sla_name ASC");
+$sql_slas = mysqli_query($mysqli, "SELECT sla_archived_at, sla_description, sla_id, sla_name, sla_resolution_minutes,
+    sla_response_minutes FROM slas ORDER BY sla_archived_at IS NOT NULL, sla_name ASC");
 
 // Active plans for the assignment dropdowns
 $active_slas = [];
diff --git a/admin/software_templates.php b/admin/software_templates.php
index 4672b8706..660053b01 100644
--- a/admin/software_templates.php
+++ b/admin/software_templates.php
@@ -8,7 +8,9 @@ require_once "includes/inc_all_admin.php";
 
 $sql = mysqli_query(
     $mysqli,
-    "SELECT SQL_CALC_FOUND_ROWS * FROM software_templates
+    "SELECT SQL_CALC_FOUND_ROWS software_template_description, software_template_id, software_template_license_type,
+        software_template_name, software_template_notes, software_template_type,
+        software_template_version FROM software_templates
     WHERE software_template_name LIKE '%$q%' OR software_template_type LIKE '%$q%'
     ORDER BY $sort $order LIMIT $record_from, $record_to"
 );
diff --git a/admin/tags.php b/admin/tags.php
index 33cfa9a66..92cb22594 100644
--- a/admin/tags.php
+++ b/admin/tags.php
@@ -26,7 +26,7 @@ $tag_type_display = $tag_types[$type_filter]['label'] ?? 'Unknown';
 
 $sql = mysqli_query(
     $mysqli,
-    "SELECT SQL_CALC_FOUND_ROWS * FROM tags
+    "SELECT SQL_CALC_FOUND_ROWS tag_color, tag_icon, tag_id, tag_name FROM tags
     WHERE tag_name LIKE '%$q%'
     AND tag_type = $type_filter
     ORDER BY $sort $order LIMIT $record_from, $record_to"
diff --git a/admin/tax_rates.php b/admin/tax_rates.php
index a50a5174e..ddd70e4fe 100644
--- a/admin/tax_rates.php
+++ b/admin/tax_rates.php
@@ -8,7 +8,7 @@ require_once "includes/inc_all_admin.php";
 
 $sql = mysqli_query(
     $mysqli,
-    "SELECT * FROM taxes
+    "SELECT tax_id, tax_name, tax_percent FROM taxes
     WHERE tax_archived_at IS NULL
     ORDER BY $sort $order"
 );
diff --git a/admin/ticket_statuses.php b/admin/ticket_statuses.php
index 82ae5bb07..c0bfc18c5 100644
--- a/admin/ticket_statuses.php
+++ b/admin/ticket_statuses.php
@@ -8,7 +8,8 @@ require_once "includes/inc_all_admin.php";
 
 $sql = mysqli_query(
     $mysqli,
-    "SELECT SQL_CALC_FOUND_ROWS * FROM ticket_statuses
+    "SELECT SQL_CALC_FOUND_ROWS ticket_status_active, ticket_status_color, ticket_status_id, ticket_status_name,
+        ticket_status_pauses_sla FROM ticket_statuses
     WHERE ticket_status_name LIKE '%$q%'
     ORDER BY $sort $order LIMIT $record_from, $record_to"
 );
diff --git a/admin/ticket_template.php b/admin/ticket_template.php
index 4cff73861..55faac80b 100644
--- a/admin/ticket_template.php
+++ b/admin/ticket_template.php
@@ -15,7 +15,8 @@ if (isset($_GET['ticket_template_id'])) {
     $ticket_template_id = intval($_GET['ticket_template_id']);
 }
 
-$sql_ticket_template = mysqli_query($mysqli, "SELECT * FROM ticket_templates WHERE ticket_template_id = $ticket_template_id LIMIT 1");
+$sql_ticket_template = mysqli_query($mysqli, "SELECT ticket_template_created_at, ticket_template_description, ticket_template_details,
+    ticket_template_name, ticket_template_subject, ticket_template_updated_at FROM ticket_templates WHERE ticket_template_id = $ticket_template_id LIMIT 1");
 
 if (mysqli_num_rows($sql_ticket_template) == 0) {
     echo "<center><h1 class='text-secondary mt-5'>Nothing to see here</h1><a class='btn btn-lg btn-secondary mt-3' href='javascript:history.back()'><i class='fa fa-fw fa-arrow-left'></i> Go Back</a></center>";
@@ -33,7 +34,7 @@ $ticket_template_created_at = escapeHtml($row['ticket_template_created_at']);
 $ticket_template_updated_at = escapeHtml($row['ticket_template_updated_at']);
 
 // Get Task Templates
-$sql_task_templates = mysqli_query($mysqli, "SELECT * FROM task_templates WHERE task_template_ticket_template_id = $ticket_template_id ORDER BY task_template_order ASC, task_template_id ASC");
+$sql_task_templates = mysqli_query($mysqli, "SELECT task_template_completion_estimate, task_template_id, task_template_name FROM task_templates WHERE task_template_ticket_template_id = $ticket_template_id ORDER BY task_template_order ASC, task_template_id ASC");
 
 ?>
 
diff --git a/admin/users.php b/admin/users.php
index d29a050ec..954ae331e 100644
--- a/admin/users.php
+++ b/admin/users.php
@@ -8,7 +8,8 @@ require_once "includes/inc_all_admin.php";
 
 $sql = mysqli_query(
     $mysqli,
-    "SELECT SQL_CALC_FOUND_ROWS * FROM users
+    "SELECT SQL_CALC_FOUND_ROWS role_name, user_archived_at, user_avatar, user_config_force_mfa, user_email,
+        user_settings.user_id, user_name, user_role_id, user_status, user_token FROM users
     LEFT JOIN user_roles ON user_role_id = role_id
     LEFT JOIN user_settings ON users.user_id = user_settings.user_id
     WHERE (user_name LIKE '%$q%' OR user_email LIKE '%$q%')
@@ -132,7 +133,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
 
                     $sql_last_login = mysqli_query(
                         $mysqli,
-                        "SELECT * FROM logs
+                        "SELECT log_created_at, log_ip, log_user_agent FROM logs
                         WHERE log_user_id = $user_id AND log_type = 'Login'
                         ORDER BY log_id DESC LIMIT 1"
                     );
@@ -155,7 +156,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                         $client_access_array[] = intval($row['client_id']);
                     }
 
-                    $sql_remember_tokens = mysqli_query($mysqli, "SELECT * FROM remember_tokens WHERE remember_token_user_id = $user_id");
+                    $sql_remember_tokens = mysqli_query($mysqli, "SELECT 1 FROM remember_tokens WHERE remember_token_user_id = $user_id");
                     $remember_token_count = mysqli_num_rows($sql_remember_tokens);
 
 
diff --git a/admin/vendor_templates.php b/admin/vendor_templates.php
index bbda9d1ef..6a58fdf5e 100644
--- a/admin/vendor_templates.php
+++ b/admin/vendor_templates.php
@@ -8,7 +8,10 @@ require_once "includes/inc_all_admin.php";
 
 $sql = mysqli_query(
     $mysqli,
-    "SELECT SQL_CALC_FOUND_ROWS * FROM vendor_templates
+    "SELECT SQL_CALC_FOUND_ROWS vendor_template_account_number, vendor_template_code, vendor_template_contact_name,
+        vendor_template_description, vendor_template_email, vendor_template_extension,
+        vendor_template_hours, vendor_template_id, vendor_template_name, vendor_template_notes,
+        vendor_template_phone, vendor_template_sla, vendor_template_website FROM vendor_templates
     WHERE vendor_template_name LIKE '%$q%' OR vendor_template_description LIKE '%$q%' OR vendor_template_account_number LIKE '%$q%' OR vendor_template_website LIKE '%$q%' OR vendor_template_contact_name LIKE '%$q%' OR vendor_template_email LIKE '%$q%' OR vendor_template_phone LIKE '%$phone_query%' ORDER BY $sort $order LIMIT $record_from, $record_to"
 );
 
diff --git a/agent/accounts.php b/agent/accounts.php
index ef8301d71..bae78d76b 100644
--- a/agent/accounts.php
+++ b/agent/accounts.php
@@ -11,7 +11,7 @@ enforceUserPermission('module_financial');
 
 $sql = mysqli_query(
     $mysqli,
-    "SELECT SQL_CALC_FOUND_ROWS * FROM accounts
+    "SELECT SQL_CALC_FOUND_ROWS account_currency_code, account_id, account_name, account_notes, opening_balance FROM accounts
     WHERE (account_name LIKE '%$q%')
     AND account_archived_at IS NULL
     ORDER BY $sort $order LIMIT $record_from, $record_to"
diff --git a/agent/ajax.php b/agent/ajax.php
index 40d7ca1d9..ee8746a82 100644
--- a/agent/ajax.php
+++ b/agent/ajax.php
@@ -239,7 +239,7 @@ if (isset($_GET['share_generate_link'])) {
         $url = "https://$config_base_url/guest/guest_view_item.php?id=$share_id&key=$item_key";
     }
 
-    $sql = mysqli_query($mysqli,"SELECT * FROM companies WHERE company_id = 1");
+    $sql = mysqli_query($mysqli,"SELECT company_name, company_phone, company_phone_country_code FROM companies WHERE company_id = 1");
     $row = mysqli_fetch_assoc($sql);
     $company_name = escapeSql($row['company_name']);
     $company_phone = escapeSql(formatPhoneNumber($row['company_phone'], $row['company_phone_country_code']));
@@ -294,7 +294,7 @@ if (isset($_GET['get_active_clients'])) {
         $mysqli,
         "SELECT client_id, client_name FROM clients
         WHERE client_archived_at IS NULL
-        $access_permission_query
+        " . clientScopeSql('clients.client_id') . "
         ORDER BY client_accessed_at DESC"
     );
 
@@ -320,7 +320,7 @@ if (isset($_GET['get_client_contacts'])) {
         "SELECT contact_id, contact_name, contact_title, contact_email, contact_primary, contact_important, contact_technical FROM contacts
         LEFT JOIN clients on contact_client_id = client_id
         WHERE contacts.contact_archived_at IS NULL AND contact_client_id = $client_id
-        $access_permission_query
+        " . clientScopeSql('contact_client_id') . "
         ORDER BY contact_primary DESC, contact_technical DESC, contact_important DESC, contact_name"
     );
 
@@ -350,7 +350,7 @@ if (isset($_GET['get_client_assets'])) {
         LEFT JOIN clients on asset_client_id = client_id
         LEFT JOIN contacts ON contact_id = asset_contact_id
         WHERE assets.asset_archived_at IS NULL AND asset_client_id = $client_id
-        $access_permission_query
+        " . clientScopeSql('asset_client_id') . "
         ORDER BY asset_type ASC, asset_favorite DESC, asset_name"
     );
 
@@ -379,7 +379,7 @@ if (isset($_GET['get_client_locations'])) {
         "SELECT location_id, location_name FROM locations
         LEFT JOIN clients on location_client_id = client_id
         WHERE locations.location_archived_at IS NULL AND location_client_id = $client_id
-        $access_permission_query
+        " . clientScopeSql('location_client_id') . "
         ORDER BY location_primary DESC, location_name ASC"
     );
 
@@ -408,7 +408,7 @@ if (isset($_GET['get_client_vendors'])) {
         "SELECT vendor_id, vendor_name FROM vendors
         LEFT JOIN clients on vendor_client_id = client_id
         WHERE vendors.vendor_archived_at IS NULL AND vendor_client_id = $client_id
-        $access_permission_query
+        " . clientScopeSql('vendor_client_id') . "
         ORDER BY vendor_name ASC"
     );
 
@@ -437,7 +437,7 @@ if (isset($_GET['get_client_projects'])) {
         "SELECT project_id, project_name FROM projects
         LEFT JOIN clients on project_client_id = client_id
         WHERE projects.project_archived_at IS NULL AND projects.project_completed_at IS NULL AND project_client_id = $client_id
-        $access_permission_query
+        " . clientScopeSql('project_client_id') . "
         ORDER BY project_name ASC"
     );
 
@@ -564,7 +564,6 @@ if (isset($_POST['update_kanban_ticket'])) {
 
                     // Get details
                     $ticket_sql = mysqli_query($mysqli, "SELECT contact_name, contact_email, ticket_prefix, ticket_number, ticket_subject, ticket_status_name, ticket_assigned_to, ticket_url_key, ticket_client_id FROM tickets
-                        LEFT JOIN clients ON ticket_client_id = client_id
                         LEFT JOIN contacts ON ticket_contact_id = contact_id
                         LEFT JOIN ticket_statuses ON ticket_status = ticket_status_id
                         WHERE ticket_id = $ticket_id
@@ -838,127 +837,88 @@ if (isset($_GET['ai_reword'])) {
 
     header('Content-Type: application/json');
 
-    $sql = mysqli_query($mysqli, "SELECT * FROM ai_models LEFT JOIN ai_providers ON ai_model_ai_provider_id = ai_provider_id WHERE ai_model_use_case = 'General' LIMIT 1");
+    // The reword button sits on every TinyMCE instance, so the ticket editor asks for
+    // the Tickets model and everything else gets General. Anything unrecognised is
+    // treated as General rather than trusted into the query.
+    $use_case = ($_GET['use_case'] ?? '') === 'Tickets' ? 'Tickets' : 'General';
 
-    $row = mysqli_fetch_assoc($sql);
-    $model_name = $row['ai_model_name'];
-    $promptText = $row['ai_model_prompt'];
-    $url = $row['ai_provider_api_url'];
-    $key = $row['ai_provider_api_key'];
+    $model = getAiModel($use_case);
+
+    if (!$model) {
+        echo json_encode(['error' => aiModelMissingError($use_case)]);
+        exit;
+    }
 
     // Collecting the input data from the AJAX request.
     $inputJSON = file_get_contents('php://input');
     $input = json_decode($inputJSON, TRUE); // Convert JSON into array.
 
-    $userText = $input['text'];
+    $userText = $input['text'] ?? '';
 
-    // Preparing the data for the OpenAI Chat API request.
-    $data = [
-        "model" => "$model_name", // Specify the model
-        "messages" => [
-            ["role" => "system", "content" => $promptText],
-            ["role" => "user", "content" => $userText],
-        ],
-        "temperature" => 0.5
-    ];
-
-    // Initialize cURL session to the OpenAI Chat API.
-    $ch = curl_init("$url");
-
-    // Set cURL options for the request.
-    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
-    curl_setopt($ch, CURLOPT_POST, true);
-    curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($data));
-    curl_setopt($ch, CURLOPT_HTTPHEADER, [
-        'Content-Type: application/json',
-        'Authorization: Bearer ' . $key,
+    $result = callAiApi($model, [
+        ["role" => "system", "content" => $model['ai_model_prompt']],
+        ["role" => "user", "content" => $userText],
     ]);
 
-    // Execute the cURL session and capture the response.
-    $response = curl_exec($ch);
-    curl_close($ch);
-
-    // Decode the JSON response.
-    $responseData = json_decode($response, true);
-
-    // Check if the response contains the expected data and return it.
-    if (isset($responseData['choices'][0]['message']['content'])) {
-        // Get the response content.
-        $content = $responseData['choices'][0]['message']['content'];
-
-        // Clean any leading "html" word or other unwanted text at the beginning.
-        $content = preg_replace('/^html/i', '', $content);  // Remove any occurrence of 'html' at the start
-
-        // Clean the response content to remove backticks or code block markers.
-        $cleanedContent = str_replace('```', '', $content); // Remove backticks if they exist.
-
-        // Trim any leading/trailing whitespace.
-        $cleanedContent = trim($cleanedContent);
-
-        // Return the cleaned response.
-        echo json_encode(['rewordedText' => $cleanedContent]);
-    } else {
-        // Handle errors or unexpected response structure.
-        echo json_encode(['rewordedText' => 'Failed to get a response from the AI API.']);
+    // Report failures as an error, never as reworded text - the editor writes
+    // rewordedText straight back over the user's content
+    if (!$result['ok']) {
+        echo json_encode(['error' => $result['error']]);
+        exit;
     }
 
+    $content = $result['content'];
+
+    // Clean any leading "html" word or other unwanted text at the beginning.
+    $content = preg_replace('/^html/i', '', $content);  // Remove any occurrence of 'html' at the start
+
+    // Clean the response content to remove backticks or code block markers.
+    $cleanedContent = str_replace('```', '', $content); // Remove backticks if they exist.
+
+    // Trim any leading/trailing whitespace.
+    $cleanedContent = trim($cleanedContent);
+
+    echo json_encode(['rewordedText' => $cleanedContent]);
+
 }
 
 if (isset($_GET['ai_create_document_template'])) {
-    // get_ai_document_template.php
+
+    enforceUserPermission('module_support');
 
     header('Content-Type: text/html; charset=UTF-8');
 
-    $sql = mysqli_query($mysqli, "SELECT * FROM ai_models LEFT JOIN ai_providers ON ai_model_ai_provider_id = ai_provider_id WHERE ai_model_use_case = 'General' LIMIT 1");
-
-    $row = mysqli_fetch_assoc($sql);
-    $model_name = $row['ai_model_name'];
-    $url = $row['ai_provider_api_url'];
-    $key = $row['ai_provider_api_key'];
-
     $prompt = $_POST['prompt'] ?? '';
 
     // Basic validation
-    if(empty($prompt)){
+    if (empty($prompt)) {
         echo "No prompt provided.";
         exit;
     }
 
+    $model = getAiModel('Documentation');
+
+    if (!$model) {
+        echo escapeHtml(aiModelMissingError('Documentation'));
+        exit;
+    }
+
     // Prepare prompt
     $system_message = "You are a helpful IT documentation assistant. You will create a well-structured HTML template for IT documentation based on a given prompt. Include headings, subheadings, bullet points, and possibly tables for clarity. No Lorem Ipsum, use realistic placeholders and professional language.";
     $user_message = "Create an HTML formatted IT documentation template based on the following request:\n\n\"$prompt\"\n\nThe template should be structured, professional, and useful for IT staff. Include relevant sections, instructions, prerequisites, and best practices.";
 
-    $post_data = [
-        "model" => "$model_name",
-        "messages" => [
-            ["role" => "system", "content" => $system_message],
-            ["role" => "user", "content" => $user_message]
-        ],
-        "temperature" => 0.5
-    ];
-
-    $ch = curl_init();
-    curl_setopt($ch, CURLOPT_URL, $url);
-    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
-    curl_setopt($ch, CURLOPT_POST, true);
-    curl_setopt($ch, CURLOPT_HTTPHEADER, [
-        'Content-Type: application/json',
-        'Authorization: Bearer ' . $key
+    $result = callAiApi($model, [
+        ["role" => "system", "content" => $system_message],
+        ["role" => "user", "content" => $user_message]
     ]);
-    curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($post_data));
 
-    $response = curl_exec($ch);
-    if (curl_errno($ch)) {
-        echo "Error: " . curl_error($ch);
+    if (!$result['ok']) {
+        echo "<p>" . escapeHtml($result['error']) . "</p>";
         exit;
     }
-    curl_close($ch);
-
-    $response_data = json_decode($response, true);
-    $template = $response_data['choices'][0]['message']['content'] ?? "<p>No content returned from AI.</p>";
 
     // Print the generated HTML template directly
-    echo $template;
+    echo $result['content'];
 }
 
 if (isset($_GET['ai_ticket_summary'])) {
@@ -967,12 +927,12 @@ if (isset($_GET['ai_ticket_summary'])) {
 
     header('Content-Type: text/html; charset=UTF-8');
 
-    $sql = mysqli_query($mysqli, "SELECT * FROM ai_models LEFT JOIN ai_providers ON ai_model_ai_provider_id = ai_provider_id WHERE ai_model_use_case = 'General' LIMIT 1");
+    $model = getAiModel('Tickets');
 
-    $row = mysqli_fetch_assoc($sql);
-    $model_name = $row['ai_model_name'];
-    $url = $row['ai_provider_api_url'];
-    $key = $row['ai_provider_api_key'];
+    if (!$model) {
+        echo escapeHtml(aiModelMissingError('Tickets'));
+        exit;
+    }
 
     // Retrieve the ticket_id from POST
     $ticket_id = intval($_POST['ticket_id']);
@@ -1049,38 +1009,17 @@ if (isset($_GET['ai_ticket_summary'])) {
     If any part of the ticket or replies is unclear or ambiguous, mention it in the summary and suggest if further clarification is needed.
     ";
 
-    // Prepare the POST data
-    $post_data = [
-        "model" => "$model_name",
-        "messages" => [
-            ["role" => "system", "content" => "Your task is to summarize IT support tickets with clear, concise details."],
-            ["role" => "user", "content" => $prompt]
-        ],
-        "temperature" => 0.3
-    ];
-
-    $ch = curl_init();
-    curl_setopt($ch, CURLOPT_URL, $url);
-    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
-    curl_setopt($ch, CURLOPT_POST, true);
-    curl_setopt($ch, CURLOPT_HTTPHEADER, [
-        'Content-Type: application/json',
-        'Authorization: Bearer ' . $key
+    $result = callAiApi($model, [
+        ["role" => "system", "content" => "Your task is to summarize IT support tickets with clear, concise details."],
+        ["role" => "user", "content" => $prompt]
     ]);
-    curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($post_data));
 
-    $response = curl_exec($ch);
-    if (curl_errno($ch)) {
-        echo "Error: " . curl_error($ch);
+    if (!$result['ok']) {
+        echo "<p>" . escapeHtml($result['error']) . "</p>";
         exit;
     }
-    curl_close($ch);
 
-    $response_data = json_decode($response, true);
-    $summary = $response_data['choices'][0]['message']['content'] ?? "No summary available.";
-
-
-    echo $summary; // nl2br to convert newlines to <br>, htmlspecialchars to prevent XSS
+    echo $result['content'];
 }
 
 // Stops people trying to use sub-domains in the domains tracker
diff --git a/agent/asset.php b/agent/asset.php
index e2798c31f..d7e0e3bdc 100644
--- a/agent/asset.php
+++ b/agent/asset.php
@@ -14,7 +14,15 @@ if (isset($_GET['client_id'])) {
 if (isset($_GET['asset_id'])) {
     $asset_id = intval($_GET['asset_id']);
 
-    $sql = mysqli_query($mysqli, "SELECT * FROM assets
+    $sql = mysqli_query($mysqli, "SELECT asset_contact_id, asset_created_at, asset_description, asset_favorite, asset_id,
+        asset_install_date, asset_location_id, asset_make, asset_model, asset_name, asset_notes,
+        asset_os, asset_photo, asset_physical_location, asset_purchase_date,
+        asset_purchase_reference, asset_serial, asset_status, asset_type, asset_uri, asset_uri_2,
+        asset_uri_client, asset_vendor_id, asset_warranty_expire, client_id, client_name,
+        contact_archived_at, contact_email, contact_extension, contact_mobile,
+        contact_mobile_country_code, contact_name, contact_phone, contact_phone_country_code,
+        interface_ip, interface_ipv6, interface_mac, interface_nat_ip, interface_network_id,
+        location_archived_at, location_name FROM assets
         LEFT JOIN clients ON client_id = asset_client_id
         LEFT JOIN contacts ON asset_contact_id = contact_id
         LEFT JOIN locations ON asset_location_id = location_id
@@ -114,7 +122,7 @@ if (isset($_GET['asset_id'])) {
         $recurring_ticket_count = mysqli_num_rows($sql_related_recurring_tickets);
 
         // Related Documents
-        $sql_related_documents = mysqli_query($mysqli, "SELECT * FROM asset_documents
+        $sql_related_documents = mysqli_query($mysqli, "SELECT 1 FROM asset_documents
             LEFT JOIN documents ON asset_documents.document_id = documents.document_id
             WHERE asset_documents.asset_id = $asset_id
             AND document_archived_at IS NULL
@@ -125,7 +133,7 @@ if (isset($_GET['asset_id'])) {
         // Tags - many to many relationship
         $asset_tag_name_display_array = array();
         $asset_tag_id_array = array();
-        $sql_asset_tags = mysqli_query($mysqli, "SELECT * FROM asset_tags LEFT JOIN tags ON asset_tag_tag_id = tag_id WHERE asset_tag_asset_id = $asset_id ORDER BY tag_name ASC");
+        $sql_asset_tags = mysqli_query($mysqli, "SELECT tag_color, tag_icon, tag_id, tag_name FROM asset_tags LEFT JOIN tags ON asset_tag_tag_id = tag_id WHERE asset_tag_asset_id = $asset_id ORDER BY tag_name ASC");
         while ($row = mysqli_fetch_assoc($sql_asset_tags)) {
 
             $asset_tag_id = intval($row['tag_id']);
@@ -186,7 +194,7 @@ if (isset($_GET['asset_id'])) {
         $interface_count = mysqli_num_rows($sql_related_interfaces);
 
         // Related Files
-        $sql_related_files = mysqli_query($mysqli, "SELECT * FROM asset_files
+        $sql_related_files = mysqli_query($mysqli, "SELECT file_created_at, file_description, file_ext, files.file_id, file_name FROM asset_files
             LEFT JOIN files ON asset_files.file_id = files.file_id
             WHERE asset_files.asset_id = $asset_id
             AND file_archived_at IS NULL
@@ -206,7 +214,8 @@ if (isset($_GET['asset_id'])) {
         }
 
         // Related Documents
-        $sql_related_documents = mysqli_query($mysqli, "SELECT * FROM asset_documents, documents
+        $sql_related_documents = mysqli_query($mysqli, "SELECT document_created_at, document_description, documents.document_id, document_name,
+            document_updated_at, user_name FROM asset_documents, documents
             LEFT JOIN users ON document_created_by = user_id
             WHERE asset_documents.asset_id = $asset_id
             AND asset_documents.document_id = documents.document_id
@@ -243,7 +252,9 @@ if (isset($_GET['asset_id'])) {
         // Related Software Query
         $sql_related_software = mysqli_query(
             $mysqli,
-            "SELECT * FROM software_assets
+            "SELECT software_expire, software_assets.software_id, software_key, software_license_type,
+                software_name, software_notes, software_purchase, software_seats, software_type,
+                software_version FROM software_assets
             LEFT JOIN software ON software_assets.software_id = software.software_id
             WHERE software_assets.asset_id = $asset_id
             AND software_archived_at IS NULL
@@ -253,7 +264,8 @@ if (isset($_GET['asset_id'])) {
         $software_count = mysqli_num_rows($sql_related_software);
 
         // Linked Services
-        $sql_linked_services = mysqli_query($mysqli, "SELECT * FROM service_assets, services
+        $sql_linked_services = mysqli_query($mysqli, "SELECT service_category, service_description, service_assets.service_id, service_importance,
+            service_name FROM service_assets, services
             WHERE service_assets.asset_id = $asset_id
             AND service_assets.service_id = services.service_id
             ORDER BY service_name ASC"
@@ -263,7 +275,7 @@ if (isset($_GET['asset_id'])) {
         $linked_services = array();
 
         // Notes - 1 to many relationship
-        $sql_related_notes = mysqli_query($mysqli, "SELECT * FROM asset_notes
+        $sql_related_notes = mysqli_query($mysqli, "SELECT asset_note, asset_note_created_at, asset_note_id, asset_note_type, user_name FROM asset_notes
             LEFT JOIN users ON asset_note_created_by = user_id
             WHERE asset_note_asset_id = $asset_id
             AND asset_note_archived_at IS NULL
@@ -690,7 +702,7 @@ if (isset($_GET['asset_id'])) {
                                     // Tags
                                     $credential_tag_name_display_array = array();
                                     $credential_tag_id_array = array();
-                                    $sql_credential_tags = mysqli_query($mysqli, "SELECT * FROM credential_tags LEFT JOIN tags ON credential_tags.tag_id = tags.tag_id WHERE credential_id = $credential_id ORDER BY tag_name ASC");
+                                    $sql_credential_tags = mysqli_query($mysqli, "SELECT tag_color, tag_icon, credential_tags.tag_id, tag_name FROM credential_tags LEFT JOIN tags ON credential_tags.tag_id = tags.tag_id WHERE credential_id = $credential_id ORDER BY tag_name ASC");
                                     while ($row = mysqli_fetch_assoc($sql_credential_tags)) {
 
                                         $credential_tag_id = intval($row['tag_id']);
diff --git a/agent/assets.php b/agent/assets.php
index 32eb370ce..1705d0ade 100644
--- a/agent/assets.php
+++ b/agent/assets.php
@@ -124,7 +124,7 @@ $row = mysqli_fetch_assoc(mysqli_query($mysqli, "
         LEFT JOIN tags ON tag_id = asset_tag_tag_id
         WHERE $archive_query
         $tag_query
-        $access_permission_query
+        " . clientScopeSql('asset_client_id') . "
         $client_query
         GROUP BY asset_id
     ) AS filtered_assets;
@@ -150,7 +150,14 @@ $other_count = intval($row['other_count']);
 
 $sql = mysqli_query(
     $mysqli,
-    "SELECT SQL_CALC_FOUND_ROWS * FROM assets
+    "SELECT SQL_CALC_FOUND_ROWS asset_archived_at, asset_contact_id, asset_created_at, asset_description, asset_favorite,
+        asset_id, asset_install_date, asset_location_id, asset_make, asset_model, asset_name,
+        asset_notes, asset_os, asset_photo, asset_physical_location, asset_purchase_date,
+        asset_purchase_reference, asset_serial, asset_status, asset_type, asset_uri, asset_uri_2,
+        asset_uri_client, asset_vendor_id, asset_warranty_expire, client_id, client_name,
+        contact_archived_at, contact_name, interface_ip, interface_ipv6, interface_mac,
+        interface_nat_ip, interface_network_id, location_archived_at, location_name, tag_color,
+        tag_icon, tag_id, tag_name FROM assets
     LEFT JOIN clients ON asset_client_id = client_id
     LEFT JOIN contacts ON asset_contact_id = contact_id
     LEFT JOIN locations ON asset_location_id = location_id
@@ -161,7 +168,7 @@ $sql = mysqli_query(
     $tag_query
     AND (asset_name LIKE '%$q%' OR asset_description LIKE '%$q%' OR asset_type LIKE '%$q%' OR interface_ip LIKE '%$q%' OR interface_ipv6 LIKE '%$q%' OR interface_mac LIKE '%$q%' OR asset_make LIKE '%$q%' OR asset_model LIKE '%$q%' OR asset_serial LIKE '%$q%' OR asset_os LIKE '%$q%' OR contact_name LIKE '%$q%' OR location_name LIKE '%$q%' OR client_name LIKE '%$q%' OR tag_name LIKE '%$q%')
     AND ($type_query)
-    $access_permission_query
+    " . clientScopeSql('asset_client_id') . "
     $location_query
     $expire_query
     $client_query
@@ -288,7 +295,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                                 FROM clients
                                 JOIN assets ON asset_client_id = client_id
                                 WHERE $archive_query
-                                $access_permission_query
+                                " . clientScopeSql('clients.client_id') . "
                                 ORDER BY client_name ASC
                             ");
                             while ($row = mysqli_fetch_assoc($sql_clients_filter)) {
@@ -634,13 +641,13 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                             $location_name_display = $location_name;
                         }
 
-                        $sql_credentials = mysqli_query($mysqli, "SELECT * FROM credentials WHERE credential_asset_id = $asset_id");
+                        $sql_credentials = mysqli_query($mysqli, "SELECT 1 FROM credentials WHERE credential_asset_id = $asset_id");
                         $credential_count = mysqli_num_rows($sql_credentials);
 
                         // Tags
                         $asset_tag_name_display_array = array();
                         $asset_tag_id_array = array();
-                        $sql_asset_tags = mysqli_query($mysqli, "SELECT * FROM asset_tags LEFT JOIN tags ON asset_tag_tag_id = tag_id WHERE asset_tag_asset_id = $asset_id ORDER BY tag_name ASC");
+                        $sql_asset_tags = mysqli_query($mysqli, "SELECT tag_color, tag_icon, tag_id, tag_name FROM asset_tags LEFT JOIN tags ON asset_tag_tag_id = tag_id WHERE asset_tag_asset_id = $asset_id ORDER BY tag_name ASC");
                         while ($row = mysqli_fetch_assoc($sql_asset_tags)) {
 
                             $asset_tag_id = intval($row['tag_id']);
diff --git a/agent/calendar.php b/agent/calendar.php
index ead5c3b93..09ef36f8f 100644
--- a/agent/calendar.php
+++ b/agent/calendar.php
@@ -38,7 +38,7 @@ if (isset($_GET['calendar_id'])) {
             </div>
             <div class="card-body">
                 <?php
-                $sql = mysqli_query($mysqli, "SELECT * FROM calendars");
+                $sql = mysqli_query($mysqli, "SELECT calendar_color, calendar_feed_key, calendar_id, calendar_name FROM calendars");
                 while ($row = mysqli_fetch_assoc($sql)) {
                     $calendar_id = intval($row['calendar_id']);
                     $calendar_name = escapeHtml($row['calendar_name']);
@@ -135,7 +135,8 @@ if (isset($_GET['calendar_id'])) {
 require_once "modals/calendar/calendar_event_add.php";
 
 //loop through IDs and create a modal for each
-$sql = mysqli_query($mysqli, "SELECT * FROM calendar_events LEFT JOIN calendars ON event_calendar_id = calendar_id $client_event_query");
+$sql = mysqli_query($mysqli, "SELECT calendar_color, calendar_id, calendar_name, event_client_id, event_description, event_end,
+    event_id, event_location, event_repeat, event_start, event_title FROM calendar_events LEFT JOIN calendars ON event_calendar_id = calendar_id $client_event_query");
 while ($row = mysqli_fetch_assoc($sql)) {
     $event_id = intval($row['event_id']);
     $event_title = escapeHtml($row['event_title']);
@@ -303,7 +304,8 @@ while ($row = mysqli_fetch_assoc($sql)) {
         },
         events: [
             <?php
-            $sql = mysqli_query($mysqli, "SELECT * FROM calendar_events LEFT JOIN calendars ON event_calendar_id = calendar_id $client_event_query");
+            $sql = mysqli_query($mysqli, "SELECT calendar_color, calendar_id, calendar_name, event_all_day, event_id, event_repeat,
+                event_title FROM calendar_events LEFT JOIN calendars ON event_calendar_id = calendar_id $client_event_query");
 
             // Repeating events are stored as a single row, so the occurrences have to
             // be materialised here - the bundled FullCalendar build has no rrule
@@ -341,7 +343,7 @@ while ($row = mysqli_fetch_assoc($sql)) {
             }
 
             // Invoices Created
-            $sql = mysqli_query($mysqli, "SELECT * FROM clients LEFT JOIN invoices ON client_id = invoice_client_id $client_query $access_permission_query");
+            $sql = mysqli_query($mysqli, "SELECT invoice_date, invoice_id, invoice_number, invoice_prefix, invoice_scope FROM clients LEFT JOIN invoices ON client_id = invoice_client_id $client_query " . clientScopeSql('clients.client_id') . "");
             while ($row = mysqli_fetch_assoc($sql)) {
                 $event_id = intval($row['invoice_id']);
                 $scope = strval($row['invoice_scope']);
@@ -356,7 +358,7 @@ while ($row = mysqli_fetch_assoc($sql)) {
             }
 
             // Quotes Created
-            $sql = mysqli_query($mysqli, "SELECT * FROM clients LEFT JOIN quotes ON client_id = quote_client_id $client_query $access_permission_query");
+            $sql = mysqli_query($mysqli, "SELECT quote_date, quote_id, quote_number, quote_prefix, quote_scope FROM clients LEFT JOIN quotes ON client_id = quote_client_id $client_query " . clientScopeSql('clients.client_id') . "");
             while ($row = mysqli_fetch_assoc($sql)) {
                 $event_id = intval($row['quote_id']);
                 $event_title = json_encode($row['quote_prefix'] . $row['quote_number'] . " " . $row['quote_scope']);
@@ -366,11 +368,12 @@ while ($row = mysqli_fetch_assoc($sql)) {
             }
 
             // Tickets Created
-            $sql = mysqli_query($mysqli, "SELECT * FROM clients
+            $sql = mysqli_query($mysqli, "SELECT ticket_created_at, ticket_id, ticket_number, ticket_prefix, ticket_status,
+                ticket_status_name, ticket_subject, user_name FROM clients
                 LEFT JOIN tickets ON client_id = ticket_client_id
                 LEFT JOIN ticket_statuses ON ticket_status = ticket_status_id
                 LEFT JOIN users ON ticket_assigned_to = user_id
-                $client_query $access_permission_query"
+                $client_query " . clientScopeSql('clients.client_id') . ""
             );
             while ($row = mysqli_fetch_assoc($sql)) {
                 $event_id = intval($row['ticket_id']);
@@ -401,10 +404,11 @@ while ($row = mysqli_fetch_assoc($sql)) {
             }
 
             // Recurring Tickets
-            $sql = mysqli_query($mysqli, "SELECT * FROM clients
+            $sql = mysqli_query($mysqli, "SELECT client_id, recurring_ticket_frequency, recurring_ticket_id, recurring_ticket_next_run,
+                recurring_ticket_subject, user_name FROM clients
                 LEFT JOIN recurring_tickets ON client_id = recurring_ticket_client_id
                 LEFT JOIN users ON recurring_ticket_assigned_to = user_id
-                $client_query $access_permission_query"
+                $client_query " . clientScopeSql('clients.client_id') . ""
             );
             while ($row = mysqli_fetch_assoc($sql)) {
                 $event_id = intval($row['recurring_ticket_id']);
@@ -425,11 +429,12 @@ while ($row = mysqli_fetch_assoc($sql)) {
             }
 
             // Tickets Scheduled
-            $sql = mysqli_query($mysqli, "SELECT * FROM clients
+            $sql = mysqli_query($mysqli, "SELECT ticket_id, ticket_number, ticket_prefix, ticket_schedule, ticket_status_name,
+                ticket_subject, user_name FROM clients
                 LEFT JOIN tickets ON client_id = ticket_client_id
                 LEFT JOIN ticket_statuses ON ticket_status = ticket_status_id
                 LEFT JOIN users ON ticket_assigned_to = user_id
-                $client_query $access_permission_query AND ticket_schedule IS NOT NULL"
+                $client_query " . clientScopeSql('clients.client_id') . " AND ticket_schedule IS NOT NULL"
             );
             while ($row = mysqli_fetch_assoc($sql)) {
                 $event_id = intval($row['ticket_id']);
@@ -460,7 +465,7 @@ while ($row = mysqli_fetch_assoc($sql)) {
             }
 
             // Vendors Added Created
-            $sql = mysqli_query($mysqli, "SELECT * FROM clients LEFT JOIN vendors ON client_id = vendor_client_id $client_query $access_permission_query");
+            $sql = mysqli_query($mysqli, "SELECT client_id, vendor_created_at, vendor_id, vendor_name FROM clients LEFT JOIN vendors ON client_id = vendor_client_id $client_query " . clientScopeSql('clients.client_id') . "");
             while ($row = mysqli_fetch_assoc($sql)) {
                 $event_id = intval($row['vendor_id']);
                 $client_id = intval($row['client_id']);
@@ -472,7 +477,7 @@ while ($row = mysqli_fetch_assoc($sql)) {
 
             if (!isset($_GET['client_id'])) {
                 //Clients Added
-                $sql = mysqli_query($mysqli, "SELECT * FROM clients");
+                $sql = mysqli_query($mysqli, "SELECT client_created_at, client_id, client_name FROM clients");
                 while ($row = mysqli_fetch_assoc($sql)) {
                     $event_id = intval($row['client_id']);
                     $event_title = json_encode("Client: '" . $row['client_name'] . "' created");
diff --git a/agent/certificates.php b/agent/certificates.php
index 5b1219868..bfdad6a4f 100644
--- a/agent/certificates.php
+++ b/agent/certificates.php
@@ -61,11 +61,13 @@ if (!$client_url) {
     }
 }
 
-$sql = mysqli_query($mysqli, "SELECT SQL_CALC_FOUND_ROWS * FROM certificates
+$sql = mysqli_query($mysqli, "SELECT SQL_CALC_FOUND_ROWS certificate_archived_at, certificate_created_at, certificate_description,
+    certificate_domain, certificate_expire, certificate_id, certificate_issued_by,
+    certificate_name, client_id, client_name FROM certificates
     LEFT JOIN clients ON client_id = certificate_client_id
     WHERE $archive_query
     AND (certificate_name LIKE '%$q%' OR certificate_domain LIKE '%$q%' OR certificate_description LIKE '%$q%' OR certificate_issued_by LIKE '%$q%' OR client_name LIKE '%$q%')
-    $access_permission_query
+    " . clientScopeSql('certificate_client_id') . "
     $client_query
     $expire_query
     ORDER BY $sort $order LIMIT $record_from, $record_to"
@@ -122,7 +124,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                                 FROM clients
                                 JOIN certificates ON certificate_client_id = client_id
                                 WHERE $archive_query
-                                $access_permission_query
+                                " . clientScopeSql('clients.client_id') . "
                                 ORDER BY client_name ASC
                             ");
                             while ($row = mysqli_fetch_assoc($sql_clients_filter)) {
diff --git a/agent/client_overview.php b/agent/client_overview.php
index d2f19be42..f5f60d69d 100644
--- a/agent/client_overview.php
+++ b/agent/client_overview.php
@@ -4,7 +4,7 @@ require_once "includes/inc_all_client.php";
 
 $sql_recent_activities = mysqli_query(
     $mysqli,
-    "SELECT * FROM logs
+    "SELECT log_created_at, log_description FROM logs
     WHERE log_client_id = $client_id
     ORDER BY log_created_at DESC
     LIMIT 5"
@@ -12,7 +12,9 @@ $sql_recent_activities = mysqli_query(
 
 $sql_important_contacts = mysqli_query(
     $mysqli,
-    "SELECT * FROM contacts
+    "SELECT contact_email, contact_extension, contact_id, contact_mobile, contact_mobile_country_code,
+        contact_name, contact_phone, contact_phone_country_code, contact_photo, contact_primary,
+        contact_title FROM contacts
     WHERE contact_client_id = $client_id
         AND (contact_important = 1
             OR contact_billing = 1
@@ -25,7 +27,7 @@ $sql_important_contacts = mysqli_query(
 
 $sql_favorite_assets = mysqli_query(
     $mysqli,
-    "SELECT * FROM assets
+    "SELECT asset_id, asset_make, asset_model, asset_name, asset_type FROM assets
     WHERE asset_client_id = $client_id
         AND asset_favorite = 1
         AND asset_archived_at IS NULL
@@ -34,7 +36,8 @@ $sql_favorite_assets = mysqli_query(
 
 $sql_favorite_credentials = mysqli_query(
     $mysqli,
-    "SELECT * FROM credentials
+    "SELECT credential_description, credential_id, credential_name, credential_otp_secret,
+        credential_uri, credential_uri_2, credential_username FROM credentials
     WHERE credential_client_id = $client_id
         AND credential_favorite = 1
         AND credential_archived_at IS NULL
@@ -60,7 +63,8 @@ $sql_recent_credentials = mysqli_query(
 
 $sql_shared_items = mysqli_query(
     $mysqli,
-    "SELECT * FROM shared_items
+    "SELECT item_active, item_created_at, item_expire_at, item_id, item_key, item_note, item_recipient,
+        item_related_id, item_type, item_view_limit, item_views FROM shared_items
     WHERE item_client_id = $client_id
         AND item_active = 1
     ORDER BY item_created_at ASC
@@ -74,7 +78,7 @@ $sql_shared_items = mysqli_query(
 // Stale Tickets
 $sql_stale_tickets = mysqli_query(
     $mysqli,
-    "SELECT * FROM tickets
+    "SELECT ticket_created_at, ticket_id, ticket_number, ticket_prefix, ticket_subject FROM tickets
     WHERE ticket_client_id = $client_id
         AND ticket_updated_at < CURRENT_DATE - INTERVAL 7 DAY
         AND ticket_resolved_At IS NULL
@@ -87,7 +91,7 @@ $sql_stale_tickets = mysqli_query(
 // Get Domains Expiring
 $sql_domains_expiring = mysqli_query(
     $mysqli,
-    "SELECT * FROM domains
+    "SELECT domain_expire, domain_id, domain_name FROM domains
     WHERE domain_client_id = $client_id
         AND domain_expire IS NOT NULL
         AND domain_archived_at IS NULL
@@ -99,7 +103,7 @@ $sql_domains_expiring = mysqli_query(
 // Get Certificates Expiring
 $sql_certificates_expiring = mysqli_query(
     $mysqli,
-    "SELECT * FROM certificates
+    "SELECT certificate_expire, certificate_id, certificate_name FROM certificates
     WHERE certificate_client_id = $client_id
         AND certificate_expire IS NOT NULL
         AND certificate_archived_at IS NULL
@@ -111,7 +115,7 @@ $sql_certificates_expiring = mysqli_query(
 // Get Licenses Expiring
 $sql_licenses_expiring = mysqli_query(
     $mysqli,
-    "SELECT * FROM software
+    "SELECT software_expire, software_id, software_name FROM software
     WHERE software_client_id = $client_id
         AND software_expire IS NOT NULL
         AND software_archived_at IS NULL
@@ -123,7 +127,7 @@ $sql_licenses_expiring = mysqli_query(
 // Get Asset Warranties Expiring
 $sql_asset_warranties_expiring = mysqli_query(
     $mysqli,
-    "SELECT * FROM assets
+    "SELECT asset_id, asset_name, asset_warranty_expire FROM assets
     WHERE asset_client_id = $client_id
         AND asset_warranty_expire IS NOT NULL
         AND asset_archived_at IS NULL
@@ -135,7 +139,7 @@ $sql_asset_warranties_expiring = mysqli_query(
 // Get Assets Retiring 7 Year
 $sql_asset_retire = mysqli_query(
     $mysqli,
-    "SELECT * FROM assets
+    "SELECT asset_id, asset_install_date, asset_name FROM assets
     WHERE asset_client_id = $client_id
         AND asset_install_date IS NOT NULL
         AND asset_archived_at IS NULL
@@ -151,7 +155,7 @@ $sql_asset_retire = mysqli_query(
 // Get Domains Expired
 $sql_domains_expired = mysqli_query(
     $mysqli,
-    "SELECT * FROM domains
+    "SELECT domain_expire, domain_id, domain_name FROM domains
     WHERE domain_client_id = $client_id
         AND domain_expire IS NOT NULL
         AND domain_archived_at IS NULL
@@ -162,7 +166,7 @@ $sql_domains_expired = mysqli_query(
 // Get Certificates Expired
 $sql_certificates_expired = mysqli_query(
     $mysqli,
-    "SELECT * FROM certificates
+    "SELECT certificate_expire, certificate_id, certificate_name FROM certificates
     WHERE certificate_client_id = $client_id
         AND certificate_expire IS NOT NULL
         AND certificate_archived_at IS NULL
@@ -173,7 +177,7 @@ $sql_certificates_expired = mysqli_query(
 // Get Licenses Expired
 $sql_licenses_expired = mysqli_query(
     $mysqli,
-    "SELECT * FROM software
+    "SELECT software_expire, software_id, software_name FROM software
     WHERE software_client_id = $client_id
         AND software_expire IS NOT NULL
         AND software_archived_at IS NULL
@@ -184,7 +188,7 @@ $sql_licenses_expired = mysqli_query(
 // Get Asset Warranties Expired
 $sql_asset_warranties_expired = mysqli_query(
     $mysqli,
-    "SELECT * FROM assets
+    "SELECT asset_id, asset_name, asset_warranty_expire FROM assets
     WHERE asset_client_id = $client_id
         AND asset_warranty_expire IS NOT NULL
         AND asset_archived_at IS NULL
@@ -195,7 +199,7 @@ $sql_asset_warranties_expired = mysqli_query(
 // Get Retired Assets
 $sql_asset_retired = mysqli_query(
     $mysqli,
-    "SELECT * FROM assets
+    "SELECT asset_id, asset_install_date, asset_name FROM assets
     WHERE asset_client_id = $client_id
         AND asset_install_date IS NOT NULL
         AND asset_archived_at IS NULL
diff --git a/agent/clients.php b/agent/clients.php
index 9c621dd79..5ef922a13 100644
--- a/agent/clients.php
+++ b/agent/clients.php
@@ -67,7 +67,7 @@ $sql = mysqli_query(
       AND client_$archive_query
       AND DATE(client_created_at) BETWEEN '$dtf' AND '$dtt'
       $leads_query
-      $access_permission_query
+      " . clientScopeSql('clients.client_id') . "
       $tag_query
       $industry_query
       $referral_query
@@ -369,7 +369,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                     // Client Tags
                     $client_tag_name_display_array = array();
                     $client_tag_id_array = array();
-                    $sql_client_tags = mysqli_query($mysqli, "SELECT * FROM client_tags LEFT JOIN tags ON client_tags.tag_id = tags.tag_id WHERE client_id = $client_id ORDER BY tag_name ASC");
+                    $sql_client_tags = mysqli_query($mysqli, "SELECT tag_color, tag_icon, client_tags.tag_id, tag_name FROM client_tags LEFT JOIN tags ON client_tags.tag_id = tags.tag_id WHERE client_id = $client_id ORDER BY tag_name ASC");
                     while ($row = mysqli_fetch_assoc($sql_client_tags)) {
                         $client_tag_id = intval($row['tag_id']);
                         $client_tag_name = escapeHtml($row['tag_name']);
diff --git a/agent/contact.php b/agent/contact.php
index 196dcdc5e..fc7aca669 100644
--- a/agent/contact.php
+++ b/agent/contact.php
@@ -14,7 +14,11 @@ if (isset($_GET['client_id'])) {
 if (isset($_GET['contact_id'])) {
     $contact_id = intval($_GET['contact_id']);
 
-    $sql = mysqli_query($mysqli, "SELECT * FROM contacts
+    $sql = mysqli_query($mysqli, "SELECT client_id, client_name, contact_billing, contact_client_id, contact_created_at,
+        contact_department, contact_email, contact_extension, contact_important,
+        contact_location_id, contact_mobile, contact_mobile_country_code, contact_name,
+        contact_notes, contact_phone, contact_phone_country_code, contact_photo, contact_pin,
+        contact_primary, contact_technical, contact_title, location_name, user_auth_method FROM contacts
         LEFT JOIN clients ON client_id = contact_client_id
         LEFT JOIN locations ON location_id = contact_location_id
         LEFT JOIN users ON user_id = contact_user_id
@@ -64,7 +68,11 @@ if (isset($_GET['contact_id'])) {
     }
 
     // Related Assets Query - 1 to 1 relationship
-    $sql_related_assets = mysqli_query($mysqli, "SELECT * FROM assets
+    $sql_related_assets = mysqli_query($mysqli, "SELECT asset_created_at, asset_description, asset_favorite, asset_id, asset_install_date,
+        asset_make, asset_model, asset_name, asset_notes, asset_os, asset_photo,
+        asset_physical_location, asset_purchase_date, asset_serial, asset_status, asset_type,
+        asset_uri, asset_uri_2, asset_warranty_expire, interface_ip, interface_ipv6, interface_mac,
+        interface_nat_ip, tag_color, tag_icon, tag_id, tag_name FROM assets
         LEFT JOIN asset_interfaces ON interface_asset_id = asset_id AND interface_primary = 1
         LEFT JOIN asset_tags ON asset_tag_asset_id = asset_id
         LEFT JOIN tags ON tag_id = asset_tag_tag_id
@@ -75,7 +83,9 @@ if (isset($_GET['contact_id'])) {
     $asset_count = mysqli_num_rows($sql_related_assets);
 
     // Linked Software Licenses
-    $sql_linked_software = mysqli_query($mysqli, "SELECT * FROM software_contacts, software
+    $sql_linked_software = mysqli_query($mysqli, "SELECT software_expire, software_contacts.software_id, software_key, software_license_type,
+        software_name, software_notes, software_purchase, software_seats, software_type,
+        software_version FROM software_contacts, software
         WHERE software_contacts.contact_id = $contact_id
         AND software_contacts.software_id = software.software_id
         AND software_archived_at IS NULL
@@ -102,14 +112,17 @@ if (isset($_GET['contact_id'])) {
     $credential_count = mysqli_num_rows($sql_related_credentials);
 
     // Related Tickets Query - 1 to 1 relationship
-    $sql_related_tickets = mysqli_query($mysqli, "SELECT * FROM tickets
+    $sql_related_tickets = mysqli_query($mysqli, "SELECT ticket_assigned_to, ticket_closed_at, ticket_created_at, ticket_id, ticket_number,
+        ticket_prefix, ticket_priority, ticket_status, ticket_status_color, ticket_status_name,
+        ticket_subject, ticket_updated_at, user_name FROM tickets
         LEFT JOIN users ON ticket_assigned_to = user_id
         LEFT JOIN ticket_statuses ON ticket_status = ticket_status_id
         WHERE ticket_contact_id = $contact_id ORDER BY ticket_id DESC");
     $ticket_count = mysqli_num_rows($sql_related_tickets);
 
     // Related Recurring Tickets Query
-    $sql_related_recurring_tickets = mysqli_query($mysqli, "SELECT * FROM recurring_tickets
+    $sql_related_recurring_tickets = mysqli_query($mysqli, "SELECT recurring_ticket_frequency, recurring_ticket_id, recurring_ticket_next_run,
+        recurring_ticket_priority, recurring_ticket_subject FROM recurring_tickets
         WHERE recurring_ticket_contact_id = $contact_id
         ORDER BY recurring_ticket_next_run DESC"
     );
@@ -119,7 +132,7 @@ if (isset($_GET['contact_id'])) {
     // Tags - many to many relationship
     $contact_tag_name_display_array = array();
     $contact_tag_id_array = array();
-    $sql_contact_tags = mysqli_query($mysqli, "SELECT * FROM contact_tags LEFT JOIN tags ON contact_tags.tag_id = tags.tag_id WHERE contact_id = $contact_id ORDER BY tag_name ASC");
+    $sql_contact_tags = mysqli_query($mysqli, "SELECT tag_color, tag_icon, contact_tags.tag_id, tag_name FROM contact_tags LEFT JOIN tags ON contact_tags.tag_id = tags.tag_id WHERE contact_id = $contact_id ORDER BY tag_name ASC");
     while ($row = mysqli_fetch_assoc($sql_contact_tags)) {
 
         $contact_tag_id = intval($row['tag_id']);
@@ -139,7 +152,7 @@ if (isset($_GET['contact_id'])) {
     $contact_tags_display = implode('', $contact_tag_name_display_array);
 
     // Notes - 1 to 1 relationship
-    $sql_related_notes = mysqli_query($mysqli, "SELECT * FROM contact_notes LEFT JOIN users ON contact_note_created_by = user_id WHERE contact_note_contact_id = $contact_id AND contact_note_archived_at IS NULL ORDER BY contact_note_created_at DESC");
+    $sql_related_notes = mysqli_query($mysqli, "SELECT contact_note, contact_note_created_at, contact_note_id, contact_note_type, user_name FROM contact_notes LEFT JOIN users ON contact_note_created_by = user_id WHERE contact_note_contact_id = $contact_id AND contact_note_archived_at IS NULL ORDER BY contact_note_created_at DESC");
     $note_count = mysqli_num_rows($sql_related_notes);
 
     // Note type icons, read from the categories list so the seeded icons
@@ -151,7 +164,8 @@ if (isset($_GET['contact_id'])) {
     }
 
      // Linked Services
-    $sql_linked_services = mysqli_query($mysqli, "SELECT * FROM service_contacts, services
+    $sql_linked_services = mysqli_query($mysqli, "SELECT service_category, service_description, service_contacts.service_id, service_importance,
+        service_name FROM service_contacts, services
         WHERE service_contacts.contact_id = $contact_id
         AND service_contacts.service_id = services.service_id
         ORDER BY service_name ASC"
@@ -161,7 +175,8 @@ if (isset($_GET['contact_id'])) {
     $linked_services = array();
 
     // Linked Documents
-    $sql_linked_documents = mysqli_query($mysqli, "SELECT * FROM contact_documents, documents
+    $sql_linked_documents = mysqli_query($mysqli, "SELECT document_created_at, document_description, documents.document_id, document_name,
+        document_updated_at, user_name FROM contact_documents, documents
         LEFT JOIN users ON document_created_by = user_id
         WHERE contact_documents.contact_id = $contact_id
         AND contact_documents.document_id = documents.document_id
@@ -173,7 +188,7 @@ if (isset($_GET['contact_id'])) {
     $linked_documents = array();
 
     // Linked Files
-    $sql_linked_files = mysqli_query($mysqli, "SELECT * FROM contact_files, files
+    $sql_linked_files = mysqli_query($mysqli, "SELECT file_created_at, file_description, files.file_id, file_mime_type, file_name, file_size FROM contact_files, files
         WHERE contact_files.contact_id = $contact_id
         AND contact_files.file_id = files.file_id
         AND file_archived_at IS NULL
@@ -420,7 +435,7 @@ if (isset($_GET['contact_id'])) {
                                 // Tags
                                 $asset_tag_name_display_array = array();
                                 $asset_tag_id_array = array();
-                                $sql_asset_tags = mysqli_query($mysqli, "SELECT * FROM asset_tags LEFT JOIN tags ON asset_tag_tag_id = tag_id WHERE asset_tag_asset_id = $asset_id ORDER BY tag_name ASC");
+                                $sql_asset_tags = mysqli_query($mysqli, "SELECT tag_color, tag_icon, tag_id, tag_name FROM asset_tags LEFT JOIN tags ON asset_tag_tag_id = tag_id WHERE asset_tag_asset_id = $asset_id ORDER BY tag_name ASC");
                                 while ($row = mysqli_fetch_assoc($sql_asset_tags)) {
 
                                     $asset_tag_id = intval($row['tag_id']);
@@ -574,7 +589,7 @@ if (isset($_GET['contact_id'])) {
                                 // Tags
                                 $credential_tag_name_display_array = array();
                                 $credential_tag_id_array = array();
-                                $sql_credential_tags = mysqli_query($mysqli, "SELECT * FROM credential_tags LEFT JOIN tags ON credential_tags.tag_id = tags.tag_id WHERE credential_id = $credential_id ORDER BY tag_name ASC");
+                                $sql_credential_tags = mysqli_query($mysqli, "SELECT tag_color, tag_icon, credential_tags.tag_id, tag_name FROM credential_tags LEFT JOIN tags ON credential_tags.tag_id = tags.tag_id WHERE credential_id = $credential_id ORDER BY tag_name ASC");
                                 while ($row = mysqli_fetch_assoc($sql_credential_tags)) {
 
                                     $credential_tag_id = intval($row['tag_id']);
diff --git a/agent/contacts.php b/agent/contacts.php
index e716fcf84..1bbb1ee59 100644
--- a/agent/contacts.php
+++ b/agent/contacts.php
@@ -74,7 +74,7 @@ $sql = mysqli_query($mysqli, "SELECT SQL_CALC_FOUND_ROWS contacts.*, clients.*,
     WHERE $archive_query
     $tag_query
     AND (contact_name LIKE '%$q%' OR contact_title LIKE '%$q%' OR location_name LIKE '%$q%'  OR contact_email LIKE '%$q%' OR contact_department LIKE '%$q%' OR contact_phone LIKE '%$phone_query%' OR contact_extension LIKE '%$q%' OR contact_mobile LIKE '%$phone_query%' OR tag_name LIKE '%$q%' OR client_name LIKE '%$q%')
-    $access_permission_query
+    " . clientScopeSql('contact_client_id') . "
     $client_query
     $location_query
     GROUP BY contact_id
@@ -193,7 +193,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                                 FROM clients
                                 JOIN contacts ON contact_client_id = client_id
                                 WHERE $archive_query
-                                $access_permission_query
+                                " . clientScopeSql('clients.client_id') . "
                                 ORDER BY client_name ASC
                             ");
                             while ($row = mysqli_fetch_assoc($sql_clients_filter)) {
@@ -444,7 +444,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                         // Tags
                         $contact_tag_name_display_array = array();
                         $contact_tag_id_array = array();
-                        $sql_contact_tags = mysqli_query($mysqli, "SELECT * FROM contact_tags LEFT JOIN tags ON contact_tags.tag_id = tags.tag_id WHERE contact_id = $contact_id ORDER BY tag_name ASC");
+                        $sql_contact_tags = mysqli_query($mysqli, "SELECT tag_color, tag_icon, contact_tags.tag_id, tag_name FROM contact_tags LEFT JOIN tags ON contact_tags.tag_id = tags.tag_id WHERE contact_id = $contact_id ORDER BY tag_name ASC");
                         while ($row = mysqli_fetch_assoc($sql_contact_tags)) {
 
                             $contact_tag_id = intval($row['tag_id']);
diff --git a/agent/credentials.php b/agent/credentials.php
index cd59b4a67..76548e8ac 100644
--- a/agent/credentials.php
+++ b/agent/credentials.php
@@ -90,7 +90,7 @@ $sql = mysqli_query(
     $tag_query
     AND (c.credential_name LIKE '%$q%' OR c.credential_description LIKE '%$q%' OR c.credential_uri LIKE '%$q%' OR tag_name LIKE '%$q%' OR client_name LIKE '%$q%')
     $location_query
-    $access_permission_query
+    " . clientScopeSql('credential_client_id') . "
     $client_query
     GROUP BY c.credential_id
     ORDER BY c.credential_favorite DESC, $sort $order LIMIT $record_from, $record_to"
@@ -179,7 +179,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                             <option value="">- All Asset Locations -</option>
 
                             <?php
-                            $sql_locations_filter = mysqli_query($mysqli, "SELECT * FROM locations WHERE location_client_id = $client_id AND location_archived_at IS NULL ORDER BY location_name ASC");
+                            $sql_locations_filter = mysqli_query($mysqli, "SELECT location_id, location_name FROM locations WHERE location_client_id = $client_id AND location_archived_at IS NULL ORDER BY location_name ASC");
                             while ($row = mysqli_fetch_assoc($sql_locations_filter)) {
                                 $location_id = intval($row['location_id']);
                                 $location_name = escapeHtml($row['location_name']);
@@ -204,7 +204,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                                 FROM clients
                                 JOIN credentials ON credential_client_id = client_id
                                 WHERE $archive_query
-                                $access_permission_query
+                                " . clientScopeSql('clients.client_id') . "
                                 ORDER BY client_name ASC
                             ");
                             while ($row = mysqli_fetch_assoc($sql_clients_filter)) {
@@ -349,7 +349,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                             // Tags
                             $credential_tag_name_display_array = array();
                             $credential_tag_id_array = array();
-                            $sql_credential_tags = mysqli_query($mysqli, "SELECT * FROM credential_tags LEFT JOIN tags ON credential_tags.tag_id = tags.tag_id WHERE credential_id = $credential_id ORDER BY tag_name ASC");
+                            $sql_credential_tags = mysqli_query($mysqli, "SELECT tag_color, tag_icon, credential_tags.tag_id, tag_name FROM credential_tags LEFT JOIN tags ON credential_tags.tag_id = tags.tag_id WHERE credential_id = $credential_id ORDER BY tag_name ASC");
                             while ($row = mysqli_fetch_assoc($sql_credential_tags)) {
 
                                 $credential_tag_id = intval($row['tag_id']);
@@ -389,7 +389,8 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                             // Check if shared
                             $sql_shared = mysqli_query(
                                 $mysqli,
-                                "SELECT * FROM shared_items
+                                "SELECT item_active, item_created_at, item_expire_at, item_id, item_key, item_note, item_recipient,
+                                    item_related_id, item_type, item_view_limit, item_views FROM shared_items
                                 WHERE item_client_id = $client_id
                                 AND item_active = 1
                                 AND (COALESCE(item_view_limit, 0) = 0 OR item_views < item_view_limit)
diff --git a/agent/dashboard.php b/agent/dashboard.php
index ff237de93..61f336696 100644
--- a/agent/dashboard.php
+++ b/agent/dashboard.php
@@ -16,7 +16,7 @@ if (isset($_GET['enable_technical'])) {
 }
 
 // Fetch User Dashboard Settings
-$sql_user_dashboard_settings = mysqli_query($mysqli, "SELECT * FROM user_settings WHERE user_id = $session_user_id");
+$sql_user_dashboard_settings = mysqli_query($mysqli, "SELECT user_config_dashboard_financial_enable, user_config_dashboard_technical_enable FROM user_settings WHERE user_id = $session_user_id");
 $row = mysqli_fetch_assoc($sql_user_dashboard_settings);
 $user_config_dashboard_financial_enable = intval($row['user_config_dashboard_financial_enable']);
 $user_config_dashboard_technical_enable = intval($row['user_config_dashboard_technical_enable']);
@@ -117,17 +117,17 @@ if ($user_config_dashboard_financial_enable == 1) {
 
     $profit = $total_income - $total_expenses;
 
-    $sql_accounts = mysqli_query($mysqli, "SELECT * FROM accounts WHERE account_archived_at IS NULL ORDER BY account_name ASC");
+    $sql_accounts = mysqli_query($mysqli, "SELECT account_id, account_name, opening_balance FROM accounts WHERE account_archived_at IS NULL ORDER BY account_name ASC");
 
     $sql_latest_invoice_payments = mysqli_query($mysqli, "
-        SELECT * FROM payments
+        SELECT client_name, invoice_number, invoice_prefix, payment_amount, payment_date FROM payments
         JOIN invoices ON payment_invoice_id = invoice_id
         JOIN clients ON invoice_client_id = client_id
         ORDER BY payment_id DESC LIMIT 5
     ");
 
     $sql_latest_expenses = mysqli_query($mysqli, "
-        SELECT * FROM expenses
+        SELECT category_name, expense_amount, expense_date, vendor_name FROM expenses
         JOIN vendors ON expense_vendor_id = vendor_id
         JOIN categories ON expense_category_id = category_id
         ORDER BY expense_id DESC LIMIT 5
@@ -599,7 +599,9 @@ if ($user_config_dashboard_technical_enable == 1) {
     $expiring_asset_warranties = $sql_asset_warranty_expiring['expiring_asset_warranties'];
 
     $sql_your_tickets = mysqli_query($mysqli, "
-        SELECT * FROM tickets
+        SELECT client_name, contact_name, ticket_client_id, ticket_contact_id, ticket_created_at,
+            ticket_id, ticket_number, ticket_prefix, ticket_priority, ticket_status,
+            ticket_status_color, ticket_status_name, ticket_subject, ticket_updated_at FROM tickets
         LEFT JOIN ticket_statuses ON ticket_status = ticket_status_id
         LEFT JOIN clients ON ticket_client_id = client_id
         LEFT JOIN contacts ON ticket_contact_id = contact_id
diff --git a/agent/document.php b/agent/document.php
index 6eeec7c95..00f7e8fc5 100644
--- a/agent/document.php
+++ b/agent/document.php
@@ -17,7 +17,9 @@ if (isset($_GET['document_id'])) {
 
 $folder_location = 0;
 
-$sql_document = mysqli_query($mysqli, "SELECT * FROM documents
+$sql_document = mysqli_query($mysqli, "SELECT document_archived_at, document_client_visible, document_content, document_created_at,
+    document_created_by, document_description, document_folder_id, document_name,
+    document_updated_at, folder_name, user_name FROM documents
     LEFT JOIN folders ON document_folder_id = folder_id
     LEFT JOIN users ON document_created_by = user_id
     WHERE document_client_id = $client_id AND document_id = $document_id
@@ -142,7 +144,8 @@ $page_title = $row['document_name'];
                     </thead>
                     <tbody>
                         <?php
-                        $sql_document_versions = mysqli_query($mysqli, "SELECT * FROM document_versions
+                        $sql_document_versions = mysqli_query($mysqli, "SELECT document_version_created_at, document_version_description, document_version_id,
+                            document_version_name, user_name FROM document_versions
                             LEFT JOIN users ON document_version_created_by = user_id
                             WHERE document_version_document_id = $document_id
                             ORDER BY document_version_created_at ASC"
@@ -208,7 +211,7 @@ $page_title = $row['document_name'];
                 </button>
             </h6>
             <?php
-            $sql_files = mysqli_query($mysqli, "SELECT * FROM files, document_files
+            $sql_files = mysqli_query($mysqli, "SELECT file_folder_id, files.file_id, file_name FROM files, document_files
                 WHERE document_files.file_id = files.file_id
                 AND document_files.document_id = $document_id
                 ORDER BY file_name ASC"
@@ -394,7 +397,8 @@ $page_title = $row['document_name'];
             <h6><i class="fas fa-history mr-2"></i>Revisions</h6>
             <?php
 
-            $sql_document_versions = mysqli_query($mysqli, "SELECT * FROM document_versions
+            $sql_document_versions = mysqli_query($mysqli, "SELECT document_version_created_at, document_version_description, document_version_id,
+                document_version_name, user_name FROM document_versions
                 LEFT JOIN users ON document_version_created_by = user_id
                 WHERE document_version_document_id = $document_id
                 ORDER BY document_version_created_at DESC"
diff --git a/agent/domains.php b/agent/domains.php
index 3ab3d3bce..a04b4df13 100644
--- a/agent/domains.php
+++ b/agent/domains.php
@@ -78,7 +78,7 @@ $sql = mysqli_query($mysqli, "SELECT SQL_CALC_FOUND_ROWS domains.*, clients.*,
     LEFT JOIN vendors AS webhost ON domains.domain_webhost = webhost.vendor_id
     WHERE (domains.domain_name LIKE '%$q%' OR domains.domain_description LIKE '%$q%' OR registrar.vendor_name LIKE '%$q%' OR dnshost.vendor_name LIKE '%$q%' OR mailhost.vendor_name LIKE '%$q%' OR webhost.vendor_name LIKE '%$q%' OR client_name LIKE '%$q%')
     AND $archive_query
-    $access_permission_query
+    " . clientScopeSql('domain_client_id') . "
     $client_query
     $expire_query
     ORDER BY $sort $order LIMIT $record_from, $record_to");
@@ -134,7 +134,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                                 FROM clients
                                 JOIN domains ON domain_client_id = client_id
                                 WHERE $archive_query
-                                $access_permission_query
+                                " . clientScopeSql('clients.client_id') . "
                                 ORDER BY client_name ASC
                             ");
                             while ($row = mysqli_fetch_assoc($sql_clients_filter)) {
diff --git a/agent/expenses.php b/agent/expenses.php
index beb8bbac6..9daba75a2 100644
--- a/agent/expenses.php
+++ b/agent/expenses.php
@@ -41,7 +41,10 @@ if (isset($_GET['category']) & !empty($_GET['category'])) {
 
 $sql = mysqli_query(
     $mysqli,
-    "SELECT SQL_CALC_FOUND_ROWS * FROM expenses
+    "SELECT SQL_CALC_FOUND_ROWS account_name, category_name, client_name, expense_account_id, expense_amount,
+        expense_category_id, expense_client_id, expense_created_at, expense_currency_code,
+        expense_date, expense_description, expense_id, expense_receipt, expense_reference,
+        expense_vendor_id, vendor_name FROM expenses
     LEFT JOIN categories ON expense_category_id = category_id
     LEFT JOIN vendors ON expense_vendor_id = vendor_id
     LEFT JOIN accounts ON expense_account_id = account_id
@@ -52,7 +55,7 @@ $sql = mysqli_query(
     $category_query
     AND (vendor_name LIKE '%$q%' OR client_name LIKE '%$q%' OR category_name LIKE '%$q%' OR account_name LIKE '%$q%' OR expense_description LIKE '%$q%' OR expense_amount LIKE '%$q%')
     $account_query
-    $access_permission_query
+    " . clientScopeSql('expense_client_id') . "
     ORDER BY $sort $order LIMIT $record_from, $record_to"
 );
 
diff --git a/agent/files.php b/agent/files.php
index 61e8af7ff..ce798557c 100644
--- a/agent/files.php
+++ b/agent/files.php
@@ -99,7 +99,7 @@ function displayFolders($parent_folder_id, $client_id, $indent = 0, $render_root
 
     $sql_folders = mysqli_query(
         $mysqli,
-        "SELECT * FROM folders
+        "SELECT folder_id, folder_name FROM folders
          WHERE parent_folder = $parent_folder_id
          AND folder_client_id = $client_id
          ORDER BY folder_name ASC"
@@ -731,7 +731,7 @@ $num_root_items = intval($row_root_files['num']) + intval($row_root_docs['num'])
                                         // Shared?
                                         $sql_shared = mysqli_query(
                                             $mysqli,
-                                            "SELECT * FROM shared_items
+                                            "SELECT item_expire_at, item_recipient FROM shared_items
                                              WHERE item_client_id = $client_id
                                              AND item_active = 1
                                              AND (COALESCE(item_view_limit, 0) = 0 OR item_views < item_view_limit)
@@ -843,7 +843,7 @@ $num_root_items = intval($row_root_files['num']) + intval($row_root_docs['num'])
 
                                         $sql_shared = mysqli_query(
                                             $mysqli,
-                                            "SELECT * FROM shared_items
+                                            "SELECT item_expire_at, item_recipient FROM shared_items
                                              WHERE item_client_id = $client_id
                                              AND item_active = 1
                                              AND (COALESCE(item_view_limit, 0) = 0 OR item_views < item_view_limit)
diff --git a/agent/global_search.php b/agent/global_search.php
index a82c776a6..bcda2362a 100644
--- a/agent/global_search.php
+++ b/agent/global_search.php
@@ -28,15 +28,19 @@ if (isset($_GET['query'])) {
     $can_sales      = lookupUserPermission('module_sales')      >= 1;
     $can_credential = lookupUserPermission('module_credential') >= 1;
 
-    $sql_clients = !$can_client ? false : mysqli_query($mysqli, "SELECT * FROM clients
+    $sql_clients = !$can_client ? false : mysqli_query($mysqli, "SELECT client_id, client_name, client_website, location_phone, location_phone_country_code
+        FROM clients
         LEFT JOIN locations ON clients.client_id = locations.location_client_id AND location_primary = 1
         WHERE client_archived_at IS NULL
             AND (client_name LIKE '%$query%' OR client_abbreviation LIKE '%$query%')
-            $access_permission_query
+            " . clientScopeSql('clients.client_id') . "
         ORDER BY client_id DESC LIMIT 5"
     );
 
-    $sql_contacts = !$can_client ? false : mysqli_query($mysqli, "SELECT * FROM contacts
+    $sql_contacts = !$can_client ? false : mysqli_query($mysqli, "SELECT client_id, client_name, contact_department, contact_email, contact_extension, contact_id,
+        contact_mobile, contact_mobile_country_code, contact_name, contact_phone,
+        contact_phone_country_code, contact_title
+        FROM contacts
         LEFT JOIN clients ON client_id = contact_client_id
         WHERE contact_archived_at IS NULL
             AND (contact_name LIKE '%$query%'
@@ -44,51 +48,59 @@ if (isset($_GET['query'])) {
             OR contact_email LIKE '%$query%'
             OR contact_phone LIKE '%$phone_query%'
             OR contact_mobile LIKE '%$phone_query%')
-            $access_permission_query
+            " . clientScopeSql('contact_client_id') . "
         ORDER BY contact_id DESC LIMIT 5"
     );
 
-    $sql_vendors = !$can_client ? false : mysqli_query($mysqli, "SELECT * FROM vendors
+    $sql_vendors = !$can_client ? false : mysqli_query($mysqli, "SELECT client_id, client_name, vendor_description, vendor_name, vendor_phone,
+        vendor_phone_country_code
+        FROM vendors
         LEFT JOIN clients ON vendor_client_id = client_id
         WHERE vendor_archived_at IS NULL
             AND (vendor_name LIKE '%$query%' OR vendor_phone LIKE '%$phone_query%')
-            $access_permission_query
+            " . clientScopeSql('vendor_client_id') . "
         ORDER BY vendor_id DESC LIMIT 5"
     );
 
-    $sql_domains = !$can_support ? false : mysqli_query($mysqli, "SELECT * FROM domains
+    $sql_domains = !$can_support ? false : mysqli_query($mysqli, "SELECT client_id, client_name, domain_expire, domain_id, domain_name
+        FROM domains
         LEFT JOIN clients ON domain_client_id = client_id
         WHERE domain_archived_at IS NULL
             AND domain_name LIKE '%$query%'
-            $access_permission_query
+            " . clientScopeSql('domain_client_id') . "
         ORDER BY domain_id DESC LIMIT 5"
     );
 
-    $sql_products = !$can_sales ? false : mysqli_query($mysqli, "SELECT * FROM products
+    $sql_products = !$can_sales ? false : mysqli_query($mysqli, "SELECT product_description, product_name
+        FROM products
         WHERE product_archived_at IS NULL
             AND product_name LIKE '%$query%'
         ORDER BY product_id DESC LIMIT 5"
     );
 
-    $sql_documents = !$can_support ? false : mysqli_query($mysqli, "SELECT * FROM documents
+    $sql_documents = !$can_support ? false : mysqli_query($mysqli, "SELECT client_name, document_client_id, document_id, document_name
+        FROM documents
         LEFT JOIN clients on document_client_id = clients.client_id
         WHERE document_archived_at IS NULL
             AND MATCH(document_content_raw) AGAINST ('$query')
-            $access_permission_query
+            " . clientScopeSql('document_client_id') . "
         ORDER BY document_id DESC LIMIT 5"
     );
 
-    $sql_files = !$can_support ? false : mysqli_query($mysqli, "SELECT * FROM files
+    $sql_files = !$can_support ? false : mysqli_query($mysqli, "SELECT client_name, file_client_id, file_description, file_id, file_name, folder_id, folder_name
+        FROM files
         LEFT JOIN clients ON file_client_id = client_id
         LEFT JOIN folders ON folder_id = file_folder_id
         WHERE file_archived_at IS NULL
             AND (file_name LIKE '%$query%'
             OR file_description LIKE '%$query%')
-            $access_permission_query
+            " . clientScopeSql('file_client_id') . "
         ORDER BY file_id DESC LIMIT 5"
     );
 
-    $sql_tickets = !$can_support ? false : mysqli_query($mysqli, "SELECT * FROM tickets
+    $sql_tickets = !$can_support ? false : mysqli_query($mysqli, "SELECT client_name, ticket_client_id, ticket_id, ticket_number, ticket_prefix, ticket_status_name,
+        ticket_subject
+        FROM tickets
         LEFT JOIN clients on tickets.ticket_client_id = clients.client_id
         LEFT JOIN ticket_statuses ON ticket_status = ticket_status_id
         WHERE ticket_archived_at IS NULL
@@ -96,62 +108,75 @@ if (isset($_GET['query'])) {
             OR ticket_details LIKE '%$query%'
             OR CONCAT(ticket_prefix,ticket_number) LIKE '%$query%'
             OR ticket_number = '$ticket_num_query')
-            $access_permission_query
+            " . clientScopeSql('tickets.ticket_client_id') . "
         ORDER BY ticket_id DESC LIMIT 5"
     );
 
-    $sql_recurring_tickets = !$can_support ? false : mysqli_query($mysqli, "SELECT * FROM recurring_tickets
+    $sql_recurring_tickets = !$can_support ? false : mysqli_query($mysqli, "SELECT client_id, client_name, recurring_ticket_frequency, recurring_ticket_id,
+        recurring_ticket_next_run, recurring_ticket_subject
+        FROM recurring_tickets
         LEFT JOIN clients ON recurring_ticket_client_id = client_id
         WHERE (recurring_ticket_subject LIKE '%$query%'
             OR recurring_ticket_details LIKE '%$query%')
-            $access_permission_query
+            " . clientScopeSql('recurring_ticket_client_id') . "
         ORDER BY recurring_ticket_id DESC LIMIT 5"
     );
 
-    $sql_credentials = !$can_credential ? false : mysqli_query($mysqli, "SELECT * FROM credentials
+    $sql_credentials = !$can_credential ? false : mysqli_query($mysqli, "SELECT client_id, client_name, credential_client_id, credential_description, credential_name,
+        credential_password, credential_username
+        FROM credentials
         LEFT JOIN contacts ON credential_contact_id = contact_id
         LEFT JOIN clients ON credential_client_id = client_id
         WHERE credential_archived_at IS NULL
             AND (credential_name LIKE '%$query%' OR credential_description LIKE '%$query%')
-            $access_permission_query
+            " . clientScopeSql('credential_client_id') . "
         ORDER BY credential_id DESC LIMIT 5"
     );
 
-    $sql_quotes = !$can_sales ? false : mysqli_query($mysqli, "SELECT * FROM quotes
+    $sql_quotes = !$can_sales ? false : mysqli_query($mysqli, "SELECT client_id, client_name, quote_amount, quote_currency_code, quote_id, quote_number,
+        quote_prefix, quote_status
+        FROM quotes
         LEFT JOIN clients ON quote_client_id = client_id
         LEFT JOIN categories ON quote_category_id = category_id
         WHERE quote_archived_at IS NULL
             AND (CONCAT(quote_prefix,quote_number) LIKE '%$query%' OR quote_number LIKE '%$query%' OR quote_scope LIKE '%$query%')
-            $access_permission_query
+            " . clientScopeSql('quote_client_id') . "
         ORDER BY quote_number DESC LIMIT 5"
     );
 
-    $sql_invoices = !$can_sales ? false : mysqli_query($mysqli, "SELECT * FROM invoices
+    $sql_invoices = !$can_sales ? false : mysqli_query($mysqli, "SELECT client_id, client_name, invoice_amount, invoice_currency_code, invoice_id, invoice_number,
+        invoice_prefix, invoice_status
+        FROM invoices
         LEFT JOIN clients ON invoice_client_id = client_id
         LEFT JOIN categories ON invoice_category_id = category_id
         WHERE invoice_archived_at IS NULL
             AND (CONCAT(invoice_prefix,invoice_number) LIKE '%$query%' OR invoice_number LIKE '%$query%' OR invoice_scope LIKE '%$query%')
-            $access_permission_query
+            " . clientScopeSql('invoice_client_id') . "
         ORDER BY invoice_number DESC LIMIT 5"
     );
 
-    $sql_assets = !$can_support ? false : mysqli_query($mysqli,"SELECT * FROM assets
+    $sql_assets = !$can_support ? false : mysqli_query($mysqli,"SELECT asset_client_id, asset_contact_id, asset_created_at, asset_description, asset_id,
+        asset_location_id, asset_make, asset_model, asset_name, asset_serial, asset_status, asset_type,
+        asset_uri, client_name, contact_archived_at, contact_id, contact_name
+        FROM assets
         LEFT JOIN contacts ON asset_contact_id = contact_id
         LEFT JOIN locations ON asset_location_id = location_id
         LEFT JOIN clients ON asset_client_id = client_id
         LEFT JOIN asset_interfaces ON interface_asset_id = asset_id AND interface_primary = 1
         WHERE asset_archived_at IS NULL
             AND (asset_name LIKE '%$query%' OR asset_description LIKE '%$query%' OR asset_type LIKE '%$query%' OR asset_make LIKE '%$query%' OR asset_model LIKE '%$query%' OR asset_serial LIKE '%$query%' OR asset_os LIKE '%$query%' OR interface_ip LIKE '%$query%' OR interface_nat_ip LIKE '%$query%' OR interface_mac LIKE '%$query%' OR asset_status LIKE '%$query%')
-            $access_permission_query
+            " . clientScopeSql('asset_client_id') . "
         ORDER BY asset_name DESC LIMIT 5"
     );
 
-    $sql_ticket_replies = !$can_support ? false : mysqli_query($mysqli,"SELECT * FROM ticket_replies
+    $sql_ticket_replies = !$can_support ? false : mysqli_query($mysqli,"SELECT client_name, ticket_client_id, ticket_id, ticket_number, ticket_prefix, ticket_reply,
+        ticket_subject
+        FROM ticket_replies
         LEFT JOIN tickets ON ticket_reply_ticket_id = ticket_id
         LEFT JOIN clients ON ticket_client_id = client_id
         WHERE ticket_reply_archived_at IS NULL
             AND (ticket_reply LIKE '%$query%')
-            $access_permission_query
+            " . clientScopeSql('ticket_client_id') . "
         ORDER BY ticket_id DESC, ticket_reply_id ASC LIMIT 20"
     );
 
diff --git a/agent/includes/client_overview_side_nav.php b/agent/includes/client_overview_side_nav.php
index 53d63c197..6b3c912d8 100644
--- a/agent/includes/client_overview_side_nav.php
+++ b/agent/includes/client_overview_side_nav.php
@@ -1,31 +1,31 @@
 <?php
 // Badge Counts
 
-$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('contact_id') AS num FROM contacts LEFT JOIN clients ON contact_client_id = client_id WHERE contact_archived_at IS NULL AND client_archived_at IS NULL $access_permission_query"));
+$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('contact_id') AS num FROM contacts LEFT JOIN clients ON contact_client_id = client_id WHERE contact_archived_at IS NULL AND client_archived_at IS NULL " . clientScopeSql('contact_client_id') . ""));
 $num_contacts = $row['num'];
 
-$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('location_id') AS num FROM locations LEFT JOIN clients ON location_client_id = client_id WHERE location_archived_at IS NULL AND client_archived_at IS NULL $access_permission_query"));
+$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('location_id') AS num FROM locations LEFT JOIN clients ON location_client_id = client_id WHERE location_archived_at IS NULL AND client_archived_at IS NULL " . clientScopeSql('location_client_id') . ""));
 $num_locations = $row['num'];
 
-$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('asset_id') AS num FROM assets LEFT JOIN clients ON asset_client_id = client_id WHERE asset_archived_at IS NULL AND client_archived_at IS NULL $access_permission_query"));
+$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('asset_id') AS num FROM assets LEFT JOIN clients ON asset_client_id = client_id WHERE asset_archived_at IS NULL AND client_archived_at IS NULL " . clientScopeSql('asset_client_id') . ""));
 $num_assets = $row['num'];
 
-$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('service_id') AS num FROM services LEFT JOIN clients ON service_client_id = client_id WHERE client_archived_at IS NULL $access_permission_query"));
+$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('service_id') AS num FROM services LEFT JOIN clients ON service_client_id = client_id WHERE client_archived_at IS NULL " . clientScopeSql('service_client_id') . ""));
 $num_services = $row['num'];
 
-$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('credential_id') AS num FROM credentials LEFT JOIN clients ON credential_client_id = client_id WHERE credential_archived_at IS NULL AND client_archived_at IS NULL $access_permission_query"));
+$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('credential_id') AS num FROM credentials LEFT JOIN clients ON credential_client_id = client_id WHERE credential_archived_at IS NULL AND client_archived_at IS NULL " . clientScopeSql('credential_client_id') . ""));
 $num_credentials = $row['num'];
 
-$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('network_id') AS num FROM networks LEFT JOIN clients ON network_client_id = client_id WHERE network_archived_at IS NULL AND client_archived_at IS NULL $access_permission_query"));
+$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('network_id') AS num FROM networks LEFT JOIN clients ON network_client_id = client_id WHERE network_archived_at IS NULL AND client_archived_at IS NULL " . clientScopeSql('network_client_id') . ""));
 $num_networks = $row['num'];
 
-$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('domain_id') AS num FROM domains LEFT JOIN clients ON domain_client_id = client_id WHERE domain_archived_at IS NULL AND client_archived_at IS NULL $access_permission_query"));
+$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('domain_id') AS num FROM domains LEFT JOIN clients ON domain_client_id = client_id WHERE domain_archived_at IS NULL AND client_archived_at IS NULL " . clientScopeSql('domain_client_id') . ""));
 $num_domains = $row['num'];
 
-$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('certificate_id') AS num FROM certificates LEFT JOIN clients ON certificate_client_id = client_id WHERE certificate_archived_at IS NULL AND client_archived_at IS NULL $access_permission_query"));
+$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('certificate_id') AS num FROM certificates LEFT JOIN clients ON certificate_client_id = client_id WHERE certificate_archived_at IS NULL AND client_archived_at IS NULL " . clientScopeSql('certificate_client_id') . ""));
 $num_certificates = $row['num'];
 
-$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('software_id') AS num FROM software LEFT JOIN clients ON software_client_id = client_id WHERE software_archived_at IS NULL AND client_archived_at IS NULL $access_permission_query"));
+$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('software_id') AS num FROM software LEFT JOIN clients ON software_client_id = client_id WHERE software_archived_at IS NULL AND client_archived_at IS NULL " . clientScopeSql('software_client_id') . ""));
 $num_software = $row['num'];
 
 ?>
diff --git a/agent/includes/get_side_nav_counts.php b/agent/includes/get_side_nav_counts.php
index 87dac0873..14bab8da9 100644
--- a/agent/includes/get_side_nav_counts.php
+++ b/agent/includes/get_side_nav_counts.php
@@ -2,31 +2,31 @@
 // Get Main Side Bar Badge Counts
 
 // Active Clients Count
-$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('client_id') AS num FROM clients WHERE client_archived_at IS NULL $access_permission_query"));
+$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('client_id') AS num FROM clients WHERE client_archived_at IS NULL " . clientScopeSql('clients.client_id') . ""));
 $num_active_clients = $row['num'];
 
 // Active Ticket Count
-$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('ticket_id') AS num FROM tickets LEFT JOIN clients ON client_id = ticket_client_id WHERE ticket_archived_at IS NULL AND ticket_closed_at IS NULL AND ticket_status != 4 $access_permission_query"));
+$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('ticket_id') AS num FROM tickets WHERE ticket_archived_at IS NULL AND ticket_closed_at IS NULL AND ticket_status != 4 " . clientScopeSql('ticket_client_id') . ""));
 $num_active_tickets = $row['num'];
 
 // Recurring Ticket Count
-$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('recurring_ticket_id') AS num FROM recurring_tickets LEFT JOIN clients ON client_id = recurring_ticket_client_id WHERE 1 = 1 $access_permission_query"));
+$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('recurring_ticket_id') AS num FROM recurring_tickets WHERE 1 = 1 " . clientScopeSql('recurring_ticket_client_id') . ""));
 $num_recurring_tickets = $row['num'];
 
 // Active Project Count
-$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('project_id') AS num FROM projects LEFT JOIN clients ON project_client_id = client_id WHERE project_archived_at IS NULL AND project_completed_at IS NULL $access_permission_query"));
+$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('project_id') AS num FROM projects WHERE project_archived_at IS NULL AND project_completed_at IS NULL " . clientScopeSql('project_client_id') . ""));
 $num_active_projects = $row['num'];
 
 // Open Invoices Count
-$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('invoice_id') AS num FROM invoices LEFT JOIN clients ON invoice_client_id = client_id WHERE (invoice_status = 'Sent' OR invoice_status = 'Viewed' OR invoice_status = 'Partial' OR invoice_status = 'Draft') AND invoice_archived_at IS NULL $access_permission_query"));
+$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('invoice_id') AS num FROM invoices WHERE (invoice_status = 'Sent' OR invoice_status = 'Viewed' OR invoice_status = 'Partial' OR invoice_status = 'Draft') AND invoice_archived_at IS NULL " . clientScopeSql('invoice_client_id') . ""));
 $num_open_invoices = $row['num'];
 
 // Recurring Invoice Count
-$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('recurring_invoice_id') AS num FROM recurring_invoices LEFT JOIN clients ON recurring_invoice_client_id = client_id WHERE recurring_invoice_archived_at IS NULL $access_permission_query"));
+$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('recurring_invoice_id') AS num FROM recurring_invoices WHERE recurring_invoice_archived_at IS NULL " . clientScopeSql('recurring_invoice_client_id') . ""));
 $num_recurring_invoices = $row['num'];
 
 // Open Quotes Count
-$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('quote_id') AS num FROM quotes LEFT JOIN clients ON quote_client_id = client_id WHERE (quote_status = 'Sent' OR quote_status = 'Viewed') AND quote_archived_at IS NULL $access_permission_query"));
+$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('quote_id') AS num FROM quotes WHERE (quote_status = 'Sent' OR quote_status = 'Viewed') AND quote_archived_at IS NULL " . clientScopeSql('quote_client_id') . ""));
 $num_open_quotes = $row['num'];
 
 // Recurring Expenses Count
diff --git a/agent/includes/inc_all_client.php b/agent/includes/inc_all_client.php
index cc676179b..da14ecc4b 100644
--- a/agent/includes/inc_all_client.php
+++ b/agent/includes/inc_all_client.php
@@ -18,7 +18,13 @@ if (isset($_GET['client_id'])) {
 
     $sql = mysqli_query(
         $mysqli,
-        "SELECT * FROM clients
+        "SELECT client_abbreviation, client_archived_at, client_created_at, client_currency_code,
+            client_lead, client_name, client_net_terms, client_notes, client_rate, client_referral,
+            client_tax_id_number, client_type, client_website, contact_email, contact_extension,
+            contact_id, contact_mobile, contact_mobile_country_code, contact_name, contact_phone,
+            contact_phone_country_code, contact_primary, contact_title, location_address,
+            location_city, location_country, location_id, location_name, location_phone,
+            location_phone_country_code, location_primary, location_state, location_zip FROM clients
         LEFT JOIN locations ON client_id = location_client_id AND location_primary = 1
         LEFT JOIN contacts ON client_id = contact_client_id AND contact_primary = 1
         WHERE client_id = $client_id"
@@ -75,7 +81,7 @@ if (isset($_GET['client_id'])) {
 
         $client_tag_name_display_array = array();
         $client_tag_id_array = array();
-        $sql_client_tags = mysqli_query($mysqli, "SELECT * FROM client_tags LEFT JOIN tags ON client_tags.tag_id = tags.tag_id WHERE client_id = $client_id ORDER BY tag_name ASC");
+        $sql_client_tags = mysqli_query($mysqli, "SELECT tag_color, tag_icon, client_tags.tag_id, tag_name FROM client_tags LEFT JOIN tags ON client_tags.tag_id = tags.tag_id WHERE client_id = $client_id ORDER BY tag_name ASC");
         while ($row = mysqli_fetch_assoc($sql_client_tags)) {
 
             $client_tag_id = intval($row['tag_id']);
diff --git a/agent/includes/inc_client_top_head.php b/agent/includes/inc_client_top_head.php
index 9bf26df13..62075a541 100644
--- a/agent/includes/inc_client_top_head.php
+++ b/agent/includes/inc_client_top_head.php
@@ -31,7 +31,7 @@
                         </a>
                         <?php } ?>
                     <?php } ?>
-                    <?php if (lookupUserPermission("module_client") >= 3) { ?>
+                    <?php if (lookupUserPermission("module_client") >= 1) { ?>
                         <div class="dropdown-divider"></div>
                         <a class="dropdown-item" href="#" data-toggle="modal" data-target="#exportClientPDFModal">
                             <i class="fas fa-fw fa-file-pdf mr-2"></i>Export Data
diff --git a/agent/includes/side_nav.php b/agent/includes/side_nav.php
index 530e56b83..9fbc901e3 100644
--- a/agent/includes/side_nav.php
+++ b/agent/includes/side_nav.php
@@ -200,7 +200,7 @@
                 <?php } ?>
 
                 <?php
-                $sql_custom_links = mysqli_query($mysqli, "SELECT * FROM custom_links WHERE custom_link_location = 1 AND custom_link_archived_at IS NULL
+                $sql_custom_links = mysqli_query($mysqli, "SELECT custom_link_icon, custom_link_name, custom_link_new_tab, custom_link_uri FROM custom_links WHERE custom_link_location = 1 AND custom_link_archived_at IS NULL
                     ORDER BY custom_link_order ASC, custom_link_name ASC"
                 );
 
diff --git a/agent/income.php b/agent/income.php
index e74f044fa..31a98a02c 100644
--- a/agent/income.php
+++ b/agent/income.php
@@ -91,7 +91,7 @@ $income_query =
     LEFT JOIN categories ON invoice_category_id = category_id
     WHERE payment_archived_at IS NULL
     $payment_client_query
-    $access_permission_query
+    " . clientScopeSql('invoice_client_id') . "
 
     UNION ALL
 
@@ -120,7 +120,8 @@ $income_query =
     LEFT JOIN transfers ON transfer_revenue_id = revenue_id
     WHERE revenue_archived_at IS NULL
     AND transfer_id IS NULL
-    $revenue_client_query";
+    $revenue_client_query
+    " . clientScopeSql('revenue_client_id') . "";
 
 $income_filter_query =
     "WHERE DATE(income_date) BETWEEN '$dtf' AND '$dtt'
diff --git a/agent/invoice.php b/agent/invoice.php
index 296d1c816..660151858 100644
--- a/agent/invoice.php
+++ b/agent/invoice.php
@@ -16,12 +16,18 @@ if (isset($_GET['invoice_id'])) {
 
     $sql = mysqli_query(
         $mysqli,
-        "SELECT * FROM invoices
+        "SELECT client_currency_code, client_id, client_name, client_net_terms, client_website,
+            contact_email, contact_extension, contact_mobile, contact_mobile_country_code,
+            contact_phone, contact_phone_country_code, invoice_amount, invoice_category_id,
+            invoice_created_at, invoice_credit_amount, invoice_currency_code, invoice_date,
+            invoice_discount_amount, invoice_due, invoice_id, invoice_note, invoice_number,
+            invoice_prefix, invoice_scope, invoice_status, invoice_url_key, location_address,
+            location_city, location_country, location_state, location_zip FROM invoices
         LEFT JOIN clients ON invoice_client_id = client_id
         LEFT JOIN contacts ON client_id = contact_client_id AND contact_primary = 1
         LEFT JOIN locations ON client_id = location_client_id AND location_primary = 1
         WHERE invoice_id = $invoice_id
-        $access_permission_query
+        " . clientScopeSql('invoice_client_id') . "
         LIMIT 1"
     );
 
@@ -77,7 +83,9 @@ if (isset($_GET['invoice_id'])) {
     $tab_title = $row['client_name'];
     $page_title = "{$row['invoice_prefix']}{$row['invoice_number']}";
 
-    $sql = mysqli_query($mysqli, "SELECT * FROM companies WHERE company_id = 1");
+    $sql = mysqli_query($mysqli, "SELECT company_address, company_city, company_country, company_email, company_id, company_logo,
+        company_name, company_phone, company_phone_country_code, company_state, company_tax_id,
+        company_website, company_zip FROM companies WHERE company_id = 1");
     $row = mysqli_fetch_assoc($sql);
     $company_id = intval($row['company_id']);
     $company_name = escapeHtml($row['company_name']);
@@ -98,9 +106,10 @@ if (isset($_GET['invoice_id'])) {
     }
     $company_logo = escapeHtml($row['company_logo']);
 
-    $sql_history = mysqli_query($mysqli, "SELECT * FROM history WHERE history_invoice_id = $invoice_id ORDER BY history_id DESC");
+    $sql_history = mysqli_query($mysqli, "SELECT history_created_at, history_description, history_status FROM history WHERE history_invoice_id = $invoice_id ORDER BY history_id DESC");
 
-    $sql_payments = mysqli_query($mysqli, "SELECT * FROM payments, accounts WHERE payment_account_id = account_id AND payment_invoice_id = $invoice_id ORDER BY payments.payment_id DESC");
+    $sql_payments = mysqli_query($mysqli, "SELECT account_name, payment_amount, payment_currency_code, payment_date, payment_id,
+        payment_reference FROM payments, accounts WHERE payment_account_id = account_id AND payment_invoice_id = $invoice_id ORDER BY payments.payment_id DESC");
 
     $sql_tickets = mysqli_query($mysqli, "
         SELECT
@@ -121,8 +130,7 @@ if (isset($_GET['invoice_id'])) {
     //Get billable, and unbilled tickets to add to invoice
     $sql_tickets_billable = mysqli_query(
         $mysqli, "
-        SELECT
-            *
+        SELECT 1
         FROM
             tickets
         WHERE
@@ -190,7 +198,7 @@ if (isset($_GET['invoice_id'])) {
 
     // Saved Payment Methods
     $sql_saved_payment_methods = mysqli_query($mysqli, "
-        SELECT * FROM client_saved_payment_methods
+        SELECT 1 FROM client_saved_payment_methods
         LEFT JOIN payment_providers
             ON client_saved_payment_methods.saved_payment_provider_id = payment_providers.payment_provider_id
         WHERE saved_payment_client_id = $client_id
@@ -372,7 +380,8 @@ if (isset($_GET['invoice_id'])) {
                 </div>
             </div>
 
-            <?php $sql_invoice_items = mysqli_query($mysqli, "SELECT * FROM invoice_items WHERE item_invoice_id = $invoice_id ORDER BY item_order ASC"); ?>
+            <?php $sql_invoice_items = mysqli_query($mysqli, "SELECT item_created_at, item_description, item_id, item_name, item_price, item_product_id,
+                item_quantity, item_tax, item_tax_id, item_total FROM invoice_items WHERE item_invoice_id = $invoice_id ORDER BY item_order ASC"); ?>
 
             <div class="row mb-3">
                 <div class="col-md-12">
@@ -469,7 +478,7 @@ if (isset($_GET['invoice_id'])) {
                                             <select class="form-control select2" name="tax_id" id="tax" required>
                                                 <option value="0">No Tax</option>
                                                 <?php
-                                                $taxes_sql = mysqli_query($mysqli, "SELECT * FROM taxes WHERE tax_archived_at IS NULL ORDER BY tax_name ASC");
+                                                $taxes_sql = mysqli_query($mysqli, "SELECT tax_id, tax_name, tax_percent FROM taxes WHERE tax_archived_at IS NULL ORDER BY tax_name ASC");
                                                 while ($row = mysqli_fetch_assoc($taxes_sql)) {
                                                     $tax_id = intval($row['tax_id']);
                                                     $tax_name = escapeHtml($row['tax_name']);
diff --git a/agent/invoices.php b/agent/invoices.php
index 7e5c7a517..3f9e885b8 100644
--- a/agent/invoices.php
+++ b/agent/invoices.php
@@ -11,57 +11,57 @@ if (isset($_GET['client_id'])) {
     $client_url = "client_id=$client_id&";
 } else {
     require_once "includes/inc_all.php";
-    $client_query = "$access_permission_query";
+    $client_query = clientScopeSql('invoice_client_id');
     $client_url = '';
 }
 
 // Perms
 enforceUserPermission('module_sales');
 
-$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('invoice_id') AS num FROM invoices LEFT JOIN clients ON invoice_client_id = client_id WHERE invoice_status = 'Sent' $client_query"));
+$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('invoice_id') AS num FROM invoices WHERE invoice_status = 'Sent' $client_query"));
 $sent_count = $row['num'];
 
-$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('invoice_id') AS num FROM invoices LEFT JOIN clients ON invoice_client_id = client_id WHERE invoice_status = 'Viewed' $client_query"));
+$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('invoice_id') AS num FROM invoices WHERE invoice_status = 'Viewed' $client_query"));
 $viewed_count = $row['num'];
 
-$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('invoice_id') AS num FROM invoices LEFT JOIN clients ON invoice_client_id = client_id WHERE invoice_status = 'Partial' $client_query"));
+$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('invoice_id') AS num FROM invoices WHERE invoice_status = 'Partial' $client_query"));
 $partial_count = $row['num'];
 
-$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('invoice_id') AS num FROM invoices LEFT JOIN clients ON invoice_client_id = client_id WHERE invoice_status = 'Draft' $client_query"));
+$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('invoice_id') AS num FROM invoices WHERE invoice_status = 'Draft' $client_query"));
 $draft_count = $row['num'];
 
-$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('invoice_id') AS num FROM invoices LEFT JOIN clients ON invoice_client_id = client_id WHERE invoice_status = 'Cancelled' $client_query"));
+$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('invoice_id') AS num FROM invoices WHERE invoice_status = 'Cancelled' $client_query"));
 $cancelled_count = $row['num'];
 
-$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('invoice_id') AS num FROM invoices LEFT JOIN clients ON invoice_client_id = client_id WHERE invoice_status NOT LIKE 'Draft' AND invoice_status NOT LIKE 'Paid' AND invoice_status NOT LIKE 'Cancelled' AND invoice_status NOT LIKE 'Non-Billable' AND invoice_due < CURDATE() $client_query"));
+$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('invoice_id') AS num FROM invoices WHERE invoice_status NOT LIKE 'Draft' AND invoice_status NOT LIKE 'Paid' AND invoice_status NOT LIKE 'Cancelled' AND invoice_status NOT LIKE 'Non-Billable' AND invoice_due < CURDATE() $client_query"));
 $overdue_count = $row['num'];
 
-$sql_total_draft_amount = mysqli_query($mysqli, "SELECT SUM(invoice_amount) AS total_draft_amount FROM invoices LEFT JOIN clients ON invoice_client_id = client_id WHERE invoice_status = 'Draft' $client_query");
+$sql_total_draft_amount = mysqli_query($mysqli, "SELECT SUM(invoice_amount) AS total_draft_amount FROM invoices WHERE invoice_status = 'Draft' $client_query");
 $row = mysqli_fetch_assoc($sql_total_draft_amount);
 $total_draft_amount = floatval($row['total_draft_amount']);
 
-$sql_total_sent_amount = mysqli_query($mysqli, "SELECT SUM(invoice_amount) AS total_sent_amount FROM invoices LEFT JOIN clients ON invoice_client_id = client_id WHERE invoice_status = 'Sent' $client_query");
+$sql_total_sent_amount = mysqli_query($mysqli, "SELECT SUM(invoice_amount) AS total_sent_amount FROM invoices WHERE invoice_status = 'Sent' $client_query");
 $row = mysqli_fetch_assoc($sql_total_sent_amount);
 $total_sent_amount = floatval($row['total_sent_amount']);
 
-$sql_total_viewed_amount = mysqli_query($mysqli, "SELECT SUM(invoice_amount) AS total_viewed_amount FROM invoices LEFT JOIN clients ON invoice_client_id = client_id WHERE invoice_status = 'Viewed' $client_query");
+$sql_total_viewed_amount = mysqli_query($mysqli, "SELECT SUM(invoice_amount) AS total_viewed_amount FROM invoices WHERE invoice_status = 'Viewed' $client_query");
 $row = mysqli_fetch_assoc($sql_total_viewed_amount);
 $total_viewed_amount = floatval($row['total_viewed_amount']);
 
-$sql_total_cancelled_amount = mysqli_query($mysqli, "SELECT SUM(invoice_amount) AS total_cancelled_amount FROM invoices LEFT JOIN clients ON invoice_client_id = client_id WHERE invoice_status = 'Cancelled' $client_query");
+$sql_total_cancelled_amount = mysqli_query($mysqli, "SELECT SUM(invoice_amount) AS total_cancelled_amount FROM invoices WHERE invoice_status = 'Cancelled' $client_query");
 $row = mysqli_fetch_assoc($sql_total_cancelled_amount);
 $total_cancelled_amount = floatval($row['total_cancelled_amount']);
 
-$sql_total_partial_amount = mysqli_query($mysqli, "SELECT SUM(invoice_amount) AS total_partial_amount FROM payments, invoices LEFT JOIN clients ON invoice_client_id = client_id WHERE payment_invoice_id = invoice_id AND invoice_status = 'Partial' $client_query");
+$sql_total_partial_amount = mysqli_query($mysqli, "SELECT SUM(invoice_amount) AS total_partial_amount FROM payments, invoices WHERE payment_invoice_id = invoice_id AND invoice_status = 'Partial' $client_query");
 $row = mysqli_fetch_assoc($sql_total_partial_amount);
 $total_partial_amount = floatval($row['total_partial_amount']);
 $total_partial_count = mysqli_num_rows($sql_total_partial_amount);
 
-$sql_total_overdue_partial_amount = mysqli_query($mysqli, "SELECT SUM(payment_amount) AS total_overdue_partial_amount FROM payments, invoices LEFT JOIN clients ON invoice_client_id = client_id WHERE payment_invoice_id = invoice_id AND invoice_status = 'Partial' AND invoice_due < CURDATE() $client_query");
+$sql_total_overdue_partial_amount = mysqli_query($mysqli, "SELECT SUM(payment_amount) AS total_overdue_partial_amount FROM payments, invoices WHERE payment_invoice_id = invoice_id AND invoice_status = 'Partial' AND invoice_due < CURDATE() $client_query");
 $row = mysqli_fetch_assoc($sql_total_overdue_partial_amount);
 $total_overdue_partial_amount = floatval($row['total_overdue_partial_amount']);
 
-$sql_total_overdue_amount = mysqli_query($mysqli, "SELECT SUM(invoice_amount) AS total_overdue_amount FROM invoices LEFT JOIN clients ON invoice_client_id = client_id WHERE invoice_status != 'Draft' AND invoice_status != 'Paid' AND invoice_status != 'Cancelled' AND invoice_status != 'Non-Billable' AND invoice_due < CURDATE() $client_query");
+$sql_total_overdue_amount = mysqli_query($mysqli, "SELECT SUM(invoice_amount) AS total_overdue_amount FROM invoices WHERE invoice_status != 'Draft' AND invoice_status != 'Paid' AND invoice_status != 'Cancelled' AND invoice_status != 'Non-Billable' AND invoice_due < CURDATE() $client_query");
 $row = mysqli_fetch_assoc($sql_total_overdue_amount);
 $total_overdue_amount = floatval($row['total_overdue_amount']);
 
@@ -94,7 +94,11 @@ if (isset($_GET['category']) & !empty($_GET['category'])) {
 
 $sql = mysqli_query(
     $mysqli,
-    "SELECT SQL_CALC_FOUND_ROWS * FROM invoices
+    "SELECT SQL_CALC_FOUND_ROWS category_id, category_name, client_currency_code, client_id, client_name, client_net_terms,
+        invoice_amount, invoice_created_at, invoice_currency_code, invoice_date,
+        invoice_discount_amount, invoice_due, invoice_id, invoice_number, invoice_prefix,
+        invoice_scope, invoice_status, recurring_invoice_id, recurring_invoice_number,
+        recurring_invoice_prefix FROM invoices
     LEFT JOIN clients ON invoice_client_id = client_id
     LEFT JOIN categories ON invoice_category_id = category_id
     LEFT JOIN recurring_invoices ON invoice_recurring_invoice_id = recurring_invoice_id
@@ -103,7 +107,7 @@ $sql = mysqli_query(
     $category_query
     AND DATE(invoice_date) BETWEEN '$dtf' AND '$dtt'
     AND (CONCAT(invoice_prefix,invoice_number) LIKE '%$q%' OR invoice_scope LIKE '%$q%' OR client_name LIKE '%$q%' OR invoice_status LIKE '%$q%' OR invoice_amount LIKE '%$q%' OR category_name LIKE '%$q%')
-    $access_permission_query
+    " . clientScopeSql('invoice_client_id') . "
     $client_query
     ORDER BY $sort $order LIMIT $record_from, $record_to"
 );
@@ -362,7 +366,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
 
                         // Saved Payment Methods
                         $sql_saved_payment_methods = mysqli_query($mysqli, "
-                            SELECT * FROM client_saved_payment_methods
+                            SELECT 1 FROM client_saved_payment_methods
                             LEFT JOIN payment_providers
                                 ON client_saved_payment_methods.saved_payment_provider_id = payment_providers.payment_provider_id
                             WHERE saved_payment_client_id = $client_id
diff --git a/agent/locations.php b/agent/locations.php
index e041987a8..e59362e3a 100644
--- a/agent/locations.php
+++ b/agent/locations.php
@@ -64,7 +64,7 @@ $sql = mysqli_query(
     WHERE $archive_query
     $tag_query
     AND (location_name LIKE '%$q%' OR location_description LIKE '%$q%' OR location_address LIKE '%$q%' OR location_city LIKE '%$q%' OR location_state LIKE '%$q%' OR location_zip LIKE '%$q%' OR location_country LIKE '%$q%' OR location_phone LIKE '%$phone_query%' OR tag_name LIKE '%$q%' OR client_name LIKE '%$q%')
-    $access_permission_query
+    " . clientScopeSql('location_client_id') . "
     $client_query
     GROUP BY location_id
     ORDER BY location_primary DESC, $sort $order LIMIT $record_from, $record_to"
@@ -154,7 +154,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                                 FROM clients
                                 JOIN locations ON location_client_id = client_id
                                 WHERE $archive_query
-                                $access_permission_query
+                                " . clientScopeSql('clients.client_id') . "
                                 ORDER BY client_name ASC
                             ");
                             while ($row = mysqli_fetch_assoc($sql_clients_filter)) {
@@ -306,7 +306,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
 
                         $location_tag_name_display_array = array();
                         $location_tag_id_array = array();
-                        $sql_location_tags = mysqli_query($mysqli, "SELECT * FROM location_tags LEFT JOIN tags ON location_tags.tag_id = tags.tag_id WHERE location_tags.location_id = $location_id ORDER BY tag_name ASC");
+                        $sql_location_tags = mysqli_query($mysqli, "SELECT tag_color, tag_icon, location_tags.tag_id, tag_name FROM location_tags LEFT JOIN tags ON location_tags.tag_id = tags.tag_id WHERE location_tags.location_id = $location_id ORDER BY tag_name ASC");
                         while ($row = mysqli_fetch_assoc($sql_location_tags)) {
 
                             $location_tag_id = intval($row['tag_id']);
diff --git a/agent/modals/account/account_edit.php b/agent/modals/account/account_edit.php
index 72cbf0b79..a44b469b1 100644
--- a/agent/modals/account/account_edit.php
+++ b/agent/modals/account/account_edit.php
@@ -6,7 +6,7 @@ enforceUserPermission('module_financial', 2);
 
 $account_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM accounts WHERE account_id = $account_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT account_name, account_notes FROM accounts WHERE account_id = $account_id LIMIT 1");
 
 $row = mysqli_fetch_assoc($sql);
 $account_name = escapeHtml($row['account_name']);
diff --git a/agent/modals/asset/asset.php b/agent/modals/asset/asset.php
index 59af1695a..0922e67fe 100644
--- a/agent/modals/asset/asset.php
+++ b/agent/modals/asset/asset.php
@@ -6,7 +6,15 @@ enforceUserPermission('module_support');
 
 $asset_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM assets
+$sql = mysqli_query($mysqli, "SELECT asset_contact_id, asset_created_at, asset_description, asset_favorite, asset_id,
+    asset_install_date, asset_location_id, asset_make, asset_model, asset_name, asset_notes,
+    asset_os, asset_photo, asset_physical_location, asset_purchase_date,
+    asset_purchase_reference, asset_serial, asset_status, asset_type, asset_uri, asset_uri_2,
+    asset_uri_client, asset_vendor_id, asset_warranty_expire, client_id, client_name,
+    contact_archived_at, contact_email, contact_extension, contact_mobile,
+    contact_mobile_country_code, contact_name, contact_phone, contact_phone_country_code,
+    interface_ip, interface_ipv6, interface_mac, interface_nat_ip, interface_network_id,
+    location_archived_at, location_name FROM assets
     LEFT JOIN clients ON client_id = asset_client_id
     LEFT JOIN contacts ON asset_contact_id = contact_id
     LEFT JOIN locations ON asset_location_id = location_id
@@ -82,7 +90,7 @@ if ($location_archived_at) {
 // Tags - many to many relationship
 $asset_tag_name_display_array = array();
 $asset_tag_id_array = array();
-$sql_asset_tags = mysqli_query($mysqli, "SELECT * FROM asset_tags LEFT JOIN tags ON asset_tag_tag_id = tag_id WHERE asset_tag_asset_id = $asset_id ORDER BY tag_name ASC");
+$sql_asset_tags = mysqli_query($mysqli, "SELECT tag_color, tag_icon, tag_id, tag_name FROM asset_tags LEFT JOIN tags ON asset_tag_tag_id = tag_id WHERE asset_tag_asset_id = $asset_id ORDER BY tag_name ASC");
 while ($row = mysqli_fetch_assoc($sql_asset_tags)) {
 
     $asset_tag_id = intval($row['tag_id']);
@@ -179,7 +187,8 @@ $sql_related_tickets = mysqli_query($mysqli, "
 $ticket_count = mysqli_num_rows($sql_related_tickets);
 
 // Related Recurring Tickets Query
-$sql_related_recurring_tickets = mysqli_query($mysqli, "SELECT * FROM recurring_tickets
+$sql_related_recurring_tickets = mysqli_query($mysqli, "SELECT recurring_ticket_frequency, recurring_ticket_assets.recurring_ticket_id,
+    recurring_ticket_next_run, recurring_ticket_priority, recurring_ticket_subject FROM recurring_tickets
     LEFT JOIN recurring_ticket_assets ON recurring_tickets.recurring_ticket_id = recurring_ticket_assets.recurring_ticket_id
     WHERE recurring_ticket_asset_id = $asset_id OR recurring_ticket_assets.asset_id = $asset_id
     GROUP BY recurring_tickets.recurring_ticket_id
@@ -188,7 +197,8 @@ $sql_related_recurring_tickets = mysqli_query($mysqli, "SELECT * FROM recurring_
 $recurring_ticket_count = mysqli_num_rows($sql_related_recurring_tickets);
 
 // Related Documents
-$sql_related_documents = mysqli_query($mysqli, "SELECT * FROM asset_documents
+$sql_related_documents = mysqli_query($mysqli, "SELECT document_created_at, document_description, documents.document_id, document_name,
+    document_updated_at, user_name FROM asset_documents
     LEFT JOIN documents ON asset_documents.document_id = documents.document_id
     LEFT JOIN users ON user_id = document_created_by
     WHERE asset_documents.asset_id = $asset_id
@@ -198,7 +208,7 @@ $sql_related_documents = mysqli_query($mysqli, "SELECT * FROM asset_documents
 $document_count = mysqli_num_rows($sql_related_documents);
 
 // Related Files
-$sql_related_files = mysqli_query($mysqli, "SELECT * FROM asset_files
+$sql_related_files = mysqli_query($mysqli, "SELECT file_created_at, file_description, file_ext, files.file_id, file_mime_type, file_name FROM asset_files
     LEFT JOIN files ON asset_files.file_id = files.file_id
     WHERE asset_files.asset_id = $asset_id
     AND file_archived_at IS NULL
@@ -209,7 +219,9 @@ $file_count = mysqli_num_rows($sql_related_files);
 // Related Software Query
 $sql_related_software = mysqli_query(
     $mysqli,
-    "SELECT * FROM software_assets
+    "SELECT software_expire, software_assets.software_id, software_key, software_license_type,
+        software_name, software_notes, software_purchase, software_seats, software_type,
+        software_version FROM software_assets
     LEFT JOIN software ON software_assets.software_id = software.software_id
     WHERE software_assets.asset_id = $asset_id
     AND software_archived_at IS NULL
@@ -219,7 +231,7 @@ $sql_related_software = mysqli_query(
 $software_count = mysqli_num_rows($sql_related_software);
 
 // Related Notes
-$sql_related_notes = mysqli_query($mysqli, "SELECT * FROM asset_notes
+$sql_related_notes = mysqli_query($mysqli, "SELECT asset_note, asset_note_created_at, asset_note_type, user_name FROM asset_notes
     LEFT JOIN users ON asset_note_created_by = user_id
     WHERE asset_note_asset_id = $asset_id
     AND asset_note_archived_at IS NULL
@@ -571,7 +583,7 @@ ob_start();
                         // Tags
                         $credential_tag_name_display_array = array();
                         $credential_tag_id_array = array();
-                        $sql_credential_tags = mysqli_query($mysqli, "SELECT * FROM credential_tags LEFT JOIN tags ON credential_tags.tag_id = tags.tag_id WHERE credential_id = $credential_id ORDER BY tag_name ASC");
+                        $sql_credential_tags = mysqli_query($mysqli, "SELECT tag_color, tag_icon, credential_tags.tag_id, tag_name FROM credential_tags LEFT JOIN tags ON credential_tags.tag_id = tags.tag_id WHERE credential_id = $credential_id ORDER BY tag_name ASC");
                         while ($row = mysqli_fetch_assoc($sql_credential_tags)) {
 
                             $credential_tag_id = intval($row['tag_id']);
diff --git a/agent/modals/asset/asset_add.php b/agent/modals/asset/asset_add.php
index c6da21baf..6a4a01d59 100644
--- a/agent/modals/asset/asset_add.php
+++ b/agent/modals/asset/asset_add.php
@@ -7,12 +7,12 @@ $contact_id = intval($_GET['contact_id'] ?? 0);
 $type = escapeHtml(ucwords($_GET['type']) ?? '');
 
 if ($client_id) {
-    $sql_network_select = mysqli_query($mysqli, "SELECT * FROM networks WHERE network_archived_at IS NULL AND network_client_id = $client_id ORDER BY network_name ASC");
-    $sql_vendor_select = mysqli_query($mysqli, "SELECT * FROM vendors WHERE vendor_archived_at IS NULL AND vendor_client_id = $client_id ORDER BY vendor_name ASC");
+    $sql_network_select = mysqli_query($mysqli, "SELECT network, network_id, network_name FROM networks WHERE network_archived_at IS NULL AND network_client_id = $client_id ORDER BY network_name ASC");
+    $sql_vendor_select = mysqli_query($mysqli, "SELECT vendor_id, vendor_name FROM vendors WHERE vendor_archived_at IS NULL AND vendor_client_id = $client_id ORDER BY vendor_name ASC");
     $sql_location_select = mysqli_query($mysqli, "SELECT location_id, location_name FROM locations WHERE location_archived_at IS NULL AND location_client_id = $client_id ORDER BY location_name ASC");
-    $sql_contact_select = mysqli_query($mysqli, "SELECT * FROM contacts WHERE contact_archived_at IS NULL AND contact_client_id = $client_id ORDER BY contact_name ASC");
+    $sql_contact_select = mysqli_query($mysqli, "SELECT contact_id, contact_name FROM contacts WHERE contact_archived_at IS NULL AND contact_client_id = $client_id ORDER BY contact_name ASC");
 } else {
-    $sql_client_select = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients WHERE client_archived_at IS NULL $access_permission_query ORDER BY client_name ASC");
+    $sql_client_select = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients WHERE client_archived_at IS NULL " . clientScopeSql('clients.client_id') . " ORDER BY client_name ASC");
 }
 
 // OS typeahead suggestions
diff --git a/agent/modals/asset/asset_bulk_add_ticket.php b/agent/modals/asset/asset_bulk_add_ticket.php
index 9050cac8f..a1f5eed98 100644
--- a/agent/modals/asset/asset_bulk_add_ticket.php
+++ b/agent/modals/asset/asset_bulk_add_ticket.php
@@ -116,7 +116,7 @@ ob_start();
                     <option value="0">- None -</option>
                     <?php
 
-                    $sql_projects = mysqli_query($mysqli, "SELECT * FROM projects WHERE project_completed_at IS NULL AND project_archived_at IS NULL ORDER BY project_name ASC");
+                    $sql_projects = mysqli_query($mysqli, "SELECT project_id, project_name FROM projects WHERE project_completed_at IS NULL AND project_archived_at IS NULL ORDER BY project_name ASC");
                     while ($row = mysqli_fetch_assoc($sql_projects)) {
                         $project_id_select = intval($row['project_id']);
                         $project_name_select = escapeHtml($row['project_name']); ?>
diff --git a/agent/modals/asset/asset_bulk_assign_contact.php b/agent/modals/asset/asset_bulk_assign_contact.php
index 6d0489b76..ab301a310 100644
--- a/agent/modals/asset/asset_bulk_assign_contact.php
+++ b/agent/modals/asset/asset_bulk_assign_contact.php
@@ -37,7 +37,7 @@ ob_start();
                     <option value="">- Contact -</option>
                     <?php
 
-                    $sql = mysqli_query($mysqli, "SELECT * FROM contacts WHERE contact_archived_at IS NULL AND contact_client_id = $client_id ORDER BY contact_name ASC");
+                    $sql = mysqli_query($mysqli, "SELECT contact_id, contact_name FROM contacts WHERE contact_archived_at IS NULL AND contact_client_id = $client_id ORDER BY contact_name ASC");
                     while ($row = mysqli_fetch_assoc($sql)) {
                         $contact_id = intval($row['contact_id']);
                         $contact_name = escapeHtml($row['contact_name']);
diff --git a/agent/modals/asset/asset_bulk_assign_tags.php b/agent/modals/asset/asset_bulk_assign_tags.php
index c47fe4944..c3db98f5b 100644
--- a/agent/modals/asset/asset_bulk_assign_tags.php
+++ b/agent/modals/asset/asset_bulk_assign_tags.php
@@ -37,7 +37,7 @@ ob_start();
                 <select class="form-control select2" name="tags[]" data-placeholder="Add some tags" multiple>
                     <?php
 
-                    $sql_tags_select = mysqli_query($mysqli, "SELECT * FROM tags WHERE tag_type = 5 ORDER BY tag_name ASC");
+                    $sql_tags_select = mysqli_query($mysqli, "SELECT tag_id, tag_name FROM tags WHERE tag_type = 5 ORDER BY tag_name ASC");
                     while ($row = mysqli_fetch_assoc($sql_tags_select)) {
                         $tag_id_select = intval($row['tag_id']);
                         $tag_name_select = escapeHtml($row['tag_name']);
diff --git a/agent/modals/asset/asset_copy.php b/agent/modals/asset/asset_copy.php
index e212a9d3e..d44741b33 100644
--- a/agent/modals/asset/asset_copy.php
+++ b/agent/modals/asset/asset_copy.php
@@ -6,7 +6,12 @@ enforceUserPermission('module_support', 2);
 
 $asset_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM assets
+$sql = mysqli_query($mysqli, "SELECT asset_archived_at, asset_client_id, asset_contact_id, asset_created_at, asset_description,
+    asset_id, asset_install_date, asset_location_id, asset_make, asset_model, asset_name,
+    asset_notes, asset_os, asset_photo, asset_physical_location, asset_purchase_date,
+    asset_purchase_reference, asset_serial, asset_status, asset_type, asset_uri, asset_uri_2,
+    asset_vendor_id, asset_warranty_expire, interface_ip, interface_ipv6, interface_mac,
+    interface_nat_ip, interface_network_id FROM assets
     LEFT JOIN asset_interfaces ON interface_asset_id = asset_id AND interface_primary = 1
     WHERE asset_id = $asset_id LIMIT 1"
 );
@@ -181,7 +186,7 @@ ob_start();
                             <option value="">- Select Location -</option>
                             <?php
 
-                            $sql_locations = mysqli_query($mysqli, "SELECT * FROM locations WHERE location_archived_at IS NULL AND location_client_id = $client_id ORDER BY location_name ASC");
+                            $sql_locations = mysqli_query($mysqli, "SELECT location_id, location_name FROM locations WHERE location_archived_at IS NULL AND location_client_id = $client_id ORDER BY location_name ASC");
                             while ($row = mysqli_fetch_assoc($sql_locations)) {
                                 $location_id_select = intval($row['location_id']);
                                 $location_name_select = escapeHtml($row['location_name']);
@@ -213,7 +218,7 @@ ob_start();
                             <option value="">- Select Contact -</option>
                             <?php
 
-                            $sql_contacts = mysqli_query($mysqli, "SELECT * FROM contacts WHERE contact_archived_at IS NULL AND contact_client_id = $client_id ORDER BY contact_name ASC");
+                            $sql_contacts = mysqli_query($mysqli, "SELECT contact_id, contact_name FROM contacts WHERE contact_archived_at IS NULL AND contact_client_id = $client_id ORDER BY contact_name ASC");
                             while ($row = mysqli_fetch_assoc($sql_contacts)) {
                                 $contact_id_select = intval($row['contact_id']);
                                 $contact_name_select = escapeHtml($row['contact_name']);
@@ -265,7 +270,7 @@ ob_start();
                             <option value="">- Select Network -</option>
                             <?php
 
-                            $sql_networks = mysqli_query($mysqli, "SELECT * FROM networks WHERE network_archived_at IS NULL AND network_client_id = $client_id ORDER BY network_name ASC");
+                            $sql_networks = mysqli_query($mysqli, "SELECT network, network_id, network_name FROM networks WHERE network_archived_at IS NULL AND network_client_id = $client_id ORDER BY network_name ASC");
                             while ($row = mysqli_fetch_assoc($sql_networks)) {
                                 $network_id_select = intval($row['network_id']);
                                 $network_name_select = escapeHtml($row['network_name']);
@@ -358,7 +363,7 @@ ob_start();
                             <option value="">- Select Vendor -</option>
                             <?php
 
-                            $sql_vendors = mysqli_query($mysqli, "SELECT * FROM vendors WHERE vendor_archived_at IS NULL AND vendor_client_id = $client_id ORDER BY vendor_name ASC");
+                            $sql_vendors = mysqli_query($mysqli, "SELECT vendor_id, vendor_name FROM vendors WHERE vendor_archived_at IS NULL AND vendor_client_id = $client_id ORDER BY vendor_name ASC");
                             while ($row = mysqli_fetch_assoc($sql_vendors)) {
                                 $vendor_id_select = intval($row['vendor_id']);
                                 $vendor_name_select = escapeHtml($row['vendor_name']);
diff --git a/agent/modals/asset/asset_edit.php b/agent/modals/asset/asset_edit.php
index df5e33a6e..b8bd7bcee 100644
--- a/agent/modals/asset/asset_edit.php
+++ b/agent/modals/asset/asset_edit.php
@@ -6,7 +6,12 @@ enforceUserPermission('module_support', 2);
 
 $asset_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM assets
+$sql = mysqli_query($mysqli, "SELECT asset_archived_at, asset_client_id, asset_contact_id, asset_created_at, asset_description,
+    asset_favorite, asset_id, asset_install_date, asset_location_id, asset_make, asset_model,
+    asset_name, asset_notes, asset_os, asset_photo, asset_physical_location,
+    asset_purchase_date, asset_purchase_reference, asset_serial, asset_status, asset_type,
+    asset_uri, asset_uri_2, asset_uri_client, asset_vendor_id, asset_warranty_expire,
+    interface_ip, interface_ipv6, interface_mac, interface_nat_ip, interface_network_id FROM assets
     LEFT JOIN asset_interfaces ON interface_asset_id = asset_id AND interface_primary = 1
     WHERE asset_id = $asset_id LIMIT 1"
 );
@@ -47,7 +52,7 @@ $asset_network_id = intval($row['interface_network_id']);
 $device_icon = getAssetIcon($asset_type);
 
 // Asset History Query
-$sql_asset_history = mysqli_query($mysqli, "SELECT * FROM asset_history
+$sql_asset_history = mysqli_query($mysqli, "SELECT asset_history_created_at, asset_history_description, asset_history_status FROM asset_history
     WHERE asset_history_asset_id = $asset_id
     ORDER BY asset_history_id
     DESC LIMIT 10"
@@ -210,7 +215,7 @@ ob_start();
                             <option value="">- Select Location -</option>
                             <?php
 
-                            $sql_locations = mysqli_query($mysqli, "SELECT * FROM locations WHERE location_id = $asset_location_id OR location_archived_at IS NULL AND location_client_id = $client_id ORDER BY location_name ASC");
+                            $sql_locations = mysqli_query($mysqli, "SELECT location_archived_at, location_id, location_name FROM locations WHERE location_id = $asset_location_id OR location_archived_at IS NULL AND location_client_id = $client_id ORDER BY location_name ASC");
                             while ($row = mysqli_fetch_assoc($sql_locations)) {
                                 $location_id_select = intval($row['location_id']);
                                 $location_name_select = escapeHtml($row['location_name']);
@@ -248,7 +253,7 @@ ob_start();
                             <option value="">- Select Contact -</option>
                             <?php
 
-                            $sql_contacts = mysqli_query($mysqli, "SELECT * FROM contacts WHERE contact_id = $asset_contact_id OR contact_archived_at IS NULL AND contact_client_id = $client_id ORDER BY contact_name ASC");
+                            $sql_contacts = mysqli_query($mysqli, "SELECT contact_archived_at, contact_id, contact_name FROM contacts WHERE contact_id = $asset_contact_id OR contact_archived_at IS NULL AND contact_client_id = $client_id ORDER BY contact_name ASC");
                             while ($row = mysqli_fetch_assoc($sql_contacts)) {
                                 $contact_id_select = intval($row['contact_id']);
                                 $contact_name_select = escapeHtml($row['contact_name']);
@@ -308,7 +313,7 @@ ob_start();
                             <option value="">- Select Network -</option>
                             <?php
 
-                            $sql_networks = mysqli_query($mysqli, "SELECT * FROM networks WHERE network_id = $asset_network_id OR network_archived_at IS NULL AND network_client_id = $client_id ORDER BY network_name ASC");
+                            $sql_networks = mysqli_query($mysqli, "SELECT network, network_archived_at, network_id, network_name FROM networks WHERE network_id = $asset_network_id OR network_archived_at IS NULL AND network_client_id = $client_id ORDER BY network_name ASC");
                             while ($row = mysqli_fetch_assoc($sql_networks)) {
                                 $network_id_select = intval($row['network_id']);
                                 $network_name_select = escapeHtml($row['network_name']);
@@ -416,7 +421,7 @@ ob_start();
                             <option value="">- Select Vendor -</option>
                             <?php
 
-                            $sql_vendors = mysqli_query($mysqli, "SELECT * FROM vendors WHERE vendor_id = $asset_vendor_id OR vendor_archived_at IS NULL AND vendor_client_id = $client_id ORDER BY vendor_name ASC");
+                            $sql_vendors = mysqli_query($mysqli, "SELECT vendor_archived_at, vendor_id, vendor_name FROM vendors WHERE vendor_id = $asset_vendor_id OR vendor_archived_at IS NULL AND vendor_client_id = $client_id ORDER BY vendor_name ASC");
                             while ($row = mysqli_fetch_assoc($sql_vendors)) {
                                 $vendor_id_select = intval($row['vendor_id']);
                                 $vendor_name_select = escapeHtml($row['vendor_name']);
@@ -506,7 +511,7 @@ ob_start();
                         <select class="form-control select2" name="tags[]" data-placeholder="Add some tags" multiple>
                             <?php
 
-                            $sql_tags_select = mysqli_query($mysqli, "SELECT * FROM tags WHERE tag_type = 5 ORDER BY tag_name ASC");
+                            $sql_tags_select = mysqli_query($mysqli, "SELECT tag_id, tag_name FROM tags WHERE tag_type = 5 ORDER BY tag_name ASC");
                             while ($row = mysqli_fetch_assoc($sql_tags_select)) {
                                 $tag_id_select = intval($row['tag_id']);
                                 $tag_name_select = escapeHtml($row['tag_name']);
diff --git a/agent/modals/asset/asset_interface_add.php b/agent/modals/asset/asset_interface_add.php
index e013c0878..10c4549f4 100644
--- a/agent/modals/asset/asset_interface_add.php
+++ b/agent/modals/asset/asset_interface_add.php
@@ -111,7 +111,7 @@ ob_start();
                         <select class="form-control select2" name="network">
                             <option value="">- Select Network -</option>
                             <?php
-                            $sql_network_select = mysqli_query($mysqli, "SELECT * FROM networks WHERE network_archived_at IS NULL AND network_client_id = $client_id ORDER BY network_name ASC");
+                            $sql_network_select = mysqli_query($mysqli, "SELECT network, network_id, network_name FROM networks WHERE network_archived_at IS NULL AND network_client_id = $client_id ORDER BY network_name ASC");
                             while ($row = mysqli_fetch_assoc($sql_network_select)) {
                                 $network_id = $row['network_id'];
                                 $network_name = escapeHtml($row['network_name']);
diff --git a/agent/modals/asset/asset_interface_edit.php b/agent/modals/asset/asset_interface_edit.php
index 25d953c4e..d8aa6dc23 100644
--- a/agent/modals/asset/asset_interface_edit.php
+++ b/agent/modals/asset/asset_interface_edit.php
@@ -4,9 +4,10 @@ require_once '../../../includes/modal_header.php';
 
 $interface_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM asset_interfaces
+$sql = mysqli_query($mysqli, "SELECT asset_client_id, asset_name, interface_asset_id, interface_description, interface_id,
+    interface_ip, interface_ipv6, interface_mac, interface_name, interface_nat_ip,
+    interface_network_id, interface_notes, interface_primary, interface_type FROM asset_interfaces
     LEFT JOIN assets ON asset_id = interface_asset_id
-    LEFT JOIN clients ON client_id = asset_client_id
     WHERE interface_id = $interface_id LIMIT 1"
 );
 
diff --git a/agent/modals/asset/asset_link_credential.php b/agent/modals/asset/asset_link_credential.php
index 4992b65e5..9c1e589c9 100644
--- a/agent/modals/asset/asset_link_credential.php
+++ b/agent/modals/asset/asset_link_credential.php
@@ -6,7 +6,7 @@ enforceUserPermission('module_credential', 2);
 
 $asset_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM assets
+$sql = mysqli_query($mysqli, "SELECT asset_client_id, asset_name FROM assets
     WHERE asset_id = $asset_id
     LIMIT 1
 ");
diff --git a/agent/modals/asset/asset_link_document.php b/agent/modals/asset/asset_link_document.php
index 6a69a64c4..ad6c607c0 100644
--- a/agent/modals/asset/asset_link_document.php
+++ b/agent/modals/asset/asset_link_document.php
@@ -4,7 +4,7 @@ require_once '../../../includes/modal_header.php';
 
 $asset_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM assets
+$sql = mysqli_query($mysqli, "SELECT asset_client_id, asset_name FROM assets
     WHERE asset_id = $asset_id
     LIMIT 1
 ");
diff --git a/agent/modals/asset/asset_link_file.php b/agent/modals/asset/asset_link_file.php
index 81fc0d4fc..55c06c161 100644
--- a/agent/modals/asset/asset_link_file.php
+++ b/agent/modals/asset/asset_link_file.php
@@ -6,7 +6,7 @@ enforceUserPermission('module_credential', 2);
 
 $asset_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM assets
+$sql = mysqli_query($mysqli, "SELECT asset_client_id, asset_name FROM assets
     WHERE asset_id = $asset_id
     LIMIT 1
 ");
diff --git a/agent/modals/asset/asset_link_service.php b/agent/modals/asset/asset_link_service.php
index 1241ce39b..f6b9c6bda 100644
--- a/agent/modals/asset/asset_link_service.php
+++ b/agent/modals/asset/asset_link_service.php
@@ -4,7 +4,7 @@ require_once '../../../includes/modal_header.php';
 
 $asset_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM assets
+$sql = mysqli_query($mysqli, "SELECT asset_client_id, asset_name FROM assets
     WHERE asset_id = $asset_id
     LIMIT 1
 ");
diff --git a/agent/modals/asset/asset_link_software.php b/agent/modals/asset/asset_link_software.php
index b5667987d..a791c4d9d 100644
--- a/agent/modals/asset/asset_link_software.php
+++ b/agent/modals/asset/asset_link_software.php
@@ -4,7 +4,7 @@ require_once '../../../includes/modal_header.php';
 
 $asset_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM assets
+$sql = mysqli_query($mysqli, "SELECT asset_client_id, asset_name FROM assets
     WHERE asset_id = $asset_id
     LIMIT 1
 ");
diff --git a/agent/modals/calendar/calendar_edit.php b/agent/modals/calendar/calendar_edit.php
index ee90557ba..8896b51dd 100644
--- a/agent/modals/calendar/calendar_edit.php
+++ b/agent/modals/calendar/calendar_edit.php
@@ -4,7 +4,7 @@ require_once '../../../includes/modal_header.php';
 
 $calendar_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM calendars WHERE calendar_id = $calendar_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT calendar_color, calendar_name FROM calendars WHERE calendar_id = $calendar_id LIMIT 1");
 
 $row = mysqli_fetch_assoc($sql);
 $calendar_name = escapeHtml($row['calendar_name']);
diff --git a/agent/modals/calendar/calendar_event_add.php b/agent/modals/calendar/calendar_event_add.php
index 8c257e3af..b593005df 100644
--- a/agent/modals/calendar/calendar_event_add.php
+++ b/agent/modals/calendar/calendar_event_add.php
@@ -39,7 +39,7 @@
                                         <option value="">- Calendar -</option>
                                         <?php
 
-                                        $sql = mysqli_query($mysqli, "SELECT * FROM calendars ORDER BY calendar_name ASC");
+                                        $sql = mysqli_query($mysqli, "SELECT calendar_color, calendar_id, calendar_name FROM calendars ORDER BY calendar_name ASC");
                                         while ($row = mysqli_fetch_assoc($sql)) {
                                             $calendar_id = intval($row['calendar_id']);
                                             $calendar_name = escapeHtml($row['calendar_name']);
@@ -167,7 +167,7 @@
                                             <option value="">- Client -</option>
                                             <?php
 
-                                            $sql = mysqli_query($mysqli, "SELECT * FROM clients LEFT JOIN contacts ON clients.client_id = contacts.contact_client_id AND contact_primary = 1 ORDER BY client_name ASC");
+                                            $sql = mysqli_query($mysqli, "SELECT client_id, client_name, contact_email FROM clients LEFT JOIN contacts ON clients.client_id = contacts.contact_client_id AND contact_primary = 1 ORDER BY client_name ASC");
                                             while ($row = mysqli_fetch_assoc($sql)) {
                                                 $client_id = intval($row['client_id']);
                                                 $client_name = escapeHtml($row['client_name']);
diff --git a/agent/modals/calendar/calendar_event_edit.php b/agent/modals/calendar/calendar_event_edit.php
index 804092769..8a3f769de 100644
--- a/agent/modals/calendar/calendar_event_edit.php
+++ b/agent/modals/calendar/calendar_event_edit.php
@@ -4,7 +4,8 @@ require_once '../../../includes/modal_header.php';
 
 $event_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM calendar_events LEFT JOIN calendars ON event_calendar_id = calendar_id WHERE event_id = $event_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT calendar_color, calendar_id, calendar_name, event_all_day, event_client_id,
+    event_description, event_end, event_location, event_repeat, event_start, event_title FROM calendar_events LEFT JOIN calendars ON event_calendar_id = calendar_id WHERE event_id = $event_id LIMIT 1");
 
 $row = mysqli_fetch_assoc($sql);
 $event_title = escapeHtml($row['event_title']);
@@ -78,7 +79,7 @@ ob_start();
                         <select class="form-control select2" name="calendar" required>
                             <?php
 
-                            $sql_calendars_select = mysqli_query($mysqli, "SELECT * FROM calendars ORDER BY calendar_name ASC");
+                            $sql_calendars_select = mysqli_query($mysqli, "SELECT calendar_color, calendar_id, calendar_name FROM calendars ORDER BY calendar_name ASC");
                             while ($row = mysqli_fetch_assoc($sql_calendars_select)) {
                                 $calendar_id_select = intval($row['calendar_id']);
                                 $calendar_name_select = escapeHtml($row['calendar_name']);
@@ -212,7 +213,7 @@ ob_start();
                                 <option value="">- Client -</option>
                                 <?php
 
-                                $sql_clients = mysqli_query($mysqli, "SELECT * FROM clients LEFT JOIN contacts ON clients.client_id = contacts.contact_client_id AND contact_primary = 1 ORDER BY client_name ASC");
+                                $sql_clients = mysqli_query($mysqli, "SELECT client_id, client_name, contact_email FROM clients LEFT JOIN contacts ON clients.client_id = contacts.contact_client_id AND contact_primary = 1 ORDER BY client_name ASC");
                                 while ($row = mysqli_fetch_assoc($sql_clients)) {
                                     $client_id_select = intval($row['client_id']);
                                     $client_name_select = escapeHtml($row['client_name']);
@@ -241,7 +242,7 @@ ob_start();
 
     </div>
     <div class="modal-footer">
-        <a class="btn btn-default text-danger mr-auto confirm-link" href="post.php?delete_event=<?= $event_id ?>&csrf_token=<?= $_SESSION['csrf_token'] ?>"><i class="fa fa-calendar-times mr-2"></i><?= empty($event_repeat) ? 'Delete' : 'Delete series' ?></a>
+        <a class="btn btn-default text-danger mr-auto" href="post.php?delete_event=<?= $event_id ?>&csrf_token=<?= $_SESSION['csrf_token'] ?>"><i class="fa fa-calendar-times mr-2"></i><?= empty($event_repeat) ? 'Delete' : 'Delete series' ?></a>
         <button type="submit" name="edit_event" class="btn btn-primary text-bold"><i class="fa fa-check mr-2"></i>Save</button>
         <button type="button" class="btn btn-light" data-dismiss="modal"><i class="fa fa-times mr-2"></i>Cancel</button>
     </div>
diff --git a/agent/modals/calendar/calendar_share.php b/agent/modals/calendar/calendar_share.php
index a2aa25abf..4a12ae21f 100644
--- a/agent/modals/calendar/calendar_share.php
+++ b/agent/modals/calendar/calendar_share.php
@@ -4,7 +4,8 @@ require_once '../../../includes/modal_header.php';
 
 $calendar_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM calendars WHERE calendar_id = $calendar_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT calendar_color, calendar_feed_accessed_at, calendar_feed_busy_only,
+    calendar_feed_created_at, calendar_feed_key, calendar_name FROM calendars WHERE calendar_id = $calendar_id LIMIT 1");
 
 $row = mysqli_fetch_assoc($sql);
 $calendar_name = escapeHtml($row['calendar_name']);
diff --git a/agent/modals/certificate/certificate_add.php b/agent/modals/certificate/certificate_add.php
index 6fb80d1dd..4b8c9dedc 100644
--- a/agent/modals/certificate/certificate_add.php
+++ b/agent/modals/certificate/certificate_add.php
@@ -50,7 +50,7 @@ ob_start();
                                 <option value="">- Select Client -</option>
                                 <?php
 
-                                $sql = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients WHERE client_archived_at IS NULL $access_permission_query ORDER BY client_name ASC");
+                                $sql = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients WHERE client_archived_at IS NULL " . clientScopeSql('clients.client_id') . " ORDER BY client_name ASC");
                                 while ($row = mysqli_fetch_assoc($sql)) {
                                     $client_id_select = intval($row['client_id']);
                                     $client_name = escapeHtml($row['client_name']); ?>
@@ -93,7 +93,7 @@ ob_start();
                         <select class="form-control select2" name="domain_id">
                             <option value="">- Domain -</option>
                             <?php
-                            $domains_sql = mysqli_query($mysqli, "SELECT * FROM domains WHERE domain_archived_at IS NULL AND domain_client_id = $client_id ORDER BY domain_name ASC");
+                            $domains_sql = mysqli_query($mysqli, "SELECT domain_id, domain_name FROM domains WHERE domain_archived_at IS NULL AND domain_client_id = $client_id ORDER BY domain_name ASC");
                             while ($domain_row = mysqli_fetch_assoc($domains_sql)) {
                                 $domain_id = intval($domain_row['domain_id']);
                                 $domain_name = escapeHtml($domain_row['domain_name']);
diff --git a/agent/modals/certificate/certificate_edit.php b/agent/modals/certificate/certificate_edit.php
index 7121296fa..a02cfa9cd 100644
--- a/agent/modals/certificate/certificate_edit.php
+++ b/agent/modals/certificate/certificate_edit.php
@@ -6,7 +6,9 @@ enforceUserPermission('module_support', 2);
 
 $certificate_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM certificates WHERE certificate_id = $certificate_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT certificate_client_id, certificate_created_at, certificate_description, certificate_domain,
+    certificate_domain_id, certificate_expire, certificate_issued_by, certificate_name,
+    certificate_notes, certificate_public_key FROM certificates WHERE certificate_id = $certificate_id LIMIT 1");
 
 $row = mysqli_fetch_assoc($sql);
 $certificate_name = escapeHtml($row['certificate_name']);
@@ -20,7 +22,8 @@ $certificate_expire = escapeHtml($row['certificate_expire']);
 $certificate_created_at = escapeHtml($row['certificate_created_at']);
 $client_id = intval($row['certificate_client_id']);
 
-$history_sql = mysqli_query($mysqli, "SELECT * FROM certificate_history WHERE certificate_history_certificate_id = $certificate_id");
+$history_sql = mysqli_query($mysqli, "SELECT certificate_history_column, certificate_history_modified_at, certificate_history_new_value,
+    certificate_history_old_value FROM certificate_history WHERE certificate_history_certificate_id = $certificate_id");
 
 enforceClientAccess();
 
diff --git a/agent/modals/client/client_add.php b/agent/modals/client/client_add.php
index 0a43ac4aa..1d9d59406 100644
--- a/agent/modals/client/client_add.php
+++ b/agent/modals/client/client_add.php
@@ -6,9 +6,9 @@ require_once '../../../includes/modal_header.php';
 $leads_filter = intval($_GET['lead'] ?? 0);
 
 // Selects
-$referral_sql = mysqli_query($mysqli, "SELECT * FROM categories WHERE category_type = 'Referral' AND category_archived_at IS NULL ORDER BY category_name ASC");
+$referral_sql = mysqli_query($mysqli, "SELECT category_name FROM categories WHERE category_type = 'Referral' AND category_archived_at IS NULL ORDER BY category_name ASC");
 
-$sql_tags_select = mysqli_query($mysqli, "SELECT * FROM tags WHERE tag_type = 1 ORDER BY tag_name ASC");
+$sql_tags_select = mysqli_query($mysqli, "SELECT tag_id, tag_name FROM tags WHERE tag_type = 1 ORDER BY tag_name ASC");
 
 $net_terms_array = array (
     '0'=>'On Receipt',
diff --git a/agent/modals/client/client_bulk_add_ticket.php b/agent/modals/client/client_bulk_add_ticket.php
index 026998f0a..73f117021 100644
--- a/agent/modals/client/client_bulk_add_ticket.php
+++ b/agent/modals/client/client_bulk_add_ticket.php
@@ -118,7 +118,7 @@ ob_start();
                             <option value="0">- None -</option>
                             <?php
 
-                            $sql_projects = mysqli_query($mysqli, "SELECT * FROM projects WHERE project_completed_at IS NULL AND project_archived_at IS NULL ORDER BY project_name ASC");
+                            $sql_projects = mysqli_query($mysqli, "SELECT project_id, project_name FROM projects WHERE project_completed_at IS NULL AND project_archived_at IS NULL ORDER BY project_name ASC");
                             while ($row = mysqli_fetch_assoc($sql_projects)) {
                                 $project_id_select = intval($row['project_id']);
                                 $project_name_select = escapeHtml($row['project_name']); ?>
diff --git a/agent/modals/client/client_bulk_assign_tags.php b/agent/modals/client/client_bulk_assign_tags.php
index 202ad5f96..2a804bf8a 100644
--- a/agent/modals/client/client_bulk_assign_tags.php
+++ b/agent/modals/client/client_bulk_assign_tags.php
@@ -38,7 +38,7 @@ ob_start();
                 <select class="form-control select2" name="bulk_tags[]" data-placeholder="Add some tags" multiple>
                     <?php
 
-                    $sql_tags_select = mysqli_query($mysqli, "SELECT * FROM tags WHERE tag_type = 1 ORDER BY tag_name ASC");
+                    $sql_tags_select = mysqli_query($mysqli, "SELECT tag_id, tag_name FROM tags WHERE tag_type = 1 ORDER BY tag_name ASC");
                     while ($row = mysqli_fetch_assoc($sql_tags_select)) {
                         $tag_id_select = intval($row['tag_id']);
                         $tag_name_select = escapeHtml($row['tag_name']);
diff --git a/agent/modals/client/client_bulk_edit_referral.php b/agent/modals/client/client_bulk_edit_referral.php
index a1598335d..17a50d5e1 100644
--- a/agent/modals/client/client_bulk_edit_referral.php
+++ b/agent/modals/client/client_bulk_edit_referral.php
@@ -31,7 +31,7 @@ ob_start();
                 <select class="form-control select2" name="bulk_referral">
                     <option value="">- Select a Referral -</option>
                     <?php
-                    $referral_sql = mysqli_query($mysqli, "SELECT * FROM categories WHERE category_type = 'Referral' AND category_archived_at IS NULL ORDER BY category_name ASC");
+                    $referral_sql = mysqli_query($mysqli, "SELECT category_name FROM categories WHERE category_type = 'Referral' AND category_archived_at IS NULL ORDER BY category_name ASC");
                     while ($row = mysqli_fetch_assoc($referral_sql)) {
                         $referral = escapeHtml($row['category_name']); ?>
                         <option><?= $referral ?></option>
diff --git a/agent/modals/client/client_download_pdf.php b/agent/modals/client/client_download_pdf.php
index 312918f48..81a6aebc2 100644
--- a/agent/modals/client/client_download_pdf.php
+++ b/agent/modals/client/client_download_pdf.php
@@ -12,168 +12,7 @@
                 <input type="hidden" name="client_id" value="<?= $client_id ?>">
                 <div class="modal-body">
                     <ul class="list-group">
-                        <div class="row">
-                            <div class="col-sm-6">
-
-                                <li class="list-group-item">
-                                    <div class="custom-control custom-checkbox">
-                                        <input class="custom-control-input" type="checkbox" id="contacts" name="export_contacts" value="1" checked>
-                                        <label for="contacts" class="custom-control-label">
-                                            <i class='fas fa-fw fa-users mr-2'></i>Contacts
-                                        </label>
-                                    </div>
-                                </li>
-
-                                <li class="list-group-item">
-                                    <div class="custom-control custom-checkbox">
-                                        <input class="custom-control-input" type="checkbox" id="locations" name="export_locations" value="1" checked>
-                                        <label for="locations" class="custom-control-label">
-                                            <i class='fas fa-fw fa-map-marker-alt mr-2'></i>Locations
-                                        </label>
-                                    </div>
-                                </li>
-
-                                <li class="list-group-item">
-                                    <div class="custom-control custom-checkbox">
-                                        <input class="custom-control-input" type="checkbox" id="assets" name="export_assets" value="1" checked>
-                                        <label for="assets" class="custom-control-label">
-                                            <i class='fas fa-fw fa-desktop mr-2'></i>Assets
-                                        </label>
-                                    </div>
-                                </li>
-
-                                <li class="list-group-item">
-                                    <div class="custom-control custom-checkbox">
-                                        <input class="custom-control-input" type="checkbox" id="software" name="export_software" value="1" checked>
-                                        <label for="software" class="custom-control-label">
-                                            <i class='fas fa-fw fa-cube mr-2'></i>Software / Licenses
-                                        </label>
-                                    </div>
-                                </li>
-
-                                <li class="list-group-item">
-                                    <div class="custom-control custom-checkbox">
-                                        <input class="custom-control-input" type="checkbox" id="credentials" name="export_credentials" value="1">
-                                        <label for="credentials" class="custom-control-label">
-                                            <i class='fas fa-fw fa-key mr-2'></i>Credentials
-                                        </label>
-                                    </div>
-                                </li>
-
-                                <li class="list-group-item">
-                                    <div class="custom-control custom-checkbox">
-                                        <input class="custom-control-input" type="checkbox" id="networks" name="export_networks" value="1" checked>
-                                        <label for="networks" class="custom-control-label">
-                                            <i class='fas fa-fw fa-network-wired mr-2'></i>Networks
-                                        </label>
-                                    </div>
-                                </li>
-
-                                <li class="list-group-item">
-                                    <div class="custom-control custom-checkbox">
-                                        <input class="custom-control-input" type="checkbox" id="certificates" name="export_certificates" value="1" checked>
-                                        <label for="certificates" class="custom-control-label">
-                                            <i class='fas fa-fw fa-lock mr-2'></i>Certificates
-                                        </label>
-                                    </div>
-                                </li>
-
-                                <li class="list-group-item">
-                                    <div class="custom-control custom-checkbox">
-                                        <input class="custom-control-input" type="checkbox" id="domains" name="export_domains" value="1" checked>
-                                        <label for="domains" class="custom-control-label">
-                                            <i class='fas fa-fw fa-globe mr-2'></i>Domains
-                                        </label>
-                                    </div>
-                                </li>
-
-                                <li class="list-group-item">
-                                    <div class="custom-control custom-checkbox">
-                                        <input class="custom-control-input" type="checkbox" id="tickets" name="export_tickets" value="1" checked>
-                                        <label for="tickets" class="custom-control-label">
-                                            <i class='fas fa-fw fa-life-ring mr-2'></i>Tickets
-                                        </label>
-                                    </div>
-                                </li>
-
-                            </div>
-
-                            <div class="col-sm-6">
-
-                                <li class="list-group-item">
-                                    <div class="custom-control custom-checkbox">
-                                        <input class="custom-control-input" type="checkbox" id="recurring_tickets" name="export_recurring_tickets" value="1" checked>
-                                        <label for="recurring_tickets" class="custom-control-label">
-                                            <i class='fas fa-fw fa-clock mr-2'></i>Recurring Tickets
-                                        </label>
-                                    </div>
-                                </li>
-
-                                <li class="list-group-item">
-                                    <div class="custom-control custom-checkbox">
-                                        <input class="custom-control-input" type="checkbox" id="vendors" name="export_vendors" value="1" checked>
-                                        <label for="vendors" class="custom-control-label">
-                                            <i class='fas fa-fw fa-building mr-2'></i>Vendors
-                                        </label>
-                                    </div>
-                                </li>
-
-                                <li class="list-group-item">
-                                    <div class="custom-control custom-checkbox">
-                                        <input class="custom-control-input" type="checkbox" id="invoices" name="export_invoices" value="1" checked>
-                                        <label for="invoices" class="custom-control-label">
-                                            <i class='fas fa-fw fa-file-invoice mr-2'></i>Invoices
-                                        </label>
-                                    </div>
-                                </li>
-
-                                <li class="list-group-item">
-                                    <div class="custom-control custom-checkbox">
-                                        <input class="custom-control-input" type="checkbox" id="recurring_invoices" name="export_recurring_invoices" value="1" checked>
-                                        <label for="recurring_invoices" class="custom-control-label">
-                                            <i class='fas fa-fw fa-sync mr-2'></i>Recurring Invoices
-                                        </label>
-                                    </div>
-                                </li>
-
-                                <li class="list-group-item">
-                                    <div class="custom-control custom-checkbox">
-                                        <input class="custom-control-input" type="checkbox" id="quotes" name="export_quotes" value="1" checked>
-                                        <label for="quotes" class="custom-control-label">
-                                            <i class='fas fa-fw fa-file mr-2'></i>Quotes
-                                        </label>
-                                    </div>
-                                </li>
-
-                                <li class="list-group-item">
-                                    <div class="custom-control custom-checkbox">
-                                        <input class="custom-control-input" type="checkbox" id="payments" name="export_payments" value="1" checked>
-                                        <label for="payments" class="custom-control-label">
-                                            <i class='fas fa-fw fa-credit-card mr-2'></i>Payments
-                                        </label>
-                                    </div>
-                                </li>
-
-                                <li class="list-group-item">
-                                    <div class="custom-control custom-checkbox">
-                                        <input class="custom-control-input" type="checkbox" id="trips" name="export_trips" value="1" checked>
-                                        <label for="trips" class="custom-control-label">
-                                            <i class='fas fa-fw fa-route mr-2'></i>Trips
-                                        </label>
-                                    </div>
-                                </li>
-
-                                <li class="list-group-item">
-                                    <div class="custom-control custom-checkbox">
-                                        <input class="custom-control-input" type="checkbox" id="logs" name="export_logs" value="1" checked>
-                                        <label for="logs" class="custom-control-label">
-                                            <i class='fas fa-fw fa-eye mr-2'></i>Audit Log
-                                        </label>
-                                    </div>
-                                </li>
-
-                            </div>
-                        </div>
+                        <?php renderClientPackSections(); ?>
                     </ul>
                 </div>
                 <div class="modal-footer">
diff --git a/agent/modals/client/client_edit.php b/agent/modals/client/client_edit.php
index 175c2a56e..8336e6684 100644
--- a/agent/modals/client/client_edit.php
+++ b/agent/modals/client/client_edit.php
@@ -8,7 +8,9 @@ $client_id = intval($_GET['id']);
 
 enforceClientAccess();
 
-$sql = mysqli_query($mysqli, "SELECT * FROM clients WHERE client_id = $client_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT client_abbreviation, client_archived_at, client_created_at, client_lead, client_name,
+    client_net_terms, client_notes, client_rate, client_referral, client_tax_id_number,
+    client_type, client_website FROM clients WHERE client_id = $client_id LIMIT 1");
 
 $row = mysqli_fetch_assoc($sql);
 $client_name = escapeHtml($row['client_name']);
@@ -132,7 +134,7 @@ ob_start();
                             <option value="">- Select Referral -</option>
                             <?php
 
-                            $referral_sql = mysqli_query($mysqli, "SELECT * FROM categories WHERE category_type = 'Referral' AND (category_archived_at > '$client_created_at' OR category_archived_at IS NULL) ORDER BY category_name ASC");
+                            $referral_sql = mysqli_query($mysqli, "SELECT category_name FROM categories WHERE category_type = 'Referral' AND (category_archived_at > '$client_created_at' OR category_archived_at IS NULL) ORDER BY category_name ASC");
                             while ($row = mysqli_fetch_assoc($referral_sql)) {
                                 $referral = escapeHtml($row['category_name']);
                                 ?>
@@ -175,7 +177,7 @@ ob_start();
                         <select class="form-control select2" name="tags[]" data-placeholder="Add some tags" multiple>
                             <?php
 
-                            $sql_tags_select = mysqli_query($mysqli, "SELECT * FROM tags WHERE tag_type = 1 ORDER BY tag_name ASC");
+                            $sql_tags_select = mysqli_query($mysqli, "SELECT tag_id, tag_name FROM tags WHERE tag_type = 1 ORDER BY tag_name ASC");
                             while ($row = mysqli_fetch_assoc($sql_tags_select)) {
                                 $tag_id_select = intval($row['tag_id']);
                                 $tag_name_select = escapeHtml($row['tag_name']);
diff --git a/agent/modals/contact/contact.php b/agent/modals/contact/contact.php
index 1e7941128..c0027ac40 100644
--- a/agent/modals/contact/contact.php
+++ b/agent/modals/contact/contact.php
@@ -6,7 +6,13 @@ enforceUserPermission('module_client');
 
 $contact_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM contacts
+$sql = mysqli_query($mysqli, "SELECT client_id, client_name, contact_billing, contact_client_id, contact_created_at,
+    contact_department, contact_email, contact_extension, contact_important,
+    contact_location_id, contact_mobile, contact_mobile_country_code, contact_name,
+    contact_notes, contact_phone, contact_phone_country_code, contact_photo, contact_pin,
+    contact_primary, contact_technical, contact_title, location_address, location_city,
+    location_country, location_name, location_phone, location_phone_country_code,
+    location_state, location_zip, user_auth_method FROM contacts
     LEFT JOIN clients ON client_id = contact_client_id
     LEFT JOIN locations ON location_id = contact_location_id
     LEFT JOIN users ON user_id = contact_user_id
@@ -52,7 +58,8 @@ $auth_method = escapeHtml($row['user_auth_method']);
 $contact_client_id = intval($row['contact_client_id']);
 
 // Related Assets Query - 1 to 1 relationship
-$sql_related_assets = mysqli_query($mysqli, "SELECT * FROM assets
+$sql_related_assets = mysqli_query($mysqli, "SELECT asset_description, asset_favorite, asset_id, asset_install_date, asset_make, asset_model,
+    asset_name, asset_serial, asset_status, asset_type FROM assets
     LEFT JOIN asset_interfaces ON interface_asset_id = asset_id AND interface_primary = 1
     LEFT JOIN asset_tags ON asset_tag_asset_id = asset_id
     LEFT JOIN tags ON tag_id = asset_tag_tag_id
@@ -63,7 +70,8 @@ $sql_related_assets = mysqli_query($mysqli, "SELECT * FROM assets
 $asset_count = mysqli_num_rows($sql_related_assets);
 
 // Linked Software Licenses
-$sql_linked_software = mysqli_query($mysqli, "SELECT * FROM software_contacts, software
+$sql_linked_software = mysqli_query($mysqli, "SELECT software.software_id, software_key, software_name, software_seats, software_type,
+    software_version FROM software_contacts, software
     WHERE software_contacts.contact_id = $contact_id
     AND software_contacts.software_id = software.software_id
     AND software_archived_at IS NULL
@@ -89,7 +97,9 @@ $sql_related_credentials = mysqli_query($mysqli, "
 $credential_count = mysqli_num_rows($sql_related_credentials);
 
 // Related Tickets Query - 1 to 1 relationship
-$sql_related_tickets = mysqli_query($mysqli, "SELECT * FROM tickets
+$sql_related_tickets = mysqli_query($mysqli, "SELECT ticket_assigned_to, ticket_created_at, ticket_id, ticket_number, ticket_prefix,
+    ticket_priority, ticket_status, ticket_status_color, ticket_status_name, ticket_subject,
+    ticket_updated_at, user_name FROM tickets
     LEFT JOIN users ON ticket_assigned_to = user_id
     LEFT JOIN ticket_statuses ON ticket_status = ticket_status_id
     WHERE ticket_contact_id = $contact_id
@@ -98,7 +108,8 @@ $sql_related_tickets = mysqli_query($mysqli, "SELECT * FROM tickets
 $ticket_count = mysqli_num_rows($sql_related_tickets);
 
 // Related Recurring Tickets Query
-$sql_related_recurring_tickets = mysqli_query($mysqli, "SELECT * FROM recurring_tickets
+$sql_related_recurring_tickets = mysqli_query($mysqli, "SELECT recurring_ticket_frequency, recurring_ticket_next_run, recurring_ticket_priority,
+    recurring_ticket_subject FROM recurring_tickets
     WHERE recurring_ticket_contact_id = $contact_id
     ORDER BY recurring_ticket_next_run DESC"
 );
@@ -107,7 +118,7 @@ $recurring_ticket_count = mysqli_num_rows($sql_related_recurring_tickets);
 // Tags - many to many relationship
 $contact_tag_name_display_array = array();
 $contact_tag_id_array = array();
-$sql_contact_tags = mysqli_query($mysqli, "SELECT * FROM contact_tags
+$sql_contact_tags = mysqli_query($mysqli, "SELECT tag_color, tag_icon, contact_tags.tag_id, tag_name FROM contact_tags
     LEFT JOIN tags ON contact_tags.tag_id = tags.tag_id
     WHERE contact_id = $contact_id
     ORDER BY tag_name ASC
@@ -131,7 +142,7 @@ while ($row = mysqli_fetch_assoc($sql_contact_tags)) {
 $contact_tags_display = implode('', $contact_tag_name_display_array);
 
 // Notes - 1 to 1 relationship
-$sql_related_notes = mysqli_query($mysqli, "SELECT * FROM contact_notes
+$sql_related_notes = mysqli_query($mysqli, "SELECT contact_note, contact_note_created_at, contact_note_type, user_name FROM contact_notes
     LEFT JOIN users ON contact_note_created_by = user_id
     WHERE contact_note_contact_id = $contact_id
     AND contact_note_archived_at IS NULL
@@ -147,7 +158,7 @@ while ($row = mysqli_fetch_assoc($sql_note_type_icons)) {
 }
 
 // Linked Services
-$sql_linked_services = mysqli_query($mysqli, "SELECT * FROM service_contacts, services
+$sql_linked_services = mysqli_query($mysqli, "SELECT 1 FROM service_contacts, services
     WHERE service_contacts.contact_id = $contact_id
     AND service_contacts.service_id = services.service_id
     ORDER BY service_name ASC"
@@ -156,7 +167,8 @@ $services_count = mysqli_num_rows($sql_linked_services);
 $linked_services = array();
 
 // Linked Documents
-$sql_linked_documents = mysqli_query($mysqli, "SELECT * FROM contact_documents, documents
+$sql_linked_documents = mysqli_query($mysqli, "SELECT document_created_at, document_description, documents.document_id, document_name,
+    document_updated_at, user_name FROM contact_documents, documents
     LEFT JOIN users ON document_created_by = user_id
     WHERE contact_documents.contact_id = $contact_id
     AND contact_documents.document_id = documents.document_id
@@ -167,7 +179,7 @@ $document_count = mysqli_num_rows($sql_linked_documents);
 $linked_documents = array();
 
 // Linked Files
-$sql_linked_files = mysqli_query($mysqli, "SELECT * FROM contact_files, files
+$sql_linked_files = mysqli_query($mysqli, "SELECT file_created_at, file_description, files.file_id, file_mime_type, file_name, file_size FROM contact_files, files
     WHERE contact_files.contact_id = $contact_id
     AND contact_files.file_id = files.file_id
     AND file_archived_at IS NULL
@@ -475,7 +487,7 @@ ob_start();
 
                                 // Tags
                                 $asset_tag_name_display_array = array();
-                                $sql_asset_tags = mysqli_query($mysqli, "SELECT * FROM asset_tags LEFT JOIN tags ON asset_tag_tag_id = tag_id WHERE asset_tag_asset_id = $asset_id ORDER BY tag_name ASC");
+                                $sql_asset_tags = mysqli_query($mysqli, "SELECT tag_color, tag_icon, tag_id, tag_name FROM asset_tags LEFT JOIN tags ON asset_tag_tag_id = tag_id WHERE asset_tag_asset_id = $asset_id ORDER BY tag_name ASC");
                                 while ($row2 = mysqli_fetch_assoc($sql_asset_tags)) {
                                     $asset_tag_id = intval($row2['tag_id']);
                                     $asset_tag_name = escapeHtml($row2['tag_name']);
diff --git a/agent/modals/contact/contact_add.php b/agent/modals/contact/contact_add.php
index 5f7196562..294c071f3 100644
--- a/agent/modals/contact/contact_add.php
+++ b/agent/modals/contact/contact_add.php
@@ -7,7 +7,7 @@ $client_id = intval($_GET['client_id'] ?? 0);
 if ($client_id) {
      $sql_location_select = mysqli_query($mysqli, "SELECT location_id, location_name FROM locations WHERE location_archived_at IS NULL AND location_client_id = $client_id ORDER BY location_name ASC");
 } else {
-    $sql_client_select = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients WHERE client_archived_at IS NULL $access_permission_query ORDER BY client_name ASC");
+    $sql_client_select = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients WHERE client_archived_at IS NULL " . clientScopeSql('clients.client_id') . " ORDER BY client_name ASC");
 }
 
 $sql_tags_select = mysqli_query($mysqli, "SELECT tag_id, tag_name FROM tags WHERE tag_type = 3 ORDER BY tag_name ASC");
diff --git a/agent/modals/contact/contact_bulk_assign_tags.php b/agent/modals/contact/contact_bulk_assign_tags.php
index c0073af6f..4154e6582 100644
--- a/agent/modals/contact/contact_bulk_assign_tags.php
+++ b/agent/modals/contact/contact_bulk_assign_tags.php
@@ -37,7 +37,7 @@ ob_start();
                 <select class="form-control select2" name="bulk_tags[]" data-placeholder="Add some tags" multiple>
                     <?php
 
-                    $sql_tags_select = mysqli_query($mysqli, "SELECT * FROM tags WHERE tag_type = 3 ORDER BY tag_name ASC");
+                    $sql_tags_select = mysqli_query($mysqli, "SELECT tag_id, tag_name FROM tags WHERE tag_type = 3 ORDER BY tag_name ASC");
                     while ($row = mysqli_fetch_assoc($sql_tags_select)) {
                         $tag_id_select = intval($row['tag_id']);
                         $tag_name_select = escapeHtml($row['tag_name']);
diff --git a/agent/modals/contact/contact_edit.php b/agent/modals/contact/contact_edit.php
index d1c5ac1f8..ec9285101 100644
--- a/agent/modals/contact/contact_edit.php
+++ b/agent/modals/contact/contact_edit.php
@@ -6,7 +6,11 @@ enforceUserPermission('module_client', 2);
 
 $contact_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM contacts
+$sql = mysqli_query($mysqli, "SELECT contact_archived_at, contact_billing, contact_client_id, contact_created_at,
+    contact_department, contact_email, contact_extension, contact_important,
+    contact_location_id, contact_mobile, contact_mobile_country_code, contact_name,
+    contact_notes, contact_phone, contact_phone_country_code, contact_photo, contact_pin,
+    contact_primary, contact_technical, contact_title, contact_user_id, user_auth_method FROM contacts
     LEFT JOIN users ON user_id = contact_user_id
     WHERE contact_id = $contact_id
     LIMIT 1"
@@ -174,7 +178,7 @@ ob_start();
                             <option value="">- Select Location -</option>
                             <?php
 
-                            $sql_locations = mysqli_query($mysqli, "SELECT * FROM locations WHERE location_id = $contact_location_id OR location_archived_at IS NULL AND location_client_id = $client_id ORDER BY location_name ASC");
+                            $sql_locations = mysqli_query($mysqli, "SELECT location_archived_at, location_id, location_name FROM locations WHERE location_id = $contact_location_id OR location_archived_at IS NULL AND location_client_id = $client_id ORDER BY location_name ASC");
                             while ($row = mysqli_fetch_assoc($sql_locations)) {
                                 $location_id_select = intval($row['location_id']);
                                 $location_name_select = escapeHtml($row['location_name']);
@@ -318,7 +322,7 @@ ob_start();
                         <select class="form-control select2" name="tags[]" data-placeholder="Add some tags" multiple>
                             <?php
 
-                            $sql_tags_select = mysqli_query($mysqli, "SELECT * FROM tags WHERE tag_type = 3 ORDER BY tag_name ASC");
+                            $sql_tags_select = mysqli_query($mysqli, "SELECT tag_id, tag_name FROM tags WHERE tag_type = 3 ORDER BY tag_name ASC");
                             while ($row = mysqli_fetch_assoc($sql_tags_select)) {
                                 $tag_id_select = intval($row['tag_id']);
                                 $tag_name_select = escapeHtml($row['tag_name']);
diff --git a/agent/modals/contact/contact_link_asset.php b/agent/modals/contact/contact_link_asset.php
index e24d166a2..4a10e2324 100644
--- a/agent/modals/contact/contact_link_asset.php
+++ b/agent/modals/contact/contact_link_asset.php
@@ -4,7 +4,7 @@ require_once '../../../includes/modal_header.php';
 
 $contact_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM contacts
+$sql = mysqli_query($mysqli, "SELECT contact_client_id, contact_name FROM contacts
     WHERE contact_id = $contact_id
     LIMIT 1
 ");
diff --git a/agent/modals/contact/contact_link_credential.php b/agent/modals/contact/contact_link_credential.php
index 7e941e303..e583e6fcd 100644
--- a/agent/modals/contact/contact_link_credential.php
+++ b/agent/modals/contact/contact_link_credential.php
@@ -4,7 +4,7 @@ require_once '../../../includes/modal_header.php';
 
 $contact_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM contacts
+$sql = mysqli_query($mysqli, "SELECT contact_client_id, contact_name FROM contacts
     WHERE contact_id = $contact_id
     LIMIT 1
 ");
diff --git a/agent/modals/contact/contact_link_document.php b/agent/modals/contact/contact_link_document.php
index c361c081d..a4a970e3b 100644
--- a/agent/modals/contact/contact_link_document.php
+++ b/agent/modals/contact/contact_link_document.php
@@ -4,7 +4,7 @@ require_once '../../../includes/modal_header.php';
 
 $contact_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM contacts
+$sql = mysqli_query($mysqli, "SELECT contact_client_id, contact_name FROM contacts
     WHERE contact_id = $contact_id
     LIMIT 1
 ");
diff --git a/agent/modals/contact/contact_link_file.php b/agent/modals/contact/contact_link_file.php
index b8bfd9a4a..633f8817a 100644
--- a/agent/modals/contact/contact_link_file.php
+++ b/agent/modals/contact/contact_link_file.php
@@ -4,7 +4,7 @@ require_once '../../../includes/modal_header.php';
 
 $contact_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM contacts
+$sql = mysqli_query($mysqli, "SELECT contact_client_id, contact_name FROM contacts
     WHERE contact_id = $contact_id
     LIMIT 1
 ");
diff --git a/agent/modals/contact/contact_link_service.php b/agent/modals/contact/contact_link_service.php
index c9e0eb94d..729a03a2e 100644
--- a/agent/modals/contact/contact_link_service.php
+++ b/agent/modals/contact/contact_link_service.php
@@ -4,7 +4,7 @@ require_once '../../../includes/modal_header.php';
 
 $contact_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM contacts
+$sql = mysqli_query($mysqli, "SELECT contact_client_id, contact_name FROM contacts
     WHERE contact_id = $contact_id
     LIMIT 1
 ");
diff --git a/agent/modals/contact/contact_link_software.php b/agent/modals/contact/contact_link_software.php
index f55a517d1..5521186c3 100644
--- a/agent/modals/contact/contact_link_software.php
+++ b/agent/modals/contact/contact_link_software.php
@@ -4,7 +4,7 @@ require_once '../../../includes/modal_header.php';
 
 $contact_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM contacts
+$sql = mysqli_query($mysqli, "SELECT contact_client_id, contact_name FROM contacts
     WHERE contact_id = $contact_id
     LIMIT 1
 ");
diff --git a/agent/modals/credential/credential_add.php b/agent/modals/credential/credential_add.php
index 7e0f4035e..9cc63d768 100644
--- a/agent/modals/credential/credential_add.php
+++ b/agent/modals/credential/credential_add.php
@@ -54,7 +54,7 @@ ob_start();
                                 <option value="">- Select Client -</option>
                                 <?php
 
-                                $sql = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients WHERE client_archived_at IS NULL $access_permission_query ORDER BY client_name ASC");
+                                $sql = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients WHERE client_archived_at IS NULL " . clientScopeSql('clients.client_id') . " ORDER BY client_name ASC");
                                 while ($row = mysqli_fetch_assoc($sql)) {
                                     $client_id_select = intval($row['client_id']);
                                     $client_name = escapeHtml($row['client_name']); ?>
@@ -167,7 +167,7 @@ ob_start();
                             <option value="">- Select Contact -</option>
                             <?php
 
-                            $sql = mysqli_query($mysqli, "SELECT * FROM contacts WHERE contact_client_id = $client_id ORDER BY contact_name ASC");
+                            $sql = mysqli_query($mysqli, "SELECT contact_id, contact_name FROM contacts WHERE contact_client_id = $client_id ORDER BY contact_name ASC");
                             while ($row = mysqli_fetch_assoc($sql)) {
                                 $contact_id_select = intval($row['contact_id']);
                                 $contact_name = escapeHtml($row['contact_name']);
@@ -194,7 +194,7 @@ ob_start();
                             <option value="">- Select Asset -</option>
                             <?php
 
-                            $sql = mysqli_query($mysqli, "SELECT * FROM assets LEFT JOIN locations on asset_location_id = location_id WHERE asset_client_id = $client_id AND asset_archived_at IS NULL ORDER BY asset_name ASC");
+                            $sql = mysqli_query($mysqli, "SELECT asset_id, asset_name, location_name FROM assets LEFT JOIN locations on asset_location_id = location_id WHERE asset_client_id = $client_id AND asset_archived_at IS NULL ORDER BY asset_name ASC");
                             while ($row = mysqli_fetch_assoc($sql)) {
                                 $asset_id_select = intval($row['asset_id']);
                                 $asset_name = escapeHtml($row['asset_name']);
@@ -233,7 +233,7 @@ ob_start();
                         <select class="form-control select2" name="tags[]" data-placeholder="Add some tags" multiple>
                             <?php
 
-                            $sql_tags_select = mysqli_query($mysqli, "SELECT * FROM tags WHERE tag_type = 4 ORDER BY tag_name ASC");
+                            $sql_tags_select = mysqli_query($mysqli, "SELECT tag_id, tag_name FROM tags WHERE tag_type = 4 ORDER BY tag_name ASC");
                             while ($row = mysqli_fetch_assoc($sql_tags_select)) {
                                 $tag_id_select = intval($row['tag_id']);
                                 $tag_name_select = escapeHtml($row['tag_name']);
diff --git a/agent/modals/credential/credential_bulk_assign_tags.php b/agent/modals/credential/credential_bulk_assign_tags.php
index 07bec33ad..8b31671c4 100644
--- a/agent/modals/credential/credential_bulk_assign_tags.php
+++ b/agent/modals/credential/credential_bulk_assign_tags.php
@@ -36,7 +36,7 @@ ob_start();
                 <select class="form-control select2" name="bulk_tags[]" data-placeholder="Add some tags" multiple>
                     <?php
 
-                    $sql_tags_select = mysqli_query($mysqli, "SELECT * FROM tags WHERE tag_type = 4 ORDER BY tag_name ASC");
+                    $sql_tags_select = mysqli_query($mysqli, "SELECT tag_id, tag_name FROM tags WHERE tag_type = 4 ORDER BY tag_name ASC");
                     while ($row = mysqli_fetch_assoc($sql_tags_select)) {
                         $tag_id_select = intval($row['tag_id']);
                         $tag_name_select = escapeHtml($row['tag_name']);
diff --git a/agent/modals/credential/credential_edit.php b/agent/modals/credential/credential_edit.php
index 91635c576..408483337 100644
--- a/agent/modals/credential/credential_edit.php
+++ b/agent/modals/credential/credential_edit.php
@@ -6,7 +6,10 @@ enforceUserPermission('module_credential', 2);
 
 $credential_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM credentials WHERE credential_id = $credential_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT credential_archived_at, credential_asset_id, credential_client_id, credential_contact_id,
+    credential_created_at, credential_description, credential_favorite, credential_name,
+    credential_note, credential_otp_secret, credential_password, credential_uri,
+    credential_uri_2, credential_username FROM credentials WHERE credential_id = $credential_id LIMIT 1");
 
 $row = mysqli_fetch_assoc($sql);
 $client_id = intval($row['credential_client_id']);
diff --git a/agent/modals/document/document_add_file_relation.php b/agent/modals/document/document_add_file_relation.php
index 9834793bf..85c03ff54 100644
--- a/agent/modals/document/document_add_file_relation.php
+++ b/agent/modals/document/document_add_file_relation.php
@@ -20,7 +20,7 @@
                             <select class="form-control select2" name="file_id">
                                 <option value="">- Select a File -</option>
                                 <?php
-                                $sql_files_select = mysqli_query($mysqli, "SELECT * FROM files
+                                $sql_files_select = mysqli_query($mysqli, "SELECT file_id, file_name, folder_name FROM files
                                     LEFT JOIN folders ON folder_id = file_folder_id
                                     WHERE file_client_id = $client_id ORDER BY folder_name ASC, file_name ASC");
                                 while ($row = mysqli_fetch_assoc($sql_files_select)) {
diff --git a/agent/modals/document/document_add_from_template.php b/agent/modals/document/document_add_from_template.php
index a70fb42c0..96b63aa10 100644
--- a/agent/modals/document/document_add_from_template.php
+++ b/agent/modals/document/document_add_from_template.php
@@ -35,7 +35,7 @@ ob_start();
                 <select class="form-control" name="document_template_id" required>
                     <option value="">- Select Template -</option>
                     <?php
-                    $sql_document_templates = mysqli_query($mysqli, "SELECT * FROM document_templates WHERE document_template_archived_at IS NULL ORDER BY document_template_name ASC");
+                    $sql_document_templates = mysqli_query($mysqli, "SELECT document_template_id, document_template_name FROM document_templates WHERE document_template_archived_at IS NULL ORDER BY document_template_name ASC");
                     while ($row = mysqli_fetch_assoc($sql_document_templates)) {
                         $document_template_id = intval($row['document_template_id']);
                         $document_template_name = escapeHtml($row['document_template_name']);
@@ -77,7 +77,7 @@ ob_start();
                 <select class="form-control" name="folder">
                     <option value="0">/</option>
                     <?php
-                    $sql_folders = mysqli_query($mysqli, "SELECT * FROM folders WHERE folder_client_id = $client_id ORDER BY folder_name ASC");
+                    $sql_folders = mysqli_query($mysqli, "SELECT folder_id, folder_name FROM folders WHERE folder_client_id = $client_id ORDER BY folder_name ASC");
                     while ($row = mysqli_fetch_assoc($sql_folders)) {
                         $folder_id = intval($row['folder_id']);
                         $folder_name = escapeHtml($row['folder_name']);
diff --git a/agent/modals/document/document_edit.php b/agent/modals/document/document_edit.php
index 1a17d9eeb..2b1ada8a0 100644
--- a/agent/modals/document/document_edit.php
+++ b/agent/modals/document/document_edit.php
@@ -6,7 +6,8 @@ enforceUserPermission('module_support', 2);
 
 $document_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM documents WHERE document_id = $document_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT document_client_id, document_client_visible, document_content, document_description,
+    document_folder_id, document_name FROM documents WHERE document_id = $document_id LIMIT 1");
 
 $row = mysqli_fetch_assoc($sql);
 $document_name = escapeHtml($row['document_name']);
diff --git a/agent/modals/document/document_edit_visibility.php b/agent/modals/document/document_edit_visibility.php
index 938d281c7..e735fcd26 100644
--- a/agent/modals/document/document_edit_visibility.php
+++ b/agent/modals/document/document_edit_visibility.php
@@ -4,7 +4,7 @@ require_once '../../../includes/modal_header.php';
 
 $document_id = intval($_GET['document_id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM documents
+$sql = mysqli_query($mysqli, "SELECT document_client_id, document_client_visible, document_name FROM documents
     WHERE document_id = $document_id
     LIMIT 1
 ");
diff --git a/agent/modals/document/document_link_asset.php b/agent/modals/document/document_link_asset.php
index 799fe8e27..a34ba2585 100644
--- a/agent/modals/document/document_link_asset.php
+++ b/agent/modals/document/document_link_asset.php
@@ -4,7 +4,7 @@ require_once '../../../includes/modal_header.php';
 
 $document_id = intval($_GET['document_id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM documents
+$sql = mysqli_query($mysqli, "SELECT document_client_id, document_name FROM documents
     WHERE document_id = $document_id
     LIMIT 1
 ");
diff --git a/agent/modals/document/document_link_contact.php b/agent/modals/document/document_link_contact.php
index f7a7970f2..3cecff644 100644
--- a/agent/modals/document/document_link_contact.php
+++ b/agent/modals/document/document_link_contact.php
@@ -4,7 +4,7 @@ require_once '../../../includes/modal_header.php';
 
 $document_id = intval($_GET['document_id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM documents
+$sql = mysqli_query($mysqli, "SELECT document_client_id, document_name FROM documents
     WHERE document_id = $document_id
     LIMIT 1
 ");
diff --git a/agent/modals/document/document_link_file.php b/agent/modals/document/document_link_file.php
index 9015bde0f..c51f3b6ac 100644
--- a/agent/modals/document/document_link_file.php
+++ b/agent/modals/document/document_link_file.php
@@ -4,7 +4,7 @@ require_once '../../../includes/modal_header.php';
 
 $document_id = intval($_GET['document_id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM documents
+$sql = mysqli_query($mysqli, "SELECT document_client_id, document_name FROM documents
     WHERE document_id = $document_id
     LIMIT 1
 ");
diff --git a/agent/modals/document/document_link_software.php b/agent/modals/document/document_link_software.php
index 7a80688fc..78d0fbace 100644
--- a/agent/modals/document/document_link_software.php
+++ b/agent/modals/document/document_link_software.php
@@ -4,7 +4,7 @@ require_once '../../../includes/modal_header.php';
 
 $document_id = intval($_GET['document_id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM documents
+$sql = mysqli_query($mysqli, "SELECT document_client_id, document_name FROM documents
     WHERE document_id = $document_id
     LIMIT 1
 ");
diff --git a/agent/modals/document/document_link_vendor.php b/agent/modals/document/document_link_vendor.php
index 5301c65a6..c3d83f720 100644
--- a/agent/modals/document/document_link_vendor.php
+++ b/agent/modals/document/document_link_vendor.php
@@ -4,7 +4,7 @@ require_once '../../../includes/modal_header.php';
 
 $document_id = intval($_GET['document_id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM documents
+$sql = mysqli_query($mysqli, "SELECT document_client_id, document_name FROM documents
     WHERE document_id = $document_id
     LIMIT 1
 ");
diff --git a/agent/modals/document/document_move.php b/agent/modals/document/document_move.php
index d1a84ded9..d736bbfa5 100644
--- a/agent/modals/document/document_move.php
+++ b/agent/modals/document/document_move.php
@@ -6,7 +6,7 @@ enforceUserPermission('module_support', 2);
 
 $document_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM documents WHERE document_id = $document_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT document_client_id, document_folder_id, document_name FROM documents WHERE document_id = $document_id LIMIT 1");
 
 $row = mysqli_fetch_assoc($sql);
 $client_id = intval($row['document_client_id']);
diff --git a/agent/modals/document/document_rename.php b/agent/modals/document/document_rename.php
index cef8d6c66..54d7d0387 100644
--- a/agent/modals/document/document_rename.php
+++ b/agent/modals/document/document_rename.php
@@ -6,7 +6,7 @@ enforceUserPermission('module_support', 2);
 
 $document_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM documents WHERE document_id = $document_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT document_client_id, document_name FROM documents WHERE document_id = $document_id LIMIT 1");
 
 $row = mysqli_fetch_assoc($sql);
 $client_id = intval($row['document_client_id']);
diff --git a/agent/modals/document/document_version_view.php b/agent/modals/document/document_version_view.php
index 3ca5618ac..dc3b6a311 100644
--- a/agent/modals/document/document_version_view.php
+++ b/agent/modals/document/document_version_view.php
@@ -14,7 +14,7 @@ $purifier = new HTMLPurifier($purifier_config);
 
 $document_version_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM document_versions LEFT JOIN documents ON document_id = document_version_document_id WHERE document_version_id = $document_version_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT document_client_id, document_version_content, document_version_name FROM document_versions LEFT JOIN documents ON document_id = document_version_document_id WHERE document_version_id = $document_version_id LIMIT 1");
 
 $row = mysqli_fetch_assoc($sql);
 $document_version_name = escapeHtml($row['document_version_name']);
diff --git a/agent/modals/document/document_view.php b/agent/modals/document/document_view.php
index 20a47e2e9..e2b18a75f 100644
--- a/agent/modals/document/document_view.php
+++ b/agent/modals/document/document_view.php
@@ -14,7 +14,7 @@ $purifier = new HTMLPurifier($purifier_config);
 
 $document_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM documents WHERE document_id = $document_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT document_client_id, document_content, document_name FROM documents WHERE document_id = $document_id LIMIT 1");
 
 $row = mysqli_fetch_assoc($sql);
 $document_name = escapeHtml($row['document_name']);
diff --git a/agent/modals/domain/domain_add.php b/agent/modals/domain/domain_add.php
index 50fae188b..2fcf357b4 100644
--- a/agent/modals/domain/domain_add.php
+++ b/agent/modals/domain/domain_add.php
@@ -48,7 +48,7 @@ ob_start();
                                 <option value="">- Select Client -</option>
                                 <?php
 
-                                $sql = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients WHERE client_archived_at IS NULL $access_permission_query ORDER BY client_name ASC");
+                                $sql = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients WHERE client_archived_at IS NULL " . clientScopeSql('clients.client_id') . " ORDER BY client_name ASC");
                                 while ($row = mysqli_fetch_assoc($sql)) {
                                     $client_id_select = intval($row['client_id']);
                                     $client_name = escapeHtml($row['client_name']); ?>
@@ -95,7 +95,7 @@ ob_start();
                             <option value="">- Vendor -</option>
                             <?php
 
-                            $sql = mysqli_query($mysqli, "SELECT * FROM vendors WHERE vendor_archived_at IS NULL AND vendor_client_id = $client_id ORDER BY vendor_name ASC");
+                            $sql = mysqli_query($mysqli, "SELECT vendor_id, vendor_name FROM vendors WHERE vendor_archived_at IS NULL AND vendor_client_id = $client_id ORDER BY vendor_name ASC");
                             while ($row = mysqli_fetch_assoc($sql)) {
                                 $vendor_id = intval($row['vendor_id']);
                                 $vendor_name = escapeHtml($row['vendor_name']);
@@ -116,7 +116,7 @@ ob_start();
                             <option value="">- Vendor -</option>
                             <?php
 
-                            $sql = mysqli_query($mysqli, "SELECT * FROM vendors WHERE vendor_archived_at IS NULL AND vendor_client_id = $client_id ORDER BY vendor_name ASC");
+                            $sql = mysqli_query($mysqli, "SELECT vendor_id, vendor_name FROM vendors WHERE vendor_archived_at IS NULL AND vendor_client_id = $client_id ORDER BY vendor_name ASC");
                             while ($row = mysqli_fetch_assoc($sql)) {
                                 $vendor_id = intval($row['vendor_id']);
                                 $vendor_name = escapeHtml($row['vendor_name']);
@@ -137,7 +137,7 @@ ob_start();
                             <option value="">- Vendor -</option>
                             <?php
 
-                            $sql = mysqli_query($mysqli, "SELECT * FROM vendors WHERE vendor_archived_at IS NULL AND vendor_client_id = $client_id ORDER BY vendor_name ASC");
+                            $sql = mysqli_query($mysqli, "SELECT vendor_id, vendor_name FROM vendors WHERE vendor_archived_at IS NULL AND vendor_client_id = $client_id ORDER BY vendor_name ASC");
                             while ($row = mysqli_fetch_assoc($sql)) {
                                 $vendor_id = intval($row['vendor_id']);
                                 $vendor_name = escapeHtml($row['vendor_name']);
@@ -158,7 +158,7 @@ ob_start();
                             <option value="">- Vendor -</option>
                             <?php
 
-                            $sql = mysqli_query($mysqli, "SELECT * FROM vendors WHERE vendor_archived_at IS NULL AND vendor_client_id = $client_id ORDER BY vendor_name ASC");
+                            $sql = mysqli_query($mysqli, "SELECT vendor_id, vendor_name FROM vendors WHERE vendor_archived_at IS NULL AND vendor_client_id = $client_id ORDER BY vendor_name ASC");
                             while ($row = mysqli_fetch_assoc($sql)) {
                                 $vendor_id = intval($row['vendor_id']);
                                 $vendor_name = escapeHtml($row['vendor_name']);
diff --git a/agent/modals/domain/domain_edit.php b/agent/modals/domain/domain_edit.php
index 54b2bb188..a3b218ab1 100644
--- a/agent/modals/domain/domain_edit.php
+++ b/agent/modals/domain/domain_edit.php
@@ -6,7 +6,10 @@ enforceUserPermission('module_support', 2);
 
 $domain_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM domains WHERE domain_id = $domain_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT domain_archived_at, domain_client_id, domain_created_at, domain_description,
+    domain_dnshost, domain_expire, domain_ip, domain_mail_servers, domain_mailhost,
+    domain_name, domain_name_servers, domain_notes, domain_raw_whois, domain_registrar,
+    domain_txt, domain_webhost FROM domains WHERE domain_id = $domain_id LIMIT 1");
 
 $row = mysqli_fetch_assoc($sql);
 $domain_name = escapeHtml($row['domain_name']);
@@ -26,7 +29,8 @@ $domain_created_at = escapeHtml($row['domain_created_at']);
 $domain_archived_at = escapeHtml($row['domain_archived_at']);
 $client_id = intval($row['domain_client_id']);
 
-$history_sql = mysqli_query($mysqli, "SELECT * FROM domain_history WHERE domain_history_domain_id = $domain_id");
+$history_sql = mysqli_query($mysqli, "SELECT domain_history_column, domain_history_modified_at, domain_history_new_value,
+    domain_history_old_value FROM domain_history WHERE domain_history_domain_id = $domain_id");
 
 enforceClientAccess();
 
diff --git a/agent/modals/expense/expense_add.php b/agent/modals/expense/expense_add.php
index 32a865472..801150598 100644
--- a/agent/modals/expense/expense_add.php
+++ b/agent/modals/expense/expense_add.php
@@ -169,7 +169,7 @@ ob_start();
                             <option value="0">- Select a Client (Optional) -</option>
                             <?php
 
-                            $sql = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients WHERE client_archived_at IS NULL $access_permission_query ORDER BY client_name ASC");
+                            $sql = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients WHERE client_archived_at IS NULL " . clientScopeSql('clients.client_id') . " ORDER BY client_name ASC");
                             while ($row = mysqli_fetch_assoc($sql)) {
                                 $client_id_select = intval($row['client_id']);
                                 $client_name = escapeHtml($row['client_name']);
diff --git a/agent/modals/expense/expense_bulk_edit_client.php b/agent/modals/expense/expense_bulk_edit_client.php
index ecca45608..a0bd9f548 100644
--- a/agent/modals/expense/expense_bulk_edit_client.php
+++ b/agent/modals/expense/expense_bulk_edit_client.php
@@ -36,7 +36,7 @@ ob_start();
                     <option value="0">- No Client -</option>
                     <?php
 
-                    $sql = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients WHERE client_archived_at IS NULL $access_permission_query ORDER BY client_name ASC");
+                    $sql = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients WHERE client_archived_at IS NULL " . clientScopeSql('clients.client_id') . " ORDER BY client_name ASC");
                     while ($row = mysqli_fetch_assoc($sql)) {
                         $client_id = intval($row['client_id']);
                         $client_name = escapeHtml($row['client_name']);
diff --git a/agent/modals/expense/expense_copy.php b/agent/modals/expense/expense_copy.php
index 2ccfd7468..36f9c4a61 100644
--- a/agent/modals/expense/expense_copy.php
+++ b/agent/modals/expense/expense_copy.php
@@ -6,7 +6,9 @@ enforceUserPermission('module_financial', 2);
 
 $expense_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM expenses WHERE expense_id = $expense_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT expense_account_id, expense_amount, expense_category_id, expense_client_id,
+    expense_created_at, expense_currency_code, expense_date, expense_description,
+    expense_receipt, expense_reference, expense_vendor_id FROM expenses WHERE expense_id = $expense_id LIMIT 1");
 
 $row = mysqli_fetch_assoc($sql);
 $expense_date = escapeHtml($row['expense_date']);
@@ -182,7 +184,7 @@ ob_start();
                             <option value="">- Select Client -</option>
                             <?php
 
-                            $sql_clients = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients WHERE client_archived_at IS NULL $access_permission_query ORDER BY client_name ASC");
+                            $sql_clients = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients WHERE client_archived_at IS NULL " . clientScopeSql('clients.client_id') . " ORDER BY client_name ASC");
                             while ($row = mysqli_fetch_assoc($sql_clients)) {
                                 $client_id_select = intval($row['client_id']);
                                 $client_name_select = escapeHtml($row['client_name']);
diff --git a/agent/modals/expense/expense_edit.php b/agent/modals/expense/expense_edit.php
index 0d4e09646..4e560a713 100644
--- a/agent/modals/expense/expense_edit.php
+++ b/agent/modals/expense/expense_edit.php
@@ -6,7 +6,9 @@ enforceUserPermission('module_financial', 2);
 
 $expense_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM expenses
+$sql = mysqli_query($mysqli, "SELECT category_name, expense_account_id, expense_amount, expense_category_id, expense_client_id,
+    expense_created_at, expense_currency_code, expense_date, expense_description,
+    expense_receipt, expense_reference, expense_vendor_id, vendor_name FROM expenses
     LEFT JOIN vendors ON expense_vendor_id = vendor_id
     LEFT JOIN categories ON expense_category_id = category_id
     WHERE expense_id = $expense_id LIMIT 1"
@@ -205,7 +207,7 @@ ob_start();
                             <option value="">- Select Client -</option>
                             <?php
 
-                            $sql_clients = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients WHERE 1 = 1 $access_permission_query ORDER BY client_name ASC");
+                            $sql_clients = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients WHERE 1 = 1 " . clientScopeSql('clients.client_id') . " ORDER BY client_name ASC");
                             while ($row = mysqli_fetch_assoc($sql_clients)) {
                                 $client_id_select = intval($row['client_id']);
                                 $client_name_select = escapeHtml($row['client_name']);
diff --git a/agent/modals/expense/expense_refund.php b/agent/modals/expense/expense_refund.php
index a51c854ec..0788b25f9 100644
--- a/agent/modals/expense/expense_refund.php
+++ b/agent/modals/expense/expense_refund.php
@@ -6,7 +6,9 @@ enforceUserPermission('module_financial', 2);
 
 $expense_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM expenses WHERE expense_id = $expense_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT expense_account_id, expense_amount, expense_category_id, expense_client_id,
+    expense_created_at, expense_currency_code, expense_date, expense_description,
+    expense_receipt, expense_reference, expense_vendor_id FROM expenses WHERE expense_id = $expense_id LIMIT 1");
 
 $row = mysqli_fetch_assoc($sql);
 $expense_date = escapeHtml($row['expense_date']);
diff --git a/agent/modals/file/file_link_asset.php b/agent/modals/file/file_link_asset.php
index a50565d16..3c0f8fbf5 100644
--- a/agent/modals/file/file_link_asset.php
+++ b/agent/modals/file/file_link_asset.php
@@ -21,7 +21,7 @@
                                 <option value="">- Select an Asset -</option>
                                 <?php
 
-                                $sql_assets_select = mysqli_query($mysqli, "SELECT * FROM assets
+                                $sql_assets_select = mysqli_query($mysqli, "SELECT asset_id, asset_name FROM assets
                                     WHERE asset_client_id = $client_id
                                     AND asset_archived_at IS NULL
                                     ORDER BY asset_name ASC"
@@ -40,7 +40,7 @@
                         </div>
                     </div>
                         <?php
-                            $sql_assets = mysqli_query($mysqli, "SELECT * FROM assets, asset_files
+                            $sql_assets = mysqli_query($mysqli, "SELECT assets.asset_id, asset_name FROM assets, asset_files
                                 WHERE assets.asset_id = asset_files.asset_id
                                 AND asset_files.file_id = $file_id
                                 ORDER BY asset_name ASC"
diff --git a/agent/modals/file/file_move.php b/agent/modals/file/file_move.php
index 44208f69c..4771647bc 100644
--- a/agent/modals/file/file_move.php
+++ b/agent/modals/file/file_move.php
@@ -6,7 +6,7 @@ enforceUserPermission('module_support', 2);
 
 $file_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM files WHERE file_id = $file_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT file_client_id, file_ext, file_folder_id, file_name FROM files WHERE file_id = $file_id LIMIT 1");
 
 $row = mysqli_fetch_assoc($sql);
 $client_id = intval($row['file_client_id']);
diff --git a/agent/modals/file/file_rename.php b/agent/modals/file/file_rename.php
index 5e4fd5e3b..2ffb36718 100644
--- a/agent/modals/file/file_rename.php
+++ b/agent/modals/file/file_rename.php
@@ -5,7 +5,7 @@ enforceUserPermission('module_support', 2);
 
 $file_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM files WHERE file_id = $file_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT file_client_id, file_description, file_name FROM files WHERE file_id = $file_id LIMIT 1");
 
 $row = mysqli_fetch_assoc($sql);
 $client_id = intval($row['file_client_id']);
diff --git a/agent/modals/folder/folder_rename.php b/agent/modals/folder/folder_rename.php
index bc13370dd..a66228da4 100644
--- a/agent/modals/folder/folder_rename.php
+++ b/agent/modals/folder/folder_rename.php
@@ -6,7 +6,7 @@ enforceUserPermission('module_support', 2);
 
 $folder_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM folders WHERE folder_id = $folder_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT folder_client_id, folder_name FROM folders WHERE folder_id = $folder_id LIMIT 1");
 
 $row = mysqli_fetch_assoc($sql);
 $folder_name = escapeHtml($row['folder_name']);
diff --git a/agent/modals/invoice/invoice_add.php b/agent/modals/invoice/invoice_add.php
index 7a02cd332..4e1ae248f 100644
--- a/agent/modals/invoice/invoice_add.php
+++ b/agent/modals/invoice/invoice_add.php
@@ -32,7 +32,7 @@ ob_start();
                         <option value="">- Select a Client -</option>
                         <?php
                         //select unarchived clients
-                        $sql = mysqli_query($mysqli, "SELECT * FROM clients WHERE client_archived_at IS NULL $access_permission_query ORDER BY client_name ASC");
+                        $sql = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients WHERE client_archived_at IS NULL " . clientScopeSql('clients.client_id') . " ORDER BY client_name ASC");
                         while ($row = mysqli_fetch_assoc($sql)) {
                             $client_id_select = intval($row['client_id']);
                             $client_name = escapeHtml($row['client_name']);
@@ -68,7 +68,7 @@ ob_start();
                     <option value="">- Category -</option>
                     <?php
 
-                    $sql = mysqli_query($mysqli, "SELECT * FROM categories WHERE category_type = 'Income' AND category_archived_at IS NULL ORDER BY category_name ASC");
+                    $sql = mysqli_query($mysqli, "SELECT category_id, category_name FROM categories WHERE category_type = 'Income' AND category_archived_at IS NULL ORDER BY category_name ASC");
                     while ($row = mysqli_fetch_assoc($sql)) {
                         $category_id = intval($row['category_id']);
                         $category_name = escapeHtml($row['category_name']);
diff --git a/agent/modals/invoice/invoice_copy.php b/agent/modals/invoice/invoice_copy.php
index 1f47dd752..53d9f009e 100644
--- a/agent/modals/invoice/invoice_copy.php
+++ b/agent/modals/invoice/invoice_copy.php
@@ -6,7 +6,7 @@ enforceUserPermission('module_sales', 2);
 
 $invoice_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM invoices LEFT JOIN clients ON invoice_client_id = client_id WHERE invoice_id = $invoice_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT client_name, invoice_client_id, invoice_number, invoice_prefix FROM invoices LEFT JOIN clients ON invoice_client_id = client_id WHERE invoice_id = $invoice_id LIMIT 1");
 
 $row = mysqli_fetch_assoc($sql);
 $invoice_prefix = escapeHtml($row['invoice_prefix']);
diff --git a/agent/modals/invoice/invoice_edit.php b/agent/modals/invoice/invoice_edit.php
index 8ca7768d5..6fa9ce001 100644
--- a/agent/modals/invoice/invoice_edit.php
+++ b/agent/modals/invoice/invoice_edit.php
@@ -6,7 +6,8 @@ enforceUserPermission('module_sales', 2);
 
 $invoice_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM invoices LEFT JOIN clients ON invoice_client_id = client_id WHERE invoice_id = $invoice_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT client_id, client_name, invoice_category_id, invoice_created_at, invoice_date,
+    invoice_discount_amount, invoice_due, invoice_number, invoice_prefix, invoice_scope FROM invoices LEFT JOIN clients ON invoice_client_id = client_id WHERE invoice_id = $invoice_id LIMIT 1");
 
 $row = mysqli_fetch_assoc($sql);
 $invoice_prefix = escapeHtml($row['invoice_prefix']);
@@ -68,7 +69,7 @@ ob_start();
                     <option value="">- Category -</option>
                     <?php
 
-                    $sql_income_category = mysqli_query($mysqli, "SELECT * FROM categories WHERE category_type = 'Income' AND (category_archived_at > '$invoice_created_at' OR category_archived_at IS NULL) ORDER BY category_name ASC");
+                    $sql_income_category = mysqli_query($mysqli, "SELECT category_id, category_name FROM categories WHERE category_type = 'Income' AND (category_archived_at > '$invoice_created_at' OR category_archived_at IS NULL) ORDER BY category_name ASC");
                     while ($row = mysqli_fetch_assoc($sql_income_category)) {
                         $category_id_select = intval($row['category_id']);
                         $category_name_select = escapeHtml($row['category_name']);
diff --git a/agent/modals/invoice/invoice_item_edit.php b/agent/modals/invoice/invoice_item_edit.php
index e21fc42c9..7b6b1b793 100644
--- a/agent/modals/invoice/invoice_item_edit.php
+++ b/agent/modals/invoice/invoice_item_edit.php
@@ -6,7 +6,8 @@ enforceUserPermission('module_sales', 2);
 
 $item_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM invoice_items LEFT JOIN invoices ON invoice_id = item_invoice_id WHERE item_id = $item_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT invoice_client_id, item_created_at, item_description, item_name, item_price,
+    item_product_id, item_quantity, item_tax_id FROM invoice_items LEFT JOIN invoices ON invoice_id = item_invoice_id WHERE item_id = $item_id LIMIT 1");
 $row = mysqli_fetch_assoc($sql);
 $item_name = escapeHtml($row['item_name']);
 $item_description = escapeHtml($row['item_description']);
@@ -87,7 +88,7 @@ ob_start();
                 <select class="form-control select2" name="tax_id" required>
                     <option value="0">No Tax</option>
                     <?php
-                        $taxes_sql = mysqli_query($mysqli, "SELECT * FROM taxes WHERE (tax_archived_at > '$item_created_at' OR tax_archived_at IS NULL) ORDER BY tax_name ASC");
+                        $taxes_sql = mysqli_query($mysqli, "SELECT tax_id, tax_name, tax_percent FROM taxes WHERE (tax_archived_at > '$item_created_at' OR tax_archived_at IS NULL) ORDER BY tax_name ASC");
                         while ($row = mysqli_fetch_assoc($taxes_sql)) {
                             $tax_id_select = intval($row['tax_id']);
                             $tax_name = escapeHtml($row['tax_name']);
diff --git a/agent/modals/invoice/invoice_payments.php b/agent/modals/invoice/invoice_payments.php
index 567c69656..db3a4f34a 100644
--- a/agent/modals/invoice/invoice_payments.php
+++ b/agent/modals/invoice/invoice_payments.php
@@ -6,7 +6,8 @@ enforceUserPermission('module_sales');
 
 $invoice_id = intval($_GET['invoice_id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM invoices WHERE invoice_id = $invoice_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT invoice_amount, invoice_client_id, invoice_currency_code, invoice_number, invoice_prefix,
+    invoice_status FROM invoices WHERE invoice_id = $invoice_id LIMIT 1");
 $row = mysqli_fetch_assoc($sql);
 $invoice_prefix = escapeHtml($row['invoice_prefix']);
 $invoice_number = escapeHtml($row['invoice_number']);
@@ -21,7 +22,8 @@ $invoice_badge_color = getInvoiceBadgeColor($invoice_status);
 
 $sql_payments = mysqli_query(
     $mysqli,
-    "SELECT * FROM payments
+    "SELECT account_archived_at, account_name, payment_amount, payment_currency_code, payment_date,
+        payment_id, payment_method, payment_reference FROM payments
     LEFT JOIN accounts ON payment_account_id = account_id
     WHERE payment_invoice_id = $invoice_id
     AND payment_archived_at IS NULL
diff --git a/agent/modals/invoice/invoice_recurring_add.php b/agent/modals/invoice/invoice_recurring_add.php
index 13cd43da2..edfc1bf85 100644
--- a/agent/modals/invoice/invoice_recurring_add.php
+++ b/agent/modals/invoice/invoice_recurring_add.php
@@ -4,7 +4,7 @@ require_once '../../../includes/modal_header.php';
 
 $invoice_id = intval($_GET['invoice_id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM invoices WHERE invoice_id = $invoice_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT invoice_client_id, invoice_number, invoice_prefix FROM invoices WHERE invoice_id = $invoice_id LIMIT 1");
 
 $row = mysqli_fetch_assoc($sql);
 $invoice_prefix = escapeHtml($row['invoice_prefix']);
diff --git a/agent/modals/location/location_add.php b/agent/modals/location/location_add.php
index 2d5febe5e..2f4dd74c3 100644
--- a/agent/modals/location/location_add.php
+++ b/agent/modals/location/location_add.php
@@ -55,7 +55,7 @@ ob_start();
                                 <option value="">- Select Client -</option>
                                 <?php
 
-                                $sql = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients WHERE client_archived_at IS NULL $access_permission_query ORDER BY client_name ASC");
+                                $sql = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients WHERE client_archived_at IS NULL " . clientScopeSql('clients.client_id') . " ORDER BY client_name ASC");
                                 while ($row = mysqli_fetch_assoc($sql)) {
                                     $client_id_select = intval($row['client_id']);
                                     $client_name = escapeHtml($row['client_name']); ?>
@@ -171,7 +171,7 @@ ob_start();
                             <option value="">- Contact -</option>
                             <?php
 
-                            $sql_contacts = mysqli_query($mysqli, "SELECT * FROM contacts WHERE contact_archived_at IS NULL AND contact_client_id = $client_id ORDER BY contact_name ASC");
+                            $sql_contacts = mysqli_query($mysqli, "SELECT contact_id, contact_name FROM contacts WHERE contact_archived_at IS NULL AND contact_client_id = $client_id ORDER BY contact_name ASC");
                             while ($row = mysqli_fetch_assoc($sql_contacts)) {
                                 $contact_id = $row['contact_id'];
                                 $contact_name = escapeHtml($row['contact_name']);
@@ -246,7 +246,7 @@ ob_start();
                         <select class="form-control select2" name="tags[]" data-placeholder="Add some tags" multiple>
                             <?php
 
-                            $sql_tags_select = mysqli_query($mysqli, "SELECT * FROM tags WHERE tag_type = 2 ORDER BY tag_name ASC");
+                            $sql_tags_select = mysqli_query($mysqli, "SELECT tag_id, tag_name FROM tags WHERE tag_type = 2 ORDER BY tag_name ASC");
                             while ($row = mysqli_fetch_assoc($sql_tags_select)) {
                                 $tag_id_select = intval($row['tag_id']);
                                 $tag_name_select = escapeHtml($row['tag_name']);
diff --git a/agent/modals/location/location_bulk_assign_tags.php b/agent/modals/location/location_bulk_assign_tags.php
index 44583f024..affa6e561 100644
--- a/agent/modals/location/location_bulk_assign_tags.php
+++ b/agent/modals/location/location_bulk_assign_tags.php
@@ -36,7 +36,7 @@ ob_start();
                 <select class="form-control select2" name="bulk_tags[]" data-placeholder="Add some tags" multiple>
                     <?php
 
-                    $sql_tags_select = mysqli_query($mysqli, "SELECT * FROM tags WHERE tag_type = 2 ORDER BY tag_name ASC");
+                    $sql_tags_select = mysqli_query($mysqli, "SELECT tag_id, tag_name FROM tags WHERE tag_type = 2 ORDER BY tag_name ASC");
                     while ($row = mysqli_fetch_assoc($sql_tags_select)) {
                         $tag_id_select = intval($row['tag_id']);
                         $tag_name_select = escapeHtml($row['tag_name']);
diff --git a/agent/modals/location/location_edit.php b/agent/modals/location/location_edit.php
index d5d38ea3e..904de8caf 100644
--- a/agent/modals/location/location_edit.php
+++ b/agent/modals/location/location_edit.php
@@ -6,7 +6,11 @@ enforceUserPermission('module_client', 2);
 
 $location_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM locations WHERE location_id = $location_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT location_address, location_archived_at, location_city, location_client_id,
+    location_contact_id, location_country, location_created_at, location_description,
+    location_fax, location_fax_country_code, location_hours, location_name, location_notes,
+    location_phone, location_phone_country_code, location_phone_extension, location_photo, location_primary,
+    location_state, location_zip FROM locations WHERE location_id = $location_id LIMIT 1");
 
 $row = mysqli_fetch_assoc($sql);
 $location_name = escapeHtml($row['location_name']);
@@ -18,7 +22,7 @@ $location_state = escapeHtml($row['location_state']);
 $location_zip = escapeHtml($row['location_zip']);
 $location_phone_country_code = escapeHtml($row['location_phone_country_code']);
 $location_phone = escapeHtml(formatPhoneNumber($row['location_phone'], $location_phone_country_code));
-//$location_extension = intval($row['location_extension']);
+$location_extension = escapeHtml($row['location_phone_extension']);
 $location_fax_country_code = escapeHtml($row['location_fax_country_code']);
 $location_fax = escapeHtml(formatPhoneNumber($row['location_fax'], $location_fax_country_code));
 $location_hours = escapeHtml($row['location_hours']);
@@ -34,7 +38,7 @@ enforceClientAccess();
 
 // Tags
 $location_tag_id_array = array();
-$sql_location_tags = mysqli_query($mysqli, "SELECT * FROM location_tags WHERE location_id = $location_id");
+$sql_location_tags = mysqli_query($mysqli, "SELECT tag_id FROM location_tags WHERE location_id = $location_id");
 while ($row = mysqli_fetch_assoc($sql_location_tags)) {
     $location_tag_id = intval($row['tag_id']);
     $location_tag_id_array[] = $location_tag_id;
@@ -186,7 +190,7 @@ ob_start();
                             <option value="">- Contact -</option>
                             <?php
 
-                            $sql_contacts = mysqli_query($mysqli, "SELECT * FROM contacts WHERE (contact_archived_at > '$location_created_at' OR contact_archived_at IS NULL) AND contact_client_id = $client_id ORDER BY contact_archived_at ASC, contact_name ASC");
+                            $sql_contacts = mysqli_query($mysqli, "SELECT contact_archived_at, contact_id, contact_name FROM contacts WHERE (contact_archived_at > '$location_created_at' OR contact_archived_at IS NULL) AND contact_client_id = $client_id ORDER BY contact_archived_at ASC, contact_name ASC");
                             while ($row = mysqli_fetch_assoc($sql_contacts)) {
                                 $contact_id_select = intval($row['contact_id']);
                                 $contact_name_select = escapeHtml($row['contact_name']);
@@ -267,7 +271,7 @@ ob_start();
                         <select class="form-control select2" name="tags[]" data-placeholder="Add some tags" multiple>
                             <?php
 
-                            $sql_tags_select = mysqli_query($mysqli, "SELECT * FROM tags WHERE tag_type = 2 ORDER BY tag_name ASC");
+                            $sql_tags_select = mysqli_query($mysqli, "SELECT tag_id, tag_name FROM tags WHERE tag_type = 2 ORDER BY tag_name ASC");
                             while ($row = mysqli_fetch_assoc($sql_tags_select)) {
                                 $tag_id_select = intval($row['tag_id']);
                                 $tag_name_select = escapeHtml($row['tag_name']);
diff --git a/agent/modals/network/network_add.php b/agent/modals/network/network_add.php
index 97eeafcf3..c5ac37f8a 100644
--- a/agent/modals/network/network_add.php
+++ b/agent/modals/network/network_add.php
@@ -54,7 +54,7 @@ ob_start();
                                 <option value="">- Select Client -</option>
                                 <?php
 
-                                $sql = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients WHERE client_archived_at IS NULL $access_permission_query ORDER BY client_name ASC");
+                                $sql = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients WHERE client_archived_at IS NULL " . clientScopeSql('clients.client_id') . " ORDER BY client_name ASC");
                                 while ($row = mysqli_fetch_assoc($sql)) {
                                     $client_id_select = intval($row['client_id']);
                                     $client_name = escapeHtml($row['client_name']); ?>
@@ -78,7 +78,7 @@ ob_start();
                             <option value="">- Select Location -</option>
                             <?php
 
-                            $sql = mysqli_query($mysqli, "SELECT * FROM locations WHERE location_archived_at IS NULL AND location_client_id = $client_id ORDER BY location_name ASC");
+                            $sql = mysqli_query($mysqli, "SELECT location_id, location_name FROM locations WHERE location_archived_at IS NULL AND location_client_id = $client_id ORDER BY location_name ASC");
                             while ($row = mysqli_fetch_assoc($sql)) {
                                 $location_id_select = intval($row['location_id']);
                                 $location_name = escapeHtml($row['location_name']);
diff --git a/agent/modals/network/network_edit.php b/agent/modals/network/network_edit.php
index 0919cab0b..dfed02761 100644
--- a/agent/modals/network/network_edit.php
+++ b/agent/modals/network/network_edit.php
@@ -6,7 +6,9 @@ enforceUserPermission('module_support', 2);
 
 $network_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM networks WHERE network_id = $network_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT network, network_client_id, network_description, network_dhcp_range, network_gateway,
+    network_location_id, network_name, network_notes, network_primary_dns,
+    network_secondary_dns, network_vlan FROM networks WHERE network_id = $network_id LIMIT 1");
 
 $row = mysqli_fetch_assoc($sql);
 $network_name = escapeHtml($row['network_name']);
diff --git a/agent/modals/payment/payment_add.php b/agent/modals/payment/payment_add.php
index bc630eaf3..42862cf43 100644
--- a/agent/modals/payment/payment_add.php
+++ b/agent/modals/payment/payment_add.php
@@ -6,7 +6,8 @@ $invoice_id = intval($_GET['id']);
 
 $sql = mysqli_query(
     $mysqli,
-    "SELECT * FROM invoices
+    "SELECT client_currency_code, client_id, client_name, contact_email, contact_name, invoice_amount,
+        invoice_id, invoice_number, invoice_prefix FROM invoices
     LEFT JOIN clients ON invoice_client_id = client_id
     LEFT JOIN contacts ON client_id = contact_client_id AND contact_primary = 1
     WHERE invoice_id = $invoice_id
@@ -92,7 +93,7 @@ ob_start();
                     <option value="">- Select an Account -</option>
                     <?php
 
-                    $sql = mysqli_query($mysqli, "SELECT * FROM accounts WHERE account_archived_at IS NULL ORDER BY account_name ASC");
+                    $sql = mysqli_query($mysqli, "SELECT account_currency_code, account_id, account_name, opening_balance FROM accounts WHERE account_archived_at IS NULL ORDER BY account_name ASC");
                     while ($row = mysqli_fetch_assoc($sql)) {
                         $account_id = intval($row['account_id']);
                         $account_name = escapeHtml($row['account_name']);
@@ -136,7 +137,7 @@ ob_start();
                     <option value="">- Method of Payment -</option>
                     <?php
 
-                    $sql = mysqli_query($mysqli, "SELECT * FROM payment_methods ORDER BY payment_method_name ASC");
+                    $sql = mysqli_query($mysqli, "SELECT payment_method_name FROM payment_methods ORDER BY payment_method_name ASC");
                     while ($row = mysqli_fetch_assoc($sql)) {
                         $payment_method_name = escapeHtml($row['payment_method_name']);
                     ?>
diff --git a/agent/modals/payment/payment_bulk_add.php b/agent/modals/payment/payment_bulk_add.php
index 96f98dd3f..b42443d38 100644
--- a/agent/modals/payment/payment_bulk_add.php
+++ b/agent/modals/payment/payment_bulk_add.php
@@ -6,7 +6,7 @@ $client_id = intval($_GET['client_id']);
 
 $sql = mysqli_query(
     $mysqli,
-    "SELECT * FROM clients
+    "SELECT client_currency_code, client_name, contact_email, contact_name FROM clients
     LEFT JOIN contacts ON clients.client_id = contacts.contact_client_id AND contact_primary = 1
     WHERE client_id = $client_id"
 );
@@ -95,7 +95,7 @@ ob_start();
                     <option value="">- Select an Account -</option>
                     <?php
 
-                    $sql = mysqli_query($mysqli, "SELECT * FROM accounts WHERE account_archived_at IS NULL ORDER BY account_name ASC");
+                    $sql = mysqli_query($mysqli, "SELECT account_id, account_name, opening_balance FROM accounts WHERE account_archived_at IS NULL ORDER BY account_name ASC");
                     while ($row = mysqli_fetch_assoc($sql)) {
                         $account_id = intval($row['account_id']);
                         $account_name = escapeHtml($row['account_name']);
@@ -138,7 +138,7 @@ ob_start();
                     <option value="">- Method of Payment -</option>
                     <?php
 
-                    $sql = mysqli_query($mysqli, "SELECT * FROM payment_methods ORDER BY payment_method_name ASC");
+                    $sql = mysqli_query($mysqli, "SELECT payment_method_name FROM payment_methods ORDER BY payment_method_name ASC");
                     while ($row = mysqli_fetch_assoc($sql)) {
                         $payment_method_name = escapeHtml($row['payment_method_name']);
                     ?>
diff --git a/agent/modals/payment/payment_edit.php b/agent/modals/payment/payment_edit.php
index 9f9dd9b23..ab9342484 100644
--- a/agent/modals/payment/payment_edit.php
+++ b/agent/modals/payment/payment_edit.php
@@ -6,7 +6,8 @@ enforceUserPermission('module_sales', 2);
 
 $payment_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM payments LEFT JOIN invoices ON invoice_id = payment_invoice_id WHERE payment_id = $payment_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT invoice_client_id, payment_account_id, payment_amount, payment_date, payment_method,
+    payment_reference FROM payments LEFT JOIN invoices ON invoice_id = payment_invoice_id WHERE payment_id = $payment_id LIMIT 1");
 
 $row = mysqli_fetch_assoc($sql);
 $payment_date = escapeHtml($row['payment_date']);
@@ -74,7 +75,7 @@ ob_start();
                     <option value="">- Select an Account -</option>
                     <?php
 
-                    $sql = mysqli_query($mysqli, "SELECT * FROM accounts WHERE account_archived_at IS NULL ORDER BY account_name ASC");
+                    $sql = mysqli_query($mysqli, "SELECT account_id, account_name, opening_balance FROM accounts WHERE account_archived_at IS NULL ORDER BY account_name ASC");
                     while ($row = mysqli_fetch_assoc($sql)) {
                         $account_id = intval($row['account_id']);
                         $account_name = escapeHtml($row['account_name']);
diff --git a/agent/modals/payment/payment_saved_method_add.php b/agent/modals/payment/payment_saved_method_add.php
index b7eff8bf3..b94a19262 100644
--- a/agent/modals/payment/payment_saved_method_add.php
+++ b/agent/modals/payment/payment_saved_method_add.php
@@ -4,7 +4,7 @@ require_once '../../../includes/modal_header.php';
 
 $invoice_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM invoices WHERE invoice_id = $invoice_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT invoice_amount, invoice_client_id, invoice_number, invoice_prefix FROM invoices WHERE invoice_id = $invoice_id LIMIT 1");
 
 $row = mysqli_fetch_assoc($sql);
 $invoice_prefix = escapeHtml($row['invoice_prefix']);
@@ -41,7 +41,7 @@ ob_start();
                     <option value="">- Saved Payment Methods -</option>
                     <?php
 
-                    $sql = mysqli_query($mysqli, "SELECT * FROM client_saved_payment_methods WHERE saved_payment_client_id = $client_id ORDER BY saved_payment_description ASC");
+                    $sql = mysqli_query($mysqli, "SELECT saved_payment_description, saved_payment_id FROM client_saved_payment_methods WHERE saved_payment_client_id = $client_id ORDER BY saved_payment_description ASC");
                     while ($row = mysqli_fetch_assoc($sql)) {
                         $saved_payment_id = intval($row['saved_payment_id']);
                         $saved_payment_description = escapeHtml($row['saved_payment_description']);
diff --git a/agent/modals/product/product_add.php b/agent/modals/product/product_add.php
index 1d9280068..29d6f1a35 100644
--- a/agent/modals/product/product_add.php
+++ b/agent/modals/product/product_add.php
@@ -67,7 +67,7 @@ ob_start();
                     <option value="">- Select Category -</option>
                     <?php
 
-                    $sql = mysqli_query($mysqli, "SELECT * FROM categories WHERE category_type = 'Income' AND category_archived_at IS NULL");
+                    $sql = mysqli_query($mysqli, "SELECT category_id, category_name FROM categories WHERE category_type = 'Income' AND category_archived_at IS NULL");
                     while ($row = mysqli_fetch_assoc($sql)) {
                         $category_id = intval($row['category_id']);
                         $category_name = escapeHtml($row['category_name']);
@@ -111,7 +111,7 @@ ob_start();
                             <option value="0">None</option>
                             <?php
 
-                            $taxes_sql = mysqli_query($mysqli, "SELECT * FROM taxes WHERE tax_archived_at IS NULL ORDER BY tax_name ASC");
+                            $taxes_sql = mysqli_query($mysqli, "SELECT tax_id, tax_name, tax_percent FROM taxes WHERE tax_archived_at IS NULL ORDER BY tax_name ASC");
                             while ($row = mysqli_fetch_assoc($taxes_sql)) {
                                 $tax_id = intval($row['tax_id']);
                                 $tax_name = escapeHtml($row['tax_name']);
diff --git a/agent/modals/product/product_edit.php b/agent/modals/product/product_edit.php
index 3afc91f4c..8b0acc539 100644
--- a/agent/modals/product/product_edit.php
+++ b/agent/modals/product/product_edit.php
@@ -6,7 +6,8 @@ enforceUserPermission('module_sales', 2);
 
 $product_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM products WHERE product_id = $product_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT product_category_id, product_code, product_created_at, product_description,
+    product_location, product_name, product_price, product_tax_id, product_type FROM products WHERE product_id = $product_id LIMIT 1");
 
 $row = mysqli_fetch_assoc($sql);
 $product_name = escapeHtml($row['product_name']);
@@ -53,7 +54,7 @@ ob_start();
                 <select class="form-control select2" name="category" required>
                     <?php
 
-                    $sql_select = mysqli_query($mysqli, "SELECT * FROM categories WHERE category_type = 'Income' AND (category_archived_at > '$product_created_at' OR category_archived_at IS NULL)");
+                    $sql_select = mysqli_query($mysqli, "SELECT category_id, category_name FROM categories WHERE category_type = 'Income' AND (category_archived_at > '$product_created_at' OR category_archived_at IS NULL)");
                     while ($row = mysqli_fetch_assoc($sql_select)) {
                         $category_id_select = intval($row['category_id']);
                         $category_name_select = escapeHtml($row['category_name']);
@@ -96,7 +97,7 @@ ob_start();
                             <option value="0">None</option>
                             <?php
 
-                            $taxes_sql = mysqli_query($mysqli, "SELECT * FROM taxes WHERE (tax_archived_at > '$product_created_at' OR tax_archived_at IS NULL) ORDER BY tax_name ASC");
+                            $taxes_sql = mysqli_query($mysqli, "SELECT tax_id, tax_name, tax_percent FROM taxes WHERE (tax_archived_at > '$product_created_at' OR tax_archived_at IS NULL) ORDER BY tax_name ASC");
                             while ($row = mysqli_fetch_assoc($taxes_sql)) {
                                 $tax_id_select = intval($row['tax_id']);
                                 $tax_name = escapeHtml($row['tax_name']);
diff --git a/agent/modals/project/project_add.php b/agent/modals/project/project_add.php
index 09b0ef253..fce32cb5f 100644
--- a/agent/modals/project/project_add.php
+++ b/agent/modals/project/project_add.php
@@ -30,7 +30,7 @@ ob_start();
                     <select class="form-control select2" name="client_id">
                         <option value="0">- No Client -</option>
                         <?php
-                        $sql = mysqli_query($mysqli, "SELECT * FROM clients WHERE client_archived_at IS NULL $access_permission_query ORDER BY client_name ASC");
+                        $sql = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients WHERE client_archived_at IS NULL " . clientScopeSql('clients.client_id') . " ORDER BY client_name ASC");
                         while ($row = mysqli_fetch_assoc($sql)) {
                             $client_id_select = intval($row['client_id']);
                             $client_name = escapeHtml($row['client_name']);
@@ -61,7 +61,7 @@ ob_start();
                 <select class="form-control select2" name="project_template_id">
                     <option value="">- Template -</option>
                     <?php
-                    $sql = mysqli_query($mysqli, "SELECT * FROM project_templates WHERE project_template_archived_at IS NULL ORDER BY project_template_name ASC");
+                    $sql = mysqli_query($mysqli, "SELECT project_template_id, project_template_name FROM project_templates WHERE project_template_archived_at IS NULL ORDER BY project_template_name ASC");
                     while ($row = mysqli_fetch_assoc($sql)) {
                         $project_template_id = intval($row['project_template_id']);
                         $project_template_name = escapeHtml($row['project_template_name']);
diff --git a/agent/modals/project/project_edit.php b/agent/modals/project/project_edit.php
index 0fe879aad..7f47ecdef 100644
--- a/agent/modals/project/project_edit.php
+++ b/agent/modals/project/project_edit.php
@@ -6,7 +6,9 @@ enforceUserPermission('module_support', 2);
 
 $project_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM projects WHERE project_id = $project_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT project_archived_at, project_client_id, project_completed_at, project_created_at,
+    project_description, project_due, project_manager, project_name, project_number,
+    project_prefix, project_updated_at FROM projects WHERE project_id = $project_id LIMIT 1");
 
 $row = mysqli_fetch_assoc($sql);
 $project_prefix = escapeHtml($row['project_prefix']);
diff --git a/agent/modals/project/project_link_closed_ticket.php b/agent/modals/project/project_link_closed_ticket.php
index 05bb1f209..26d5f5954 100644
--- a/agent/modals/project/project_link_closed_ticket.php
+++ b/agent/modals/project/project_link_closed_ticket.php
@@ -14,7 +14,7 @@ if ($client_id) {
     $client_ticket_select_query = '';
 }
 
-$sql = mysqli_query($mysqli, "SELECT * FROM projects WHERE project_id = $project_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT project_name FROM projects WHERE project_id = $project_id LIMIT 1");
 
 $row = mysqli_fetch_assoc($sql);
 $project_name = escapeHtml($row['project_name']);
diff --git a/agent/modals/project/project_link_ticket.php b/agent/modals/project/project_link_ticket.php
index daa47757f..2ccebc69a 100644
--- a/agent/modals/project/project_link_ticket.php
+++ b/agent/modals/project/project_link_ticket.php
@@ -14,7 +14,7 @@ if ($client_id) {
     $client_ticket_select_query = '';
 }
 
-$sql = mysqli_query($mysqli, "SELECT * FROM projects WHERE project_id = $project_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT project_name FROM projects WHERE project_id = $project_id LIMIT 1");
 
 $row = mysqli_fetch_assoc($sql);
 $project_name = escapeHtml($row['project_name']);
@@ -43,7 +43,7 @@ ob_start();
                 <select class="form-control select2" data-placeholder="- Select Tickets- " multiple name="tickets[]" required>
                     <?php
 
-                    $sql_tickets_select = mysqli_query($mysqli, "SELECT * FROM tickets LEFT JOIN clients on ticket_client_id = client_id WHERE ticket_project_id = 0 AND ticket_closed_at IS NULL $client_ticket_select_query");
+                    $sql_tickets_select = mysqli_query($mysqli, "SELECT client_abbreviation, ticket_id, ticket_number, ticket_prefix, ticket_subject FROM tickets LEFT JOIN clients on ticket_client_id = client_id WHERE ticket_project_id = 0 AND ticket_closed_at IS NULL $client_ticket_select_query");
                     while ($row = mysqli_fetch_assoc($sql_tickets_select)) {
                         $ticket_id_select = intval($row['ticket_id']);
                         $ticket_prefix_select = escapeHtml($row['ticket_prefix']);
diff --git a/agent/modals/quote/quote_add.php b/agent/modals/quote/quote_add.php
index eed835e80..29555fdee 100644
--- a/agent/modals/quote/quote_add.php
+++ b/agent/modals/quote/quote_add.php
@@ -33,7 +33,7 @@ ob_start();
                         <?php
 
                         //select unarchived clients
-                        $sql = mysqli_query($mysqli, "SELECT * FROM clients WHERE client_archived_at IS NULL $access_permission_query ORDER BY client_name ASC");
+                        $sql = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients WHERE client_archived_at IS NULL " . clientScopeSql('clients.client_id') . " ORDER BY client_name ASC");
                         while ($row = mysqli_fetch_assoc($sql)) {
                             $client_id_select = intval($row['client_id']);
                             $client_name = escapeHtml($row['client_name']);
@@ -67,7 +67,7 @@ ob_start();
                     <option value="">- Category -</option>
                     <?php
 
-                    $sql = mysqli_query($mysqli, "SELECT * FROM categories WHERE category_type = 'Income' AND category_archived_at IS NULL ORDER BY category_name ASC");
+                    $sql = mysqli_query($mysqli, "SELECT category_id, category_name FROM categories WHERE category_type = 'Income' AND category_archived_at IS NULL ORDER BY category_name ASC");
                     while ($row = mysqli_fetch_assoc($sql)) {
                         $category_id = intval($row['category_id']);
                         $category_name = escapeHtml($row['category_name']);
diff --git a/agent/modals/quote/quote_copy.php b/agent/modals/quote/quote_copy.php
index d6fe1f28e..c61d54924 100644
--- a/agent/modals/quote/quote_copy.php
+++ b/agent/modals/quote/quote_copy.php
@@ -6,7 +6,7 @@ enforceUserPermission('module_sales', 2);
 
 $quote_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM quotes LEFT JOIN clients ON quote_client_id = client_id WHERE quote_id = $quote_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT client_id, client_name, quote_number, quote_prefix FROM quotes LEFT JOIN clients ON quote_client_id = client_id WHERE quote_id = $quote_id LIMIT 1");
 
 $row = mysqli_fetch_assoc($sql);
 $quote_prefix = escapeHtml($row['quote_prefix']);
@@ -41,7 +41,7 @@ ob_start();
                 </div>
                 <select class="form-control select2" name="client_id" required>
                     <?php
-                        $sql_client_select = mysqli_query($mysqli, "SELECT * FROM clients WHERE client_archived_at IS NULL ORDER BY client_name ASC");
+                        $sql_client_select = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients WHERE client_archived_at IS NULL ORDER BY client_name ASC");
                         while ($row = mysqli_fetch_assoc($sql_client_select)) {
                             $client_id_select = intval($row['client_id']);
                             $client_name_select = escapeHtml($row['client_name']);
diff --git a/agent/modals/quote/quote_edit.php b/agent/modals/quote/quote_edit.php
index 36d489746..2d44293e3 100644
--- a/agent/modals/quote/quote_edit.php
+++ b/agent/modals/quote/quote_edit.php
@@ -6,7 +6,8 @@ enforceUserPermission('module_sales', 2);
 
 $quote_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM quotes LEFT JOIN clients ON quote_client_id = client_id WHERE quote_id = $quote_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT client_name, quote_category_id, quote_client_id, quote_created_at, quote_date,
+    quote_discount_amount, quote_expire, quote_id, quote_number, quote_prefix, quote_scope FROM quotes LEFT JOIN clients ON quote_client_id = client_id WHERE quote_id = $quote_id LIMIT 1");
 
 $row = mysqli_fetch_assoc($sql);
 $quote_id = intval($row['quote_id']);
@@ -68,7 +69,7 @@ ob_start();
                 <select class="form-control select2" name="category" required>
                     <?php
 
-                    $sql = mysqli_query($mysqli, "SELECT * FROM categories WHERE category_type = 'Income' AND (category_archived_at > '$quote_created_at' OR category_archived_at IS NULL) ORDER BY category_name ASC");
+                    $sql = mysqli_query($mysqli, "SELECT category_id, category_name FROM categories WHERE category_type = 'Income' AND (category_archived_at > '$quote_created_at' OR category_archived_at IS NULL) ORDER BY category_name ASC");
                     while ($row = mysqli_fetch_assoc($sql)) {
                         $category_id = intval($row['category_id']);
                         $category_name = escapeHtml($row['category_name']);
diff --git a/agent/modals/quote/quote_item_edit.php b/agent/modals/quote/quote_item_edit.php
index 94b5767fe..4df64ff12 100644
--- a/agent/modals/quote/quote_item_edit.php
+++ b/agent/modals/quote/quote_item_edit.php
@@ -6,7 +6,8 @@ enforceUserPermission('module_sales', 2);
 
 $item_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM quote_items LEFT JOIN quotes ON quote_id = item_quote_id WHERE item_id = $item_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT item_created_at, item_description, item_name, item_price, item_product_id, item_quantity,
+    item_tax_id, quote_client_id FROM quote_items LEFT JOIN quotes ON quote_id = item_quote_id WHERE item_id = $item_id LIMIT 1");
 $row = mysqli_fetch_assoc($sql);
 $item_name = escapeHtml($row['item_name']);
 $item_description = escapeHtml($row['item_description']);
@@ -87,7 +88,7 @@ ob_start();
                 <select class="form-control select2" name="tax_id" required>
                     <option value="0">No Tax</option>
                     <?php
-                        $taxes_sql = mysqli_query($mysqli, "SELECT * FROM taxes WHERE (tax_archived_at > '$item_created_at' OR tax_archived_at IS NULL) ORDER BY tax_name ASC");
+                        $taxes_sql = mysqli_query($mysqli, "SELECT tax_id, tax_name, tax_percent FROM taxes WHERE (tax_archived_at > '$item_created_at' OR tax_archived_at IS NULL) ORDER BY tax_name ASC");
                         while ($row = mysqli_fetch_assoc($taxes_sql)) {
                             $tax_id_select = intval($row['tax_id']);
                             $tax_name = escapeHtml($row['tax_name']);
diff --git a/agent/modals/quote/quote_to_invoice.php b/agent/modals/quote/quote_to_invoice.php
index 21d6a1412..6aed5fa3c 100644
--- a/agent/modals/quote/quote_to_invoice.php
+++ b/agent/modals/quote/quote_to_invoice.php
@@ -6,7 +6,7 @@ enforceUserPermission('module_sales', 2);
 
 $quote_id = intval($_GET['quote_id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM quotes WHERE quote_id = $quote_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT quote_client_id, quote_number, quote_prefix FROM quotes WHERE quote_id = $quote_id LIMIT 1");
 
 $row = mysqli_fetch_assoc($sql);
 $quote_prefix = escapeHtml($row['quote_prefix']);
diff --git a/agent/modals/rack/rack_add.php b/agent/modals/rack/rack_add.php
index c2e439f69..9743e26e3 100644
--- a/agent/modals/rack/rack_add.php
+++ b/agent/modals/rack/rack_add.php
@@ -109,7 +109,7 @@ ob_start();
                             <option value="">- Location -</option>
                             <?php
 
-                            $sql = mysqli_query($mysqli, "SELECT * FROM locations WHERE location_archived_at IS NULL AND location_client_id = $client_id ORDER BY location_name ASC");
+                            $sql = mysqli_query($mysqli, "SELECT location_id, location_name FROM locations WHERE location_archived_at IS NULL AND location_client_id = $client_id ORDER BY location_name ASC");
                             while ($row = mysqli_fetch_assoc($sql)) {
                                 $location_id = intval($row['location_id']);
                                 $location_name = escapeHtml($row['location_name']);
diff --git a/agent/modals/rack/rack_device_add.php b/agent/modals/rack/rack_device_add.php
index c41e5bb01..0ef99ad86 100644
--- a/agent/modals/rack/rack_device_add.php
+++ b/agent/modals/rack/rack_device_add.php
@@ -4,7 +4,7 @@ require_once '../../../includes/modal_header.php';
 
 $rack_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM racks WHERE rack_id = $rack_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT rack_client_id, rack_name FROM racks WHERE rack_id = $rack_id LIMIT 1");
 
 $row = mysqli_fetch_assoc($sql);
 $rack_name = escapeHtml($row['rack_name']);
@@ -58,7 +58,7 @@ ob_start();
                     $assigned_assets_list = empty($assigned_assets_list) ? '0' : $assigned_assets_list;
 
                     // Fetch assets not assigned to any rack
-                    $sql_assets = mysqli_query($mysqli, "SELECT * FROM assets WHERE asset_archived_at IS NULL AND asset_client_id = $client_id AND asset_id NOT IN ($assigned_assets_list) ORDER BY asset_name ASC");
+                    $sql_assets = mysqli_query($mysqli, "SELECT asset_id, asset_name FROM assets WHERE asset_archived_at IS NULL AND asset_client_id = $client_id AND asset_id NOT IN ($assigned_assets_list) ORDER BY asset_name ASC");
                     while ($row = mysqli_fetch_assoc($sql_assets)) {
                         $asset_id = intval($row['asset_id']);
                         $asset_name = escapeHtml($row['asset_name']);
diff --git a/agent/modals/rack/rack_edit.php b/agent/modals/rack/rack_edit.php
index fd3b22cfe..f0cf435ed 100644
--- a/agent/modals/rack/rack_edit.php
+++ b/agent/modals/rack/rack_edit.php
@@ -6,7 +6,9 @@ enforceUserPermission('module_support', 2);
 
 $rack_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM racks WHERE rack_id = $rack_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT rack_client_id, rack_created_at, rack_depth, rack_description, rack_location_id,
+    rack_model, rack_name, rack_notes, rack_photo, rack_physical_location, rack_type,
+    rack_units FROM racks WHERE rack_id = $rack_id LIMIT 1");
 
 $row = mysqli_fetch_assoc($sql);
 $rack_name = escapeHtml($row['rack_name']);
@@ -132,7 +134,7 @@ ob_start();
                             <option value="">- Location -</option>
                             <?php
 
-                            $sql_location_select = mysqli_query($mysqli, "SELECT * FROM locations WHERE location_archived_at IS NULL AND location_client_id = $client_id ORDER BY location_name ASC");
+                            $sql_location_select = mysqli_query($mysqli, "SELECT location_id, location_name FROM locations WHERE location_archived_at IS NULL AND location_client_id = $client_id ORDER BY location_name ASC");
                             while ($row = mysqli_fetch_assoc($sql_location_select)) {
                                 $location_id_select = intval($row['location_id']);
                                 $location_name_select = escapeHtml($row['location_name']);
diff --git a/agent/modals/recurring_expense/recurring_expense_add.php b/agent/modals/recurring_expense/recurring_expense_add.php
index 2d3ac5250..78f82518e 100644
--- a/agent/modals/recurring_expense/recurring_expense_add.php
+++ b/agent/modals/recurring_expense/recurring_expense_add.php
@@ -213,7 +213,7 @@ ob_start();
                             <option value="0">- Client (Optional) -</option>
                             <?php
 
-                            $sql = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients WHERE client_archived_at IS NULL $access_permission_query ORDER BY client_name ASC");
+                            $sql = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients WHERE client_archived_at IS NULL " . clientScopeSql('clients.client_id') . " ORDER BY client_name ASC");
                             while ($row = mysqli_fetch_assoc($sql)) {
                                 $client_id_select = intval($row['client_id']);
                                 $client_name = escapeHtml($row['client_name']);
diff --git a/agent/modals/recurring_expense/recurring_expense_edit.php b/agent/modals/recurring_expense/recurring_expense_edit.php
index e337fb85f..92033284d 100644
--- a/agent/modals/recurring_expense/recurring_expense_edit.php
+++ b/agent/modals/recurring_expense/recurring_expense_edit.php
@@ -6,7 +6,12 @@ enforceUserPermission('module_financial', 2);
 
 $recurring_expense_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM recurring_expenses WHERE recurring_expense_id = $recurring_expense_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT recurring_expense_account_id, recurring_expense_amount, recurring_expense_category_id,
+    recurring_expense_client_id, recurring_expense_created_at, recurring_expense_currency_code,
+    recurring_expense_day, recurring_expense_description, recurring_expense_frequency,
+    recurring_expense_last_sent, recurring_expense_month, recurring_expense_next_date,
+    recurring_expense_payment_method, recurring_expense_reference, recurring_expense_status,
+    recurring_expense_vendor_id FROM recurring_expenses WHERE recurring_expense_id = $recurring_expense_id LIMIT 1");
 
 $row = mysqli_fetch_assoc($sql);
 $recurring_expense_frequency = intval($row['recurring_expense_frequency']);
@@ -244,7 +249,7 @@ ob_start();
                             <option value="">- Select Client -</option>
                             <?php
 
-                            $sql_clients = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients WHERE 1 = 1 $access_permission_query ORDER BY client_name ASC");
+                            $sql_clients = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients WHERE 1 = 1 " . clientScopeSql('clients.client_id') . " ORDER BY client_name ASC");
                             while ($row = mysqli_fetch_assoc($sql_clients)) {
                                 $client_id_select = intval($row['client_id']);
                                 $client_name_select = escapeHtml($row['client_name']);
diff --git a/agent/modals/recurring_invoice/recurring_invoice_add.php b/agent/modals/recurring_invoice/recurring_invoice_add.php
index 47433d447..54e4ffb38 100644
--- a/agent/modals/recurring_invoice/recurring_invoice_add.php
+++ b/agent/modals/recurring_invoice/recurring_invoice_add.php
@@ -32,7 +32,7 @@ ob_start();
                         <option value="">- Select a Client -</option>
                         <?php
                         //select unarchived clients
-                        $sql = mysqli_query($mysqli, "SELECT * FROM clients WHERE client_archived_at IS NULL $access_permission_query ORDER BY client_name ASC");
+                        $sql = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients WHERE client_archived_at IS NULL " . clientScopeSql('clients.client_id') . " ORDER BY client_name ASC");
                         while ($row = mysqli_fetch_assoc($sql)) {
                             $client_id = intval($row['client_id']);
                             $client_name = escapeHtml($row['client_name']);
@@ -92,7 +92,7 @@ ob_start();
                     <option value="">- Category -</option>
                     <?php
 
-                    $sql = mysqli_query($mysqli, "SELECT * FROM categories WHERE category_type = 'Income' AND category_archived_at IS NULL ORDER BY category_name ASC");
+                    $sql = mysqli_query($mysqli, "SELECT category_id, category_name FROM categories WHERE category_type = 'Income' AND category_archived_at IS NULL ORDER BY category_name ASC");
                     while ($row = mysqli_fetch_assoc($sql)) {
                         $category_id = intval($row['category_id']);
                         $category_name = escapeHtml($row['category_name']);
diff --git a/agent/modals/recurring_invoice/recurring_invoice_edit.php b/agent/modals/recurring_invoice/recurring_invoice_edit.php
index e1683efa9..712dcc694 100644
--- a/agent/modals/recurring_invoice/recurring_invoice_edit.php
+++ b/agent/modals/recurring_invoice/recurring_invoice_edit.php
@@ -6,7 +6,10 @@ enforceUserPermission('module_sales', 2);
 
 $recurring_invoice_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM recurring_invoices WHERE recurring_invoice_id = $recurring_invoice_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT recurring_invoice_category_id, recurring_invoice_client_id, recurring_invoice_created_at,
+    recurring_invoice_discount_amount, recurring_invoice_frequency,
+    recurring_invoice_next_date, recurring_invoice_number, recurring_invoice_prefix,
+    recurring_invoice_scope, recurring_invoice_status FROM recurring_invoices WHERE recurring_invoice_id = $recurring_invoice_id LIMIT 1");
 
 $row = mysqli_fetch_assoc($sql);
 $recurring_invoice_prefix = escapeHtml($row['recurring_invoice_prefix']);
@@ -82,7 +85,7 @@ ob_start();
                     <option value="">- Category -</option>
                     <?php
 
-                    $sql_income_category = mysqli_query($mysqli, "SELECT * FROM categories WHERE category_type = 'Income' AND (category_archived_at > '$recurring_invoice_created_at' OR category_archived_at IS NULL) ORDER BY category_name ASC");
+                    $sql_income_category = mysqli_query($mysqli, "SELECT category_id, category_name FROM categories WHERE category_type = 'Income' AND (category_archived_at > '$recurring_invoice_created_at' OR category_archived_at IS NULL) ORDER BY category_name ASC");
                     while ($row = mysqli_fetch_assoc($sql_income_category)) {
                         $category_id_select = intval($row['category_id']);
                         $category_name_select = escapeHtml($row['category_name']);
diff --git a/agent/modals/recurring_invoice/recurring_invoice_item_edit.php b/agent/modals/recurring_invoice/recurring_invoice_item_edit.php
index 756598c51..98165ce05 100644
--- a/agent/modals/recurring_invoice/recurring_invoice_item_edit.php
+++ b/agent/modals/recurring_invoice/recurring_invoice_item_edit.php
@@ -6,7 +6,8 @@ enforceUserPermission('module_sales', 2);
 
 $item_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM recurring_invoice_items LEFT JOIN recurring_invoices ON recurring_invoice_id = item_recurring_invoice_id WHERE item_id = $item_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT item_created_at, item_description, item_name, item_price, item_product_id, item_quantity,
+    item_tax_id, recurring_invoice_client_id FROM recurring_invoice_items LEFT JOIN recurring_invoices ON recurring_invoice_id = item_recurring_invoice_id WHERE item_id = $item_id LIMIT 1");
 $row = mysqli_fetch_assoc($sql);
 $item_name = escapeHtml($row['item_name']);
 $item_description = escapeHtml($row['item_description']);
@@ -87,7 +88,7 @@ ob_start();
                 <select class="form-control select2" name="tax_id" required>
                     <option value="0">No Tax</option>
                     <?php
-                        $taxes_sql = mysqli_query($mysqli, "SELECT * FROM taxes WHERE (tax_archived_at > '$item_created_at' OR tax_archived_at IS NULL) ORDER BY tax_name ASC");
+                        $taxes_sql = mysqli_query($mysqli, "SELECT tax_id, tax_name, tax_percent FROM taxes WHERE (tax_archived_at > '$item_created_at' OR tax_archived_at IS NULL) ORDER BY tax_name ASC");
                         while ($row = mysqli_fetch_assoc($taxes_sql)) {
                             $tax_id_select = intval($row['tax_id']);
                             $tax_name = escapeHtml($row['tax_name']);
diff --git a/agent/modals/recurring_ticket/recurring_ticket_add.php b/agent/modals/recurring_ticket/recurring_ticket_add.php
index 56f2c9b72..00dea5dbf 100644
--- a/agent/modals/recurring_ticket/recurring_ticket_add.php
+++ b/agent/modals/recurring_ticket/recurring_ticket_add.php
@@ -58,7 +58,7 @@ ob_start();
                                     <option value="">- Select a Client -</option>
                                     <?php
 
-                                    $sql = mysqli_query($mysqli, "SELECT * FROM clients WHERE client_archived_at IS NULL $access_permission_query ORDER BY client_name ASC");
+                                    $sql = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients WHERE client_archived_at IS NULL " . clientScopeSql('clients.client_id') . " ORDER BY client_name ASC");
                                     while ($row = mysqli_fetch_assoc($sql)) {
                                         $client_id_select = intval($row['client_id']);
                                         $client_name = escapeHtml($row['client_name']); ?>
diff --git a/agent/modals/recurring_ticket/recurring_ticket_edit.php b/agent/modals/recurring_ticket/recurring_ticket_edit.php
index 657f2b738..8d7b3505f 100644
--- a/agent/modals/recurring_ticket/recurring_ticket_edit.php
+++ b/agent/modals/recurring_ticket/recurring_ticket_edit.php
@@ -6,7 +6,10 @@ enforceUserPermission('module_support', 2);
 
 $recurring_ticket_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM recurring_tickets WHERE recurring_ticket_id = $recurring_ticket_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT recurring_ticket_asset_id, recurring_ticket_assigned_to, recurring_ticket_billable,
+    recurring_ticket_category, recurring_ticket_client_id, recurring_ticket_contact_id,
+    recurring_ticket_details, recurring_ticket_frequency, recurring_ticket_next_run,
+    recurring_ticket_priority, recurring_ticket_subject, recurring_ticket_ticket_template_id FROM recurring_tickets WHERE recurring_ticket_id = $recurring_ticket_id LIMIT 1");
 
 $row = mysqli_fetch_assoc($sql);
 $client_id = intval($row['recurring_ticket_client_id']);
diff --git a/agent/modals/revenue/revenue_add.php b/agent/modals/revenue/revenue_add.php
index 1f4ad4102..1c6091fcc 100644
--- a/agent/modals/revenue/revenue_add.php
+++ b/agent/modals/revenue/revenue_add.php
@@ -51,7 +51,7 @@ ob_start();
                         <option value="">- Account -</option>
                         <?php
 
-                        $sql = mysqli_query($mysqli, "SELECT * FROM accounts WHERE account_archived_at IS NULL ORDER BY account_name ASC");
+                        $sql = mysqli_query($mysqli, "SELECT account_currency_code, account_id, account_name, opening_balance FROM accounts WHERE account_archived_at IS NULL ORDER BY account_name ASC");
                         while ($row = mysqli_fetch_assoc($sql)) {
                             $account_id = intval($row['account_id']);
                             $account_name = escapeHtml($row['account_name']);
@@ -92,7 +92,7 @@ ob_start();
                         <option value="">- Category -</option>
                         <?php
 
-                        $sql = mysqli_query($mysqli, "SELECT * FROM categories WHERE category_type = 'Income' AND category_archived_at IS NULL ORDER BY category_name ASC");
+                        $sql = mysqli_query($mysqli, "SELECT category_id, category_name FROM categories WHERE category_type = 'Income' AND category_archived_at IS NULL ORDER BY category_name ASC");
                         while ($row = mysqli_fetch_assoc($sql)) {
                             $category_id = intval($row['category_id']);
                             $category_name = escapeHtml($row['category_name']);
@@ -131,7 +131,7 @@ ob_start();
                         <option value="">- Method of Payment -</option>
                         <?php
 
-                        $sql = mysqli_query($mysqli, "SELECT * FROM payment_methods ORDER BY payment_method_name ASC");
+                        $sql = mysqli_query($mysqli, "SELECT payment_method_name FROM payment_methods ORDER BY payment_method_name ASC");
                         while ($row = mysqli_fetch_assoc($sql)) {
                             $payment_method_name = escapeHtml($row['payment_method_name']);
                             ?>
diff --git a/agent/modals/revenue/revenue_edit.php b/agent/modals/revenue/revenue_edit.php
index 4663cc915..9dd9261a8 100644
--- a/agent/modals/revenue/revenue_edit.php
+++ b/agent/modals/revenue/revenue_edit.php
@@ -6,7 +6,9 @@ enforceUserPermission('module_financial', 2);
 
 $revenue_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM revenues WHERE revenue_id = $revenue_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT revenue_account_id, revenue_amount, revenue_category_id, revenue_created_at,
+    revenue_currency_code, revenue_date, revenue_description, revenue_payment_method,
+    revenue_reference FROM revenues WHERE revenue_id = $revenue_id LIMIT 1");
 
 $row = mysqli_fetch_assoc($sql);
 $revenue_description = escapeHtml($row['revenue_description']);
@@ -70,7 +72,7 @@ ob_start();
                         <option value="">- Select Account -</option>
                         <?php
 
-                        $sql_accounts = mysqli_query($mysqli, "SELECT * FROM accounts WHERE (account_archived_at > '$revenue_created_at' OR account_archived_at IS NULL) ORDER BY account_archived_at ASC, account_name ASC");
+                        $sql_accounts = mysqli_query($mysqli, "SELECT account_archived_at, account_currency_code, account_id, account_name, opening_balance FROM accounts WHERE (account_archived_at > '$revenue_created_at' OR account_archived_at IS NULL) ORDER BY account_archived_at ASC, account_name ASC");
                         while ($row = mysqli_fetch_assoc($sql_accounts)) {
                             $account_id_select = intval($row['account_id']);
                             $account_name_select = escapeHtml($row['account_name']);
@@ -116,7 +118,7 @@ ob_start();
                         <option value="">- Select Category -</option>
                         <?php
 
-                        $sql_category = mysqli_query($mysqli, "SELECT * FROM categories WHERE category_type = 'Income' AND (category_archived_at > '$revenue_created_at' OR category_archived_at IS NULL) ORDER BY category_name ASC");
+                        $sql_category = mysqli_query($mysqli, "SELECT category_id, category_name FROM categories WHERE category_type = 'Income' AND (category_archived_at > '$revenue_created_at' OR category_archived_at IS NULL) ORDER BY category_name ASC");
                         while ($row = mysqli_fetch_assoc($sql_category)) {
                             $category_id_select = intval($row['category_id']);
                             $category_name = escapeHtml($row['category_name']);
@@ -155,7 +157,7 @@ ob_start();
                         <option value="">- Select Method of Payment -</option>
                         <?php
 
-                        $sql_categories = mysqli_query($mysqli, "SELECT * FROM payment_methods ORDER BY payment_method_name ASC");
+                        $sql_categories = mysqli_query($mysqli, "SELECT payment_method_name FROM payment_methods ORDER BY payment_method_name ASC");
                         while ($row = mysqli_fetch_assoc($sql_categories)) {
                             $payment_method_name_select = escapeHtml($row['payment_method_name']);
                             ?>
diff --git a/agent/modals/service/service.php b/agent/modals/service/service.php
index 6a1f4c58f..a9f7abcf4 100644
--- a/agent/modals/service/service.php
+++ b/agent/modals/service/service.php
@@ -6,7 +6,9 @@ enforceUserPermission('module_support');
 
 $service_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM services WHERE service_id = $service_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT service_backup, service_category, service_client_id, service_created_at,
+    service_description, service_importance, service_name, service_notes, service_review_due,
+    service_updated_at FROM services WHERE service_id = $service_id LIMIT 1");
 $row = mysqli_fetch_assoc($sql);
 $service_name = escapeHtml($row['service_name']);
 $service_description = escapeHtml($row['service_description']);
@@ -55,7 +57,7 @@ $sql_credentials = mysqli_query(
 // Associated Domains
 $sql_domains = mysqli_query(
     $mysqli,
-    "SELECT * FROM service_domains
+    "SELECT domain_name FROM service_domains
     LEFT JOIN domains ON service_domains.domain_id = domains.domain_id
     WHERE service_id = $service_id"
 );
@@ -63,7 +65,7 @@ $sql_domains = mysqli_query(
 // Associated Certificates
 $sql_certificates = mysqli_query(
     $mysqli,
-    "SELECT * FROM service_certificates
+    "SELECT certificate_domain, certificate_name FROM service_certificates
     LEFT JOIN certificates ON service_certificates.certificate_id = certificates.certificate_id
     WHERE service_id = $service_id"
 );
@@ -71,7 +73,7 @@ $sql_certificates = mysqli_query(
 // Associated Vendors
 $sql_vendors = mysqli_query(
     $mysqli,
-    "SELECT * FROM service_vendors
+    "SELECT vendors.vendor_id, vendor_name FROM service_vendors
     LEFT JOIN vendors ON service_vendors.vendor_id = vendors.vendor_id
     WHERE service_id = $service_id"
 );
@@ -79,7 +81,7 @@ $sql_vendors = mysqli_query(
 // Associated Contacts
 $sql_contacts = mysqli_query(
     $mysqli,
-    "SELECT * FROM service_contacts
+    "SELECT service_contacts.contact_id, contact_name FROM service_contacts
     LEFT JOIN contacts ON service_contacts.contact_id = contacts.contact_id
     WHERE service_id = $service_id"
 );
@@ -87,7 +89,7 @@ $sql_contacts = mysqli_query(
 // Associated Documents
 $sql_docs = mysqli_query(
     $mysqli,
-    "SELECT * FROM service_documents
+    "SELECT documents.document_id, document_name FROM service_documents
     LEFT JOIN documents ON service_documents.document_id = documents.document_id
     WHERE service_id = $service_id"
 );
diff --git a/agent/modals/service/service_add.php b/agent/modals/service/service_add.php
index e721fe8e2..e103deabc 100644
--- a/agent/modals/service/service_add.php
+++ b/agent/modals/service/service_add.php
@@ -57,7 +57,7 @@ ob_start();
                                 <option value="">- Select Client -</option>
                                 <?php
 
-                                $sql = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients WHERE client_archived_at IS NULL $access_permission_query ORDER BY client_name ASC");
+                                $sql = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients WHERE client_archived_at IS NULL " . clientScopeSql('clients.client_id') . " ORDER BY client_name ASC");
                                 while ($row = mysqli_fetch_assoc($sql)) {
                                     $client_id = intval($row['client_id']);
                                     $client_name = escapeHtml($row['client_name']); ?>
@@ -138,7 +138,7 @@ ob_start();
                     <label for="contacts">Select related Contacts</label>
                     <select class="form-control select2" id="contacts" name="contacts[]" multiple>
                         <?php
-                        $sql = mysqli_query($mysqli, "SELECT * FROM contacts WHERE contact_archived_at IS NULL AND contact_client_id = $client_id");
+                        $sql = mysqli_query($mysqli, "SELECT contact_id, contact_name FROM contacts WHERE contact_archived_at IS NULL AND contact_client_id = $client_id");
                         while ($row = mysqli_fetch_assoc($sql)) {
                             $contact_id = intval($row['contact_id']);
                             $contact_name = escapeHtml($row['contact_name']);
@@ -152,7 +152,7 @@ ob_start();
                     <label for="vendors">Select related vendors</label>
                     <select class="form-control select2" id="vendors" name="vendors[]" multiple>
                         <?php
-                        $sql = mysqli_query($mysqli, "SELECT * FROM vendors WHERE vendor_archived_at IS NULL AND vendor_client_id = $client_id");
+                        $sql = mysqli_query($mysqli, "SELECT vendor_id, vendor_name FROM vendors WHERE vendor_archived_at IS NULL AND vendor_client_id = $client_id");
                         while ($row = mysqli_fetch_assoc($sql)) {
                             $vendor_id = intval($row['vendor_id']);
                             $vendor_name = escapeHtml($row['vendor_name']);
@@ -166,7 +166,7 @@ ob_start();
                     <label for="documents">Select related documents</label>
                     <select class="form-control select2" id="documents" name="documents[]" multiple>
                         <?php
-                        $sql = mysqli_query($mysqli, "SELECT * FROM documents WHERE document_archived_at IS NULL AND document_client_id = $client_id");
+                        $sql = mysqli_query($mysqli, "SELECT document_id, document_name FROM documents WHERE document_archived_at IS NULL AND document_client_id = $client_id");
                         while ($row = mysqli_fetch_assoc($sql)) {
                             $document_id = intval($row['document_id']);
                             $document_name = escapeHtml($row['document_name']);
@@ -186,7 +186,7 @@ ob_start();
                     <label for="assets">Select related assets</label>
                     <select class="form-control select2" id="assets" name="assets[]" multiple>
                         <?php
-                        $sql = mysqli_query($mysqli, "SELECT * FROM assets WHERE asset_archived_at IS NULL AND asset_client_id = $client_id");
+                        $sql = mysqli_query($mysqli, "SELECT asset_id, asset_name FROM assets WHERE asset_archived_at IS NULL AND asset_client_id = $client_id");
                         while ($row = mysqli_fetch_assoc($sql)) {
                             $asset_id = intval($row['asset_id']);
                             $asset_name = escapeHtml($row['asset_name']);
@@ -200,7 +200,7 @@ ob_start();
                     <label for="logins">Select related Credentials</label>
                     <select class="form-control select2" id="credentials" name="credentials[]" multiple>
                         <?php
-                        $sql = mysqli_query($mysqli, "SELECT * FROM credentials WHERE credential_archived_at IS NULL AND credential_client_id = $client_id");
+                        $sql = mysqli_query($mysqli, "SELECT credential_id, credential_name FROM credentials WHERE credential_archived_at IS NULL AND credential_client_id = $client_id");
                         while ($row = mysqli_fetch_assoc($sql)) {
                             $credential_id = intval($row['credential_id']);
                             $credential_name = escapeHtml($row['credential_name']);
@@ -214,7 +214,7 @@ ob_start();
                     <label for="domains">Select related domains</label>
                     <select class="form-control select2" id="domains" name="domains[]" multiple>
                         <?php
-                        $sql = mysqli_query($mysqli, "SELECT * FROM domains WHERE domain_archived_at IS NULL AND domain_client_id = $client_id");
+                        $sql = mysqli_query($mysqli, "SELECT domain_id, domain_name FROM domains WHERE domain_archived_at IS NULL AND domain_client_id = $client_id");
                         while ($row = mysqli_fetch_assoc($sql)) {
                             $domain_id = intval($row['domain_id']);
                             $domain_name = escapeHtml($row['domain_name']);
@@ -228,7 +228,7 @@ ob_start();
                     <label for="certificates">Select related certificates</label>
                     <select class="form-control select2" id="certificates" name="certificates[]" multiple>
                         <?php
-                        $sql = mysqli_query($mysqli, "SELECT * FROM certificates WHERE certificate_archived_at IS NULL AND certificate_client_id = $client_id");
+                        $sql = mysqli_query($mysqli, "SELECT certificate_domain, certificate_id, certificate_name FROM certificates WHERE certificate_archived_at IS NULL AND certificate_client_id = $client_id");
                         while ($row = mysqli_fetch_assoc($sql)) {
                             $cert_id = intval($row['certificate_id']);
                             $cert_name = escapeHtml($row['certificate_name']);
diff --git a/agent/modals/service/service_edit.php b/agent/modals/service/service_edit.php
index d78656d8f..925e9dfac 100644
--- a/agent/modals/service/service_edit.php
+++ b/agent/modals/service/service_edit.php
@@ -6,7 +6,9 @@ enforceUserPermission('module_support', 2);
 
 $service_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM services WHERE service_id = $service_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT service_backup, service_category, service_client_id, service_created_at,
+    service_description, service_importance, service_name, service_notes, service_review_due,
+    service_updated_at FROM services WHERE service_id = $service_id LIMIT 1");
 
 $row = mysqli_fetch_assoc($sql);
 $service_name = escapeHtml($row['service_name']);
@@ -193,7 +195,7 @@ ob_start();
                         // Get all contacts
                         // NOTE: These are called $sql_all and $row_all for a reason - anything overwriting $sql or $row will break the current while loop we are in from client_services.php
 
-                        $sql_all = mysqli_query($mysqli, "SELECT * FROM contacts WHERE (contact_archived_at > '$service_created_at' OR contact_archived_at IS NULL) AND contact_client_id = $client_id");
+                        $sql_all = mysqli_query($mysqli, "SELECT contact_id, contact_name FROM contacts WHERE (contact_archived_at > '$service_created_at' OR contact_archived_at IS NULL) AND contact_client_id = $client_id");
 
                         while ($row_all = mysqli_fetch_assoc($sql_all)) {
                             $contact_id = intval($row_all['contact_id']);
@@ -216,7 +218,7 @@ ob_start();
                         <?php
                         $selected_ids = array_column(mysqli_fetch_all($sql_vendors, MYSQLI_ASSOC), "vendor_id");
 
-                        $sql_all = mysqli_query($mysqli, "SELECT * FROM vendors WHERE (vendor_archived_at > '$service_created_at' OR vendor_archived_at IS NULL) AND vendor_client_id = $client_id");
+                        $sql_all = mysqli_query($mysqli, "SELECT vendor_id, vendor_name FROM vendors WHERE (vendor_archived_at > '$service_created_at' OR vendor_archived_at IS NULL) AND vendor_client_id = $client_id");
                         while ($row_all = mysqli_fetch_assoc($sql_all)) {
                             $vendor_id = intval($row_all['vendor_id']);
                             $vendor_name = escapeHtml($row_all['vendor_name']);
@@ -238,7 +240,7 @@ ob_start();
                         <?php
                         $selected_ids = array_column(mysqli_fetch_all($sql_docs, MYSQLI_ASSOC), "document_id");
 
-                        $sql_all = mysqli_query($mysqli, "SELECT * FROM documents WHERE document_archived_at IS NULL AND document_client_id = $client_id");
+                        $sql_all = mysqli_query($mysqli, "SELECT document_id, document_name FROM documents WHERE document_archived_at IS NULL AND document_client_id = $client_id");
                         while ($row_all = mysqli_fetch_assoc($sql_all)) {
                             $document_id = intval($row_all['document_id']);
                             $document_name = escapeHtml($row_all['document_name']);
@@ -268,7 +270,7 @@ ob_start();
                         <?php
                         $selected_ids = array_column(mysqli_fetch_all($sql_assets, MYSQLI_ASSOC), "asset_id");
 
-                        $sql_all = mysqli_query($mysqli, "SELECT * FROM assets WHERE (asset_archived_at > '$service_created_at' OR asset_archived_at IS NULL) AND asset_client_id = $client_id");
+                        $sql_all = mysqli_query($mysqli, "SELECT asset_id, asset_name FROM assets WHERE (asset_archived_at > '$service_created_at' OR asset_archived_at IS NULL) AND asset_client_id = $client_id");
                         while ($row_all = mysqli_fetch_assoc($sql_all)) {
                             $asset_id = intval($row_all['asset_id']);
                             $asset_name = escapeHtml($row_all['asset_name']);
@@ -290,7 +292,7 @@ ob_start();
                         <?php
                         $selected_ids = array_column(mysqli_fetch_all($sql_credentials, MYSQLI_ASSOC), "credential_id");
 
-                        $sql_all = mysqli_query($mysqli, "SELECT * FROM credentials WHERE (credential_archived_at > '$service_created_at' OR credential_archived_at IS NULL) AND credential_client_id = $client_id");
+                        $sql_all = mysqli_query($mysqli, "SELECT credential_id, credential_name FROM credentials WHERE (credential_archived_at > '$service_created_at' OR credential_archived_at IS NULL) AND credential_client_id = $client_id");
                         while ($row_all = mysqli_fetch_assoc($sql_all)) {
                             $credential_id = intval($row_all['credential_id']);
                             $credential_name = escapeHtml($row_all['credential_name']);
@@ -312,7 +314,7 @@ ob_start();
                         <?php
                         $selected_ids = array_column(mysqli_fetch_all($sql_domains, MYSQLI_ASSOC), "domain_id");
 
-                        $sql_all = mysqli_query($mysqli, "SELECT * FROM domains WHERE (domain_archived_at > '$service_created_at' OR domain_archived_at IS NULL) AND domain_client_id = $client_id");
+                        $sql_all = mysqli_query($mysqli, "SELECT domain_id, domain_name FROM domains WHERE (domain_archived_at > '$service_created_at' OR domain_archived_at IS NULL) AND domain_client_id = $client_id");
                         while ($row_all = mysqli_fetch_assoc($sql_all)) {
                             $domain_id = intval($row_all['domain_id']);
                             $domain_name = escapeHtml($row_all['domain_name']);
@@ -334,7 +336,7 @@ ob_start();
                         <?php
                         $selected_ids = array_column(mysqli_fetch_all($sql_certificates, MYSQLI_ASSOC), "certificate_id");
 
-                        $sql_all = mysqli_query($mysqli, "SELECT * FROM certificates WHERE (certificate_archived_at > '$service_created_at' OR certificate_archived_at IS NULL) AND certificate_client_id = $client_id");
+                        $sql_all = mysqli_query($mysqli, "SELECT certificate_id, certificate_name FROM certificates WHERE (certificate_archived_at > '$service_created_at' OR certificate_archived_at IS NULL) AND certificate_client_id = $client_id");
                         while ($row_all = mysqli_fetch_assoc($sql_all)) {
                             $cert_id = intval($row_all['certificate_id']);
                             $cert_name = escapeHtml($row_all['certificate_name']);
diff --git a/agent/modals/share_modal.php b/agent/modals/share_modal.php
index eb5f9431c..eb4a86db6 100644
--- a/agent/modals/share_modal.php
+++ b/agent/modals/share_modal.php
@@ -28,7 +28,7 @@
                                     <option value=""></option>
                                     <?php
 
-                                    $sql_client_contacts_select = mysqli_query($mysqli, "SELECT * FROM contacts WHERE contact_client_id = $client_id AND contact_email <> '' AND contact_archived_at IS NULL ORDER BY contact_name ASC");
+                                    $sql_client_contacts_select = mysqli_query($mysqli, "SELECT contact_email, contact_id, contact_name FROM contacts WHERE contact_client_id = $client_id AND contact_email <> '' AND contact_archived_at IS NULL ORDER BY contact_name ASC");
                                     while ($row = mysqli_fetch_assoc($sql_client_contacts_select)) {
                                         $contact_id_select = intval($row['contact_id']);
                                         $contact_name_select = escapeHtml($row['contact_name']);
diff --git a/agent/modals/software/software_add.php b/agent/modals/software/software_add.php
index 0f5701414..a79f0e783 100644
--- a/agent/modals/software/software_add.php
+++ b/agent/modals/software/software_add.php
@@ -68,7 +68,7 @@ ob_start();
                                 <option value="">- Select Client -</option>
                                 <?php
 
-                                $sql = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients WHERE client_archived_at IS NULL $access_permission_query ORDER BY client_name ASC");
+                                $sql = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients WHERE client_archived_at IS NULL " . clientScopeSql('clients.client_id') . " ORDER BY client_name ASC");
                                 while ($row = mysqli_fetch_assoc($sql)) {
                                     $client_id_select = intval($row['client_id']);
                                     $client_name = escapeHtml($row['client_name']); ?>
@@ -244,7 +244,7 @@ ob_start();
 
 
                     <?php
-                    $sql_assets_select = mysqli_query($mysqli, "SELECT * FROM assets LEFT JOIN contacts ON asset_contact_id = contact_id WHERE asset_archived_at IS NULL AND asset_client_id = $client_id ORDER BY asset_archived_at ASC, asset_name ASC");
+                    $sql_assets_select = mysqli_query($mysqli, "SELECT asset_archived_at, asset_id, asset_name, asset_type, contact_name FROM assets LEFT JOIN contacts ON asset_contact_id = contact_id WHERE asset_archived_at IS NULL AND asset_client_id = $client_id ORDER BY asset_archived_at ASC, asset_name ASC");
 
                     while ($row = mysqli_fetch_assoc($sql_assets_select)) {
                         $asset_id_select = intval($row['asset_id']);
@@ -284,7 +284,7 @@ ob_start();
                     </li>
 
                     <?php
-                    $sql_contacts_select = mysqli_query($mysqli, "SELECT * FROM contacts WHERE contact_archived_at IS NULL AND contact_client_id = $client_id ORDER BY contact_name ASC");
+                    $sql_contacts_select = mysqli_query($mysqli, "SELECT contact_email, contact_id, contact_name FROM contacts WHERE contact_archived_at IS NULL AND contact_client_id = $client_id ORDER BY contact_name ASC");
 
                     while ($row = mysqli_fetch_assoc($sql_contacts_select)) {
                         $contact_id_select = intval($row['contact_id']);
diff --git a/agent/modals/software/software_add_from_template.php b/agent/modals/software/software_add_from_template.php
index 9c2b6f96d..264263ba7 100644
--- a/agent/modals/software/software_add_from_template.php
+++ b/agent/modals/software/software_add_from_template.php
@@ -33,7 +33,7 @@ ob_start();
                         <option value="">- Select Client -</option>
                         <?php
 
-                        $sql = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients WHERE client_archived_at IS NULL $access_permission_query ORDER BY client_name ASC");
+                        $sql = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients WHERE client_archived_at IS NULL " . clientScopeSql('clients.client_id') . " ORDER BY client_name ASC");
                         while ($row = mysqli_fetch_assoc($sql)) {
                             $client_id_select = intval($row['client_id']);
                             $client_name_select = escapeHtml($row['client_name']); ?>
@@ -55,7 +55,7 @@ ob_start();
                 <select class="form-control" name="software_template_id" required>
                     <option value="">- Select Template -</option>
                     <?php
-                    $sql_software_templates = mysqli_query($mysqli, "SELECT * FROM software_templates WHERE software_template_archived_at IS NULL ORDER BY software_template_name ASC");
+                    $sql_software_templates = mysqli_query($mysqli, "SELECT software_template_id, software_template_name FROM software_templates WHERE software_template_archived_at IS NULL ORDER BY software_template_name ASC");
                     while ($row = mysqli_fetch_assoc($sql_software_templates)) {
                         $software_template_id = intval($row['software_template_id']);
                         $software_template_name = escapeHtml($row['software_template_name']);
diff --git a/agent/modals/software/software_edit.php b/agent/modals/software/software_edit.php
index 80e23a5a7..2273ae0d8 100644
--- a/agent/modals/software/software_edit.php
+++ b/agent/modals/software/software_edit.php
@@ -6,7 +6,10 @@ enforceUserPermission('module_support', 2);
 
 $software_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM software WHERE software_id = $software_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT software_client_id, software_created_at, software_description, software_expire,
+    software_key, software_license_type, software_name, software_notes, software_purchase,
+    software_purchase_reference, software_seats, software_type, software_vendor_id,
+    software_version FROM software WHERE software_id = $software_id LIMIT 1");
 
 $row = mysqli_fetch_assoc($sql);
 $software_name = escapeHtml($row['software_name']);
@@ -258,7 +261,7 @@ ob_start();
 
 
                     <?php
-                    $sql_assets_select = mysqli_query($mysqli, "SELECT * FROM assets LEFT JOIN contacts ON asset_contact_id = contact_id WHERE (asset_archived_at > '$software_created_at' OR asset_archived_at IS NULL) AND asset_client_id = $client_id ORDER BY asset_archived_at ASC, asset_name ASC");
+                    $sql_assets_select = mysqli_query($mysqli, "SELECT asset_archived_at, asset_id, asset_name, asset_type, contact_name FROM assets LEFT JOIN contacts ON asset_contact_id = contact_id WHERE (asset_archived_at > '$software_created_at' OR asset_archived_at IS NULL) AND asset_client_id = $client_id ORDER BY asset_archived_at ASC, asset_name ASC");
 
                     while ($row = mysqli_fetch_assoc($sql_assets_select)) {
                         $asset_id_select = intval($row['asset_id']);
@@ -298,7 +301,7 @@ ob_start();
                     </li>
 
                     <?php
-                    $sql_contacts_select = mysqli_query($mysqli, "SELECT * FROM contacts WHERE (contact_archived_at > '$software_created_at' OR contact_archived_at IS NULL) AND contact_client_id = $client_id ORDER BY contact_archived_at ASC, contact_name ASC");
+                    $sql_contacts_select = mysqli_query($mysqli, "SELECT contact_archived_at, contact_email, contact_id, contact_name FROM contacts WHERE (contact_archived_at > '$software_created_at' OR contact_archived_at IS NULL) AND contact_client_id = $client_id ORDER BY contact_archived_at ASC, contact_name ASC");
 
                     while ($row = mysqli_fetch_assoc($sql_contacts_select)) {
                         $contact_id_select = intval($row['contact_id']);
diff --git a/agent/modals/ticket/ticket_add.php b/agent/modals/ticket/ticket_add.php
index caeae4195..9f250c2a9 100644
--- a/agent/modals/ticket/ticket_add.php
+++ b/agent/modals/ticket/ticket_add.php
@@ -62,7 +62,7 @@ ob_start();
                                     <option value="">- Select a Client -</option>
                                     <?php
 
-                                    $sql = mysqli_query($mysqli, "SELECT * FROM clients WHERE client_lead = 0 AND client_archived_at IS NULL $access_permission_query ORDER BY client_name ASC");
+                                    $sql = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients WHERE client_lead = 0 AND client_archived_at IS NULL " . clientScopeSql('clients.client_id') . " ORDER BY client_name ASC");
                                     while ($row = mysqli_fetch_assoc($sql)) {
                                         $client_id_select = intval($row['client_id']);
                                         $client_name = escapeHtml($row['client_name']); ?>
diff --git a/agent/modals/ticket/ticket_assign.php b/agent/modals/ticket/ticket_assign.php
index 2b734afd5..07c784278 100644
--- a/agent/modals/ticket/ticket_assign.php
+++ b/agent/modals/ticket/ticket_assign.php
@@ -6,7 +6,8 @@ enforceUserPermission('module_support', 2);
 
 $ticket_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM tickets
+$sql = mysqli_query($mysqli, "SELECT client_name, ticket_assigned_to, ticket_client_id, ticket_closed_at, ticket_number,
+    ticket_prefix, ticket_status FROM tickets
     LEFT JOIN clients ON client_id = ticket_client_id
     WHERE ticket_id = $ticket_id
     LIMIT 1"
diff --git a/agent/modals/ticket/ticket_billable.php b/agent/modals/ticket/ticket_billable.php
index 657386f67..afa743f91 100644
--- a/agent/modals/ticket/ticket_billable.php
+++ b/agent/modals/ticket/ticket_billable.php
@@ -6,7 +6,7 @@ enforceUserPermission('module_support', 2);
 
 $ticket_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM tickets WHERE ticket_id = $ticket_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT ticket_billable, ticket_client_id, ticket_number, ticket_prefix FROM tickets WHERE ticket_id = $ticket_id LIMIT 1");
 
 $row = mysqli_fetch_assoc($sql);
 $ticket_prefix = escapeHtml($row['ticket_prefix']);
diff --git a/agent/modals/ticket/ticket_bulk_merge.php b/agent/modals/ticket/ticket_bulk_merge.php
index 0558600d2..16ac34a9c 100644
--- a/agent/modals/ticket/ticket_bulk_merge.php
+++ b/agent/modals/ticket/ticket_bulk_merge.php
@@ -12,7 +12,7 @@ if (!empty($ticket_ids)) {
     $whereNotIn = "AND ticket_id NOT IN ($ids)";
 }
 
-$sql_merge = mysqli_query($mysqli, "SELECT * FROM tickets
+$sql_merge = mysqli_query($mysqli, "SELECT client_name, ticket_id, ticket_number, ticket_prefix, ticket_status_name, ticket_subject FROM tickets
     LEFT JOIN ticket_statuses ON ticket_status = ticket_status_id
     LEFT JOIN clients ON client_id = ticket_client_id
     WHERE ticket_closed_at IS NULL
diff --git a/agent/modals/ticket/ticket_bulk_reply.php b/agent/modals/ticket/ticket_bulk_reply.php
index 32a64d4bf..342f0c8a9 100644
--- a/agent/modals/ticket/ticket_bulk_reply.php
+++ b/agent/modals/ticket/ticket_bulk_reply.php
@@ -31,7 +31,7 @@ ob_start();
             <select class="form-control select2" name="bulk_status" required>
 
                 <!-- Show all active ticket statuses, apart from new or closed as these are system-managed -->
-                <?php $sql_ticket_status = mysqli_query($mysqli, "SELECT * FROM ticket_statuses WHERE ticket_status_id != 1 AND ticket_status_id != 5 AND ticket_status_active = 1");
+                <?php $sql_ticket_status = mysqli_query($mysqli, "SELECT ticket_status_id, ticket_status_name FROM ticket_statuses WHERE ticket_status_id != 1 AND ticket_status_id != 5 AND ticket_status_active = 1");
                 while ($row = mysqli_fetch_assoc($sql_ticket_status)) {
                     $ticket_status_id_select = intval($row['ticket_status_id']);
                     $ticket_status_name_select = escapeHtml($row['ticket_status_name']); ?>
diff --git a/agent/modals/ticket/ticket_change_client.php b/agent/modals/ticket/ticket_change_client.php
index fbb4314c9..2d570be0c 100644
--- a/agent/modals/ticket/ticket_change_client.php
+++ b/agent/modals/ticket/ticket_change_client.php
@@ -6,7 +6,7 @@ enforceUserPermission('module_support', 2);
 
 $ticket_id = intval($_GET['ticket_id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM tickets WHERE ticket_id = $ticket_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT ticket_client_id, ticket_number, ticket_prefix FROM tickets WHERE ticket_id = $ticket_id LIMIT 1");
 
 $row = mysqli_fetch_assoc($sql);
 $ticket_prefix = escapeHtml($row['ticket_prefix']);
@@ -42,7 +42,7 @@ ob_start();
                 </div>
                 <select class="form-control select2" name="new_client_id" id="client_select" required>
                     <?php
-                    $sql_clients = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients WHERE client_lead = 0 AND client_archived_at IS NULL $access_permission_query ORDER BY client_name ASC");
+                    $sql_clients = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients WHERE client_lead = 0 AND client_archived_at IS NULL " . clientScopeSql('clients.client_id') . " ORDER BY client_name ASC");
                     while ($row = mysqli_fetch_assoc($sql_clients)) {
                         $client_id_select = intval($row['client_id']);
                         $client_name = escapeHtml($row['client_name']);
diff --git a/agent/modals/ticket/ticket_contact.php b/agent/modals/ticket/ticket_contact.php
index ff1a94a26..e72ccc797 100644
--- a/agent/modals/ticket/ticket_contact.php
+++ b/agent/modals/ticket/ticket_contact.php
@@ -6,7 +6,7 @@ enforceUserPermission('module_support', 2);
 
 $ticket_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM tickets
+$sql = mysqli_query($mysqli, "SELECT client_name, ticket_client_id, ticket_contact_id, ticket_number, ticket_prefix FROM tickets
     LEFT JOIN clients ON client_id = ticket_client_id
     WHERE ticket_id = $ticket_id
     LIMIT 1"
diff --git a/agent/modals/ticket/ticket_edit.php b/agent/modals/ticket/ticket_edit.php
index fa9baad1a..5a3b6b042 100644
--- a/agent/modals/ticket/ticket_edit.php
+++ b/agent/modals/ticket/ticket_edit.php
@@ -4,18 +4,15 @@ require_once '../../../includes/modal_header.php';
 
 enforceUserPermission('module_support', 2);
 
-// Ticket client access overide - This is the only way to show tickets without a client to agents with restricted client access
-$access_permission_query_overide = '';
-if ($client_access_string) {
-    $access_permission_query_overide .= " AND ticket_client_id IN (0,$client_access_string)";
-}
-if ($client_deny_string) {
-    $access_permission_query_overide .= " AND ticket_client_id NOT IN ($client_deny_string)";
-}
+// Tickets with no client stay visible to restricted agents - clientScopeSql() includes 0
+$access_permission_query_overide = clientScopeSql('ticket_client_id');
 
 $ticket_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM tickets LEFT JOIN clients ON client_id = ticket_client_id WHERE ticket_id = $ticket_id $access_permission_query_overide LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT client_id, client_name, ticket_asset_id, ticket_assigned_to, ticket_billable,
+    ticket_category, ticket_contact_id, ticket_created_at, ticket_details, ticket_due_at,
+    ticket_location_id, ticket_number, ticket_prefix, ticket_priority, ticket_project_id,
+    ticket_subject, ticket_vendor_id, ticket_vendor_ticket_number FROM tickets LEFT JOIN clients ON client_id = ticket_client_id WHERE ticket_id = $ticket_id $access_permission_query_overide LIMIT 1");
 
 $row = mysqli_fetch_assoc($sql);
 $client_id = intval($row['client_id']);
diff --git a/agent/modals/ticket/ticket_edit_asset.php b/agent/modals/ticket/ticket_edit_asset.php
index d9c75caa8..3644db2da 100644
--- a/agent/modals/ticket/ticket_edit_asset.php
+++ b/agent/modals/ticket/ticket_edit_asset.php
@@ -6,7 +6,7 @@ enforceUserPermission('module_support', 2);
 
 $ticket_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM tickets LEFT JOIN clients ON client_id = ticket_client_id WHERE ticket_id = $ticket_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT client_name, ticket_asset_id, ticket_client_id, ticket_number, ticket_prefix FROM tickets LEFT JOIN clients ON client_id = ticket_client_id WHERE ticket_id = $ticket_id LIMIT 1");
 
 $row = mysqli_fetch_assoc($sql);
 $client_name = escapeHtml($row['client_name']);
diff --git a/agent/modals/ticket/ticket_edit_project.php b/agent/modals/ticket/ticket_edit_project.php
index d3880e04d..0fcc89c75 100644
--- a/agent/modals/ticket/ticket_edit_project.php
+++ b/agent/modals/ticket/ticket_edit_project.php
@@ -6,7 +6,7 @@ enforceUserPermission('module_support', 2);
 
 $ticket_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM tickets LEFT JOIN clients ON client_id = ticket_client_id WHERE ticket_id = $ticket_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT client_name, ticket_client_id, ticket_number, ticket_prefix, ticket_project_id FROM tickets LEFT JOIN clients ON client_id = ticket_client_id WHERE ticket_id = $ticket_id LIMIT 1");
 
 $row = mysqli_fetch_assoc($sql);
 $client_name = escapeHtml($row['client_name']);
diff --git a/agent/modals/ticket/ticket_edit_schedule.php b/agent/modals/ticket/ticket_edit_schedule.php
index 579001886..ebb7d6cb1 100644
--- a/agent/modals/ticket/ticket_edit_schedule.php
+++ b/agent/modals/ticket/ticket_edit_schedule.php
@@ -6,7 +6,8 @@ enforceUserPermission('module_support', 2);
 
 $ticket_id = intval($_GET['ticket_id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM tickets
+$sql = mysqli_query($mysqli, "SELECT client_name, ticket_client_id, ticket_number, ticket_onsite, ticket_prefix,
+    ticket_schedule FROM tickets
     LEFT JOIN clients ON client_id = ticket_client_id
     WHERE ticket_id = $ticket_id
     LIMIT 1"
diff --git a/agent/modals/ticket/ticket_edit_vendor.php b/agent/modals/ticket/ticket_edit_vendor.php
index f9bbc0e1a..33ce877e0 100644
--- a/agent/modals/ticket/ticket_edit_vendor.php
+++ b/agent/modals/ticket/ticket_edit_vendor.php
@@ -6,7 +6,7 @@ enforceUserPermission('module_support', 2);
 
 $ticket_id = intval($_GET['ticket_id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM tickets WHERE ticket_id = $ticket_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT ticket_client_id, ticket_number, ticket_prefix, ticket_vendor_id FROM tickets WHERE ticket_id = $ticket_id LIMIT 1");
 
 $row = mysqli_fetch_assoc($sql);
 $ticket_prefix = escapeHtml($row['ticket_prefix']);
diff --git a/agent/modals/ticket/ticket_invoice_add.php b/agent/modals/ticket/ticket_invoice_add.php
index 3ffe6c6c7..f8118cebd 100644
--- a/agent/modals/ticket/ticket_invoice_add.php
+++ b/agent/modals/ticket/ticket_invoice_add.php
@@ -6,7 +6,12 @@ $ticket_id = intval($_GET['ticket_id']);
 
 $ticket_sql = mysqli_query(
     $mysqli,
-    "SELECT * FROM tickets
+    "SELECT asset_id, asset_name, asset_type, category_name, client_id, client_rate, contact_id,
+        contact_name, location_address, location_city, location_id, location_name, location_phone,
+        location_state, location_zip, ticket_assigned_to, ticket_billable, ticket_category,
+        ticket_created_at, ticket_created_by, ticket_first_response_at, ticket_number,
+        ticket_onsite, ticket_prefix, ticket_priority, ticket_quote_id, ticket_resolved_at,
+        ticket_subject, user_name FROM tickets
     LEFT JOIN clients ON ticket_client_id = client_id
     LEFT JOIN contacts ON ticket_contact_id = contact_id
     LEFT JOIN users ON ticket_assigned_to = user_id
@@ -15,7 +20,7 @@ $ticket_sql = mysqli_query(
     LEFT JOIN ticket_statuses ON ticket_status = ticket_status_id
     LEFT JOIN categories ON ticket_category = category_id
     WHERE ticket_id = $ticket_id
-    $access_permission_query
+    " . clientScopeSql('ticket_client_id') . "
     LIMIT 1"
 );
 
@@ -81,7 +86,8 @@ $row = mysqli_fetch_assoc($ticket_total_reply_time);
 $ticket_total_reply_time = escapeHtml($row['ticket_total_reply_time']);
 $ticket_total_reply_time_display = formatDuration($ticket_total_reply_time);
 
-$sql_invoices = mysqli_query($mysqli, "SELECT * FROM invoices WHERE invoice_status LIKE 'Draft' AND invoice_client_id = $client_id ORDER BY invoice_number ASC");
+$sql_invoices = mysqli_query($mysqli, "SELECT invoice_amount, invoice_date, invoice_due, invoice_id, invoice_number, invoice_prefix,
+    invoice_scope, invoice_status FROM invoices WHERE invoice_status LIKE 'Draft' AND invoice_client_id = $client_id ORDER BY invoice_number ASC");
 
 ob_start();
 
@@ -183,7 +189,7 @@ ob_start();
                                     <option value="">- Select a Category -</option>
                                     <?php
 
-                                    $sql = mysqli_query($mysqli, "SELECT * FROM categories WHERE category_type = 'Income' AND category_archived_at IS NULL ORDER BY category_name ASC");
+                                    $sql = mysqli_query($mysqli, "SELECT category_id, category_name FROM categories WHERE category_type = 'Income' AND category_archived_at IS NULL ORDER BY category_name ASC");
                                     while ($row = mysqli_fetch_assoc($sql)) {
                                         $category_id = intval($row['category_id']);
                                         $category_name = escapeHtml($row['category_name']);
@@ -314,7 +320,7 @@ ob_start();
                     <option value="0">None</option>
                     <?php
 
-                    $taxes_sql = mysqli_query($mysqli, "SELECT * FROM taxes WHERE tax_archived_at IS NULL ORDER BY tax_name ASC");
+                    $taxes_sql = mysqli_query($mysqli, "SELECT tax_id, tax_name, tax_percent FROM taxes WHERE tax_archived_at IS NULL ORDER BY tax_name ASC");
                     while ($row = mysqli_fetch_assoc($taxes_sql)) {
                         $tax_id_select = intval($row['tax_id']);
                         $tax_name = escapeHtml($row['tax_name']);
diff --git a/agent/modals/ticket/ticket_merge.php b/agent/modals/ticket/ticket_merge.php
index 36d064669..ccb799456 100644
--- a/agent/modals/ticket/ticket_merge.php
+++ b/agent/modals/ticket/ticket_merge.php
@@ -6,7 +6,7 @@ enforceUserPermission('module_support', 2);
 
 $ticket_id = intval($_GET['ticket_id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM tickets
+$sql = mysqli_query($mysqli, "SELECT client_name, ticket_client_id, ticket_number, ticket_prefix FROM tickets
     LEFT JOIN clients ON client_id = ticket_client_id
     WHERE ticket_id = $ticket_id
     LIMIT 1"
@@ -22,12 +22,12 @@ if ($client_id) {
     enforceClientAccess();
 }
 
-$sql_merge = mysqli_query($mysqli, "SELECT * FROM tickets
+$sql_merge = mysqli_query($mysqli, "SELECT client_name, ticket_id, ticket_number, ticket_prefix, ticket_status_name, ticket_subject FROM tickets
     LEFT JOIN ticket_statuses ON ticket_status = ticket_status_id
     LEFT JOIN clients ON client_id = ticket_client_id
     WHERE ticket_closed_at IS NULL
     AND ticket_id != $ticket_id
-    $access_permission_query
+    " . clientScopeSql('ticket_client_id') . "
     ORDER BY ticket_status ASC, ticket_id DESC"
 );
 
diff --git a/agent/modals/ticket/ticket_priority.php b/agent/modals/ticket/ticket_priority.php
index cd7dbf91a..ba9374f69 100644
--- a/agent/modals/ticket/ticket_priority.php
+++ b/agent/modals/ticket/ticket_priority.php
@@ -6,7 +6,7 @@ enforceUserPermission('module_support', 2);
 
 $ticket_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM tickets
+$sql = mysqli_query($mysqli, "SELECT client_name, ticket_client_id, ticket_number, ticket_prefix, ticket_priority FROM tickets
     LEFT JOIN clients ON client_id = ticket_client_id
     WHERE ticket_id = $ticket_id
     LIMIT 1"
diff --git a/agent/modals/ticket/ticket_quote_add.php b/agent/modals/ticket/ticket_quote_add.php
index 40b32683c..3f4d819a4 100644
--- a/agent/modals/ticket/ticket_quote_add.php
+++ b/agent/modals/ticket/ticket_quote_add.php
@@ -6,7 +6,10 @@ $ticket_id = intval($_GET['ticket_id']);
 
 $ticket_sql = mysqli_query(
     $mysqli,
-    "SELECT * FROM tickets
+    "SELECT asset_id, asset_name, asset_type, category_name, client_id, client_rate, contact_id,
+        contact_name, ticket_assigned_to, ticket_billable, ticket_category, ticket_created_at,
+        ticket_created_by, ticket_first_response_at, ticket_number, ticket_onsite, ticket_prefix,
+        ticket_priority, ticket_resolved_at, ticket_subject, user_name FROM tickets
     LEFT JOIN clients ON ticket_client_id = client_id
     LEFT JOIN contacts ON ticket_contact_id = contact_id
     LEFT JOIN users ON ticket_assigned_to = user_id
@@ -15,7 +18,7 @@ $ticket_sql = mysqli_query(
     LEFT JOIN ticket_statuses ON ticket_status = ticket_status_id
     LEFT JOIN categories ON ticket_category = category_id
     WHERE ticket_id = $ticket_id
-    $access_permission_query
+    " . clientScopeSql('ticket_client_id') . "
     LIMIT 1"
 );
 
@@ -107,7 +110,7 @@ ob_start();
                             <select class="form-control select2" name="category">
                                 <option value="">- Select a Category -</option>
                                 <?php
-                                $sql = mysqli_query($mysqli, "SELECT * FROM categories WHERE category_type = 'Income' AND category_archived_at IS NULL ORDER BY category_name ASC");
+                                $sql = mysqli_query($mysqli, "SELECT category_id, category_name FROM categories WHERE category_type = 'Income' AND category_archived_at IS NULL ORDER BY category_name ASC");
                                 while ($row = mysqli_fetch_assoc($sql)) {
                                     $category_id = intval($row['category_id']);
                                     $category_name = escapeHtml($row['category_name']);
@@ -213,7 +216,7 @@ ob_start();
                     <select class="form-control select2" name="tax_id" required>
                         <option value="0">None</option>
                         <?php
-                        $taxes_sql = mysqli_query($mysqli, "SELECT * FROM taxes WHERE tax_archived_at IS NULL ORDER BY tax_name ASC");
+                        $taxes_sql = mysqli_query($mysqli, "SELECT tax_id, tax_name, tax_percent FROM taxes WHERE tax_archived_at IS NULL ORDER BY tax_name ASC");
                         while ($row = mysqli_fetch_assoc($taxes_sql)) {
                             $tax_id_select = intval($row['tax_id']);
                             $tax_name = escapeHtml($row['tax_name']);
diff --git a/agent/modals/ticket/ticket_reply_edit.php b/agent/modals/ticket/ticket_reply_edit.php
index 9322f911b..398571ac2 100644
--- a/agent/modals/ticket/ticket_reply_edit.php
+++ b/agent/modals/ticket/ticket_reply_edit.php
@@ -4,7 +4,7 @@ require_once '../../../includes/modal_header.php';
 
 $ticket_reply_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM ticket_replies
+$sql = mysqli_query($mysqli, "SELECT ticket_client_id, ticket_reply, ticket_reply_time_worked, ticket_reply_type FROM ticket_replies
     LEFT JOIN tickets ON ticket_id = ticket_reply_ticket_id
     WHERE ticket_reply_id = $ticket_reply_id
     LIMIT 1"
diff --git a/agent/modals/ticket/ticket_reply_redact.php b/agent/modals/ticket/ticket_reply_redact.php
index dbed855c4..f54177519 100644
--- a/agent/modals/ticket/ticket_reply_redact.php
+++ b/agent/modals/ticket/ticket_reply_redact.php
@@ -6,7 +6,7 @@ enforceUserPermission('module_support', 2);
 
 $ticket_reply_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM ticket_replies
+$sql = mysqli_query($mysqli, "SELECT ticket_client_id, ticket_reply FROM ticket_replies
     LEFT JOIN tickets ON ticket_id = ticket_reply_ticket_id
     WHERE ticket_reply_id = $ticket_reply_id
     LIMIT 1"
diff --git a/agent/modals/ticket/ticket_sla.php b/agent/modals/ticket/ticket_sla.php
index 0df1de4d6..e1a10de29 100644
--- a/agent/modals/ticket/ticket_sla.php
+++ b/agent/modals/ticket/ticket_sla.php
@@ -6,8 +6,7 @@ enforceUserPermission('module_support', 2);
 
 $ticket_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM tickets
-    LEFT JOIN clients ON client_id = ticket_client_id
+$sql = mysqli_query($mysqli, "SELECT ticket_client_id, ticket_number, ticket_prefix, ticket_sla_id FROM tickets
     WHERE ticket_id = $ticket_id
     LIMIT 1"
 );
diff --git a/agent/modals/ticket/ticket_task_approver_add.php b/agent/modals/ticket/ticket_task_approver_add.php
index e58452b5f..a3b9f07f9 100644
--- a/agent/modals/ticket/ticket_task_approver_add.php
+++ b/agent/modals/ticket/ticket_task_approver_add.php
@@ -6,7 +6,7 @@ enforceUserPermission('module_support', 2);
 
 $task_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM tasks
+$sql = mysqli_query($mysqli, "SELECT task_name, ticket_client_id FROM tasks
     LEFT JOIN tickets ON task_ticket_id = ticket_id
     WHERE task_id = $task_id
     LIMIT 1"
diff --git a/agent/modals/ticket/ticket_task_edit.php b/agent/modals/ticket/ticket_task_edit.php
index 30e0ff355..cb037ac76 100644
--- a/agent/modals/ticket/ticket_task_edit.php
+++ b/agent/modals/ticket/ticket_task_edit.php
@@ -6,7 +6,7 @@ enforceUserPermission('module_support', 2);
 
 $task_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM tasks LEFT JOIN tickets ON task_ticket_id = ticket_id
+$sql = mysqli_query($mysqli, "SELECT task_completed_at, task_completion_estimate, task_name, ticket_client_id FROM tasks LEFT JOIN tickets ON task_ticket_id = ticket_id
     WHERE task_id = $task_id
     LIMIT 1"
 );
diff --git a/agent/modals/transaction/transaction_export.php b/agent/modals/transaction/transaction_export.php
index 1fd5ec558..ffc62e648 100644
--- a/agent/modals/transaction/transaction_export.php
+++ b/agent/modals/transaction/transaction_export.php
@@ -100,7 +100,7 @@ ob_start();
                     <option value="">- Select an Account -</option>
 
                     <?php
-                    $sql_accounts_filter = mysqli_query($mysqli, "SELECT * FROM accounts WHERE account_archived_at IS NULL ORDER BY account_name ASC");
+                    $sql_accounts_filter = mysqli_query($mysqli, "SELECT account_id, account_name FROM accounts WHERE account_archived_at IS NULL ORDER BY account_name ASC");
                     while ($row = mysqli_fetch_assoc($sql_accounts_filter)) {
                         $account_id = intval($row['account_id']);
                         $account_name = escapeHtml($row['account_name']);
diff --git a/agent/modals/transfer/transfer_add.php b/agent/modals/transfer/transfer_add.php
index feb49abfa..10217e7dc 100644
--- a/agent/modals/transfer/transfer_add.php
+++ b/agent/modals/transfer/transfer_add.php
@@ -50,7 +50,7 @@ ob_start();
                     <option value="">- Account From -</option>
                     <?php
 
-                    $sql = mysqli_query($mysqli, "SELECT * FROM accounts WHERE account_archived_at IS NULL ORDER BY account_name ASC");
+                    $sql = mysqli_query($mysqli, "SELECT account_id, account_name, opening_balance FROM accounts WHERE account_archived_at IS NULL ORDER BY account_name ASC");
                     while ($row = mysqli_fetch_assoc($sql)) {
                         $account_id = intval($row['account_id']);
                         $account_name = escapeHtml($row['account_name']);
@@ -88,7 +88,7 @@ ob_start();
                     <option value="">- Account To -</option>
                     <?php
 
-                    $sql = mysqli_query($mysqli, "SELECT * FROM accounts WHERE account_archived_at IS NULL ORDER BY account_name ASC");
+                    $sql = mysqli_query($mysqli, "SELECT account_id, account_name, opening_balance FROM accounts WHERE account_archived_at IS NULL ORDER BY account_name ASC");
                     while ($row = mysqli_fetch_assoc($sql)) {
                         $account_id = intval($row['account_id']);
                         $account_name = escapeHtml($row['account_name']);
@@ -159,7 +159,7 @@ ob_start();
                     <option value="">- Method of Transfer -</option>
                     <?php
 
-                    $sql = mysqli_query($mysqli, "SELECT * FROM payment_methods ORDER BY payment_method_name ASC");
+                    $sql = mysqli_query($mysqli, "SELECT payment_method_name FROM payment_methods ORDER BY payment_method_name ASC");
                     while ($row = mysqli_fetch_assoc($sql)) {
                         $payment_method_name = escapeHtml($row['payment_method_name']);
                     ?>
diff --git a/agent/modals/transfer/transfer_edit.php b/agent/modals/transfer/transfer_edit.php
index 4a525f07d..b6c09ce1e 100644
--- a/agent/modals/transfer/transfer_edit.php
+++ b/agent/modals/transfer/transfer_edit.php
@@ -75,7 +75,7 @@ ob_start();
                 <select class="form-control select2" name="account_from" required>
                     <?php
 
-                    $sql_accounts = mysqli_query($mysqli, "SELECT * FROM accounts WHERE (account_archived_at > '$transfer_created_at' OR account_archived_at IS NULL) ORDER BY account_archived_at ASC, account_name ASC");
+                    $sql_accounts = mysqli_query($mysqli, "SELECT account_archived_at, account_id, account_name, opening_balance FROM accounts WHERE (account_archived_at > '$transfer_created_at' OR account_archived_at IS NULL) ORDER BY account_archived_at ASC, account_name ASC");
                     while ($row = mysqli_fetch_assoc($sql_accounts)) {
                         $account_id_select = intval($row['account_id']);
                         $account_name_select = escapeHtml($row['account_name']);
@@ -119,7 +119,7 @@ ob_start();
                 <select class="form-control select2" name="account_to" required>
                     <?php
 
-                    $sql2 = mysqli_query($mysqli, "SELECT * FROM accounts WHERE (account_archived_at > '$transfer_created_at' OR account_archived_at IS NULL) ORDER BY account_archived_at ASC, account_name ASC");
+                    $sql2 = mysqli_query($mysqli, "SELECT account_archived_at, account_id, account_name, opening_balance FROM accounts WHERE (account_archived_at > '$transfer_created_at' OR account_archived_at IS NULL) ORDER BY account_archived_at ASC, account_name ASC");
                     while ($row = mysqli_fetch_assoc($sql2)) {
                         $account_id2 = intval($row['account_id']);
                         $account_name = escapeHtml($row['account_name']);
@@ -169,7 +169,7 @@ ob_start();
                     <option value="">- Method of Transfer -</option>
                     <?php
 
-                    $sql_transfer_method_select = mysqli_query($mysqli, "SELECT * FROM payment_methods ORDER BY payment_method_name ASC");
+                    $sql_transfer_method_select = mysqli_query($mysqli, "SELECT payment_method_name FROM payment_methods ORDER BY payment_method_name ASC");
                     while ($row = mysqli_fetch_assoc($sql_transfer_method_select)) {
                         $payment_method_name_select = escapeHtml($row['payment_method_name']);
                     ?>
diff --git a/agent/modals/trip/trip_add.php b/agent/modals/trip/trip_add.php
index 88ef31b40..96b7bb409 100644
--- a/agent/modals/trip/trip_add.php
+++ b/agent/modals/trip/trip_add.php
@@ -32,7 +32,7 @@ ob_start();
                         <option value="0">- Client (Optional) -</option>
                         <?php
 
-                        $sql = mysqli_query($mysqli, "SELECT * FROM clients WHERE client_archived_at is NULL $access_permission_query ORDER BY client_name ASC");
+                        $sql = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients WHERE client_archived_at is NULL " . clientScopeSql('clients.client_id') . " ORDER BY client_name ASC");
                         while ($row = mysqli_fetch_assoc($sql)) {
                             $client_id_select = intval($row['client_id']);
                             $client_name = escapeHtml($row['client_name']);
@@ -94,7 +94,7 @@ ob_start();
                     <option value=""></option>
                     <?php
                     if ($client_id) {
-                        $sql_locations = mysqli_query($mysqli, "SELECT * FROM locations WHERE location_archived_at IS NULL AND location_client_id = $client_id ORDER BY location_name ASC");
+                        $sql_locations = mysqli_query($mysqli, "SELECT location_address, location_city, location_name, location_state, location_zip FROM locations WHERE location_archived_at IS NULL AND location_client_id = $client_id ORDER BY location_name ASC");
                     while ($row = mysqli_fetch_assoc($sql_locations)) {
                         $location_name = escapeHtml($row['location_name']);
                         $location_address = escapeHtml($row['location_address']);
diff --git a/agent/modals/trip/trip_copy.php b/agent/modals/trip/trip_copy.php
index c8e5435de..2a25b36e7 100644
--- a/agent/modals/trip/trip_copy.php
+++ b/agent/modals/trip/trip_copy.php
@@ -6,7 +6,8 @@ enforceUserPermission('module_financial', 2);
 
 $trip_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM trips WHERE trip_id = $trip_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT round_trip, trip_archived_at, trip_client_id, trip_created_at, trip_date, trip_destination,
+    trip_miles, trip_purpose, trip_source, trip_user_id FROM trips WHERE trip_id = $trip_id LIMIT 1");
 
 $row = mysqli_fetch_assoc($sql);
 $trip_date = escapeHtml($row['trip_date']);
@@ -87,7 +88,7 @@ ob_start();
                     <option><?= $trip_destination ?></option>
                     <?php
 
-                    $sql_locations_select = mysqli_query($mysqli, "SELECT * FROM locations WHERE location_archived_at IS NULL AND location_client_id = $client_id ORDER BY location_name ASC");
+                    $sql_locations_select = mysqli_query($mysqli, "SELECT location_address, location_city, location_name, location_state, location_zip FROM locations WHERE location_archived_at IS NULL AND location_client_id = $client_id ORDER BY location_name ASC");
                     while ($row = mysqli_fetch_assoc($sql_locations_select)) {
                         $location_name = escapeHtml($row['location_name']);
                         $location_address = escapeHtml($row['location_address']);
@@ -150,7 +151,7 @@ ob_start();
                         <option value="">- Client (Optional) -</option>
                         <?php
 
-                        $sql_clients = mysqli_query($mysqli, "SELECT * FROM clients WHERE client_archived_at IS NULL $access_permission_query ORDER BY client_name ASC");
+                        $sql_clients = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients WHERE client_archived_at IS NULL " . clientScopeSql('clients.client_id') . " ORDER BY client_name ASC");
                         while ($row = mysqli_fetch_assoc($sql_clients)) {
                             $client_id_select = intval($row['client_id']);
                             $client_name_select = escapeHtml($row['client_name']);
diff --git a/agent/modals/trip/trip_edit.php b/agent/modals/trip/trip_edit.php
index dcd87266a..53275cf7b 100644
--- a/agent/modals/trip/trip_edit.php
+++ b/agent/modals/trip/trip_edit.php
@@ -6,7 +6,8 @@ enforceUserPermission('module_financial', 2);
 
 $trip_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM trips WHERE trip_id = $trip_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT round_trip, trip_archived_at, trip_client_id, trip_created_at, trip_date, trip_destination,
+    trip_miles, trip_purpose, trip_source, trip_user_id FROM trips WHERE trip_id = $trip_id LIMIT 1");
 
 $row = mysqli_fetch_assoc($sql);
 $trip_date = escapeHtml($row['trip_date']);
@@ -87,7 +88,7 @@ ob_start();
                     <option><?= $trip_destination ?></option>
                     <?php
 
-                    $sql_locations_select = mysqli_query($mysqli, "SELECT * FROM locations WHERE location_archived_at IS NULL AND location_client_id = $client_id ORDER BY location_name ASC");
+                    $sql_locations_select = mysqli_query($mysqli, "SELECT location_address, location_city, location_name, location_state, location_zip FROM locations WHERE location_archived_at IS NULL AND location_client_id = $client_id ORDER BY location_name ASC");
                     while ($row = mysqli_fetch_assoc($sql_locations_select)) {
                         $location_name = escapeHtml($row['location_name']);
                         $location_address = escapeHtml($row['location_address']);
@@ -121,7 +122,7 @@ ob_start();
                     <option value="">- Driver -</option>
                     <?php
 
-                    $sql_users = mysqli_query($mysqli, "SELECT * FROM users
+                    $sql_users = mysqli_query($mysqli, "SELECT users.user_id, user_name FROM users
                         LEFT JOIN user_settings on users.user_id = user_settings.user_id
                         WHERE (users.user_id = $trip_user_id) OR (user_archived_at IS NULL AND user_status = 1) ORDER BY user_name ASC"
                     );
@@ -151,7 +152,7 @@ ob_start();
                         <option value="">- Client (Optional) -</option>
                         <?php
 
-                        $sql_clients = mysqli_query($mysqli, "SELECT * FROM clients WHERE client_archived_at IS NULL $access_permission_query ORDER BY client_name ASC");
+                        $sql_clients = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients WHERE client_archived_at IS NULL " . clientScopeSql('clients.client_id') . " ORDER BY client_name ASC");
                         while ($row = mysqli_fetch_assoc($sql_clients)) {
                             $client_id_select = intval($row['client_id']);
                             $client_name_select = escapeHtml($row['client_name']);
diff --git a/agent/modals/vendor/vendor.php b/agent/modals/vendor/vendor.php
index c4a7f98ae..79039f7c7 100644
--- a/agent/modals/vendor/vendor.php
+++ b/agent/modals/vendor/vendor.php
@@ -6,7 +6,9 @@ enforceUserPermission('module_client');
 
 $vendor_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM vendors WHERE vendor_id = $vendor_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT vendor_account_number, vendor_client_id, vendor_code, vendor_contact_name,
+    vendor_description, vendor_email, vendor_extension, vendor_hours, vendor_name,
+    vendor_notes, vendor_phone, vendor_sla, vendor_website FROM vendors WHERE vendor_id = $vendor_id LIMIT 1");
 
 $row = mysqli_fetch_assoc($sql);
 $name = escapeHtml($row['vendor_name']);
diff --git a/agent/modals/vendor/vendor_add_from_template.php b/agent/modals/vendor/vendor_add_from_template.php
index bfc2421ac..2134bd1eb 100644
--- a/agent/modals/vendor/vendor_add_from_template.php
+++ b/agent/modals/vendor/vendor_add_from_template.php
@@ -29,7 +29,7 @@ ob_start();
                 <select class="form-control" name="vendor_template_id" required>
                     <option value="">- Select Template -</option>
                     <?php
-                    $sql_vendor_templates = mysqli_query($mysqli, "SELECT * FROM vendor_templates WHERE vendor_template_archived_at IS NULL ORDER BY vendor_template_name ASC");
+                    $sql_vendor_templates = mysqli_query($mysqli, "SELECT vendor_template_id, vendor_template_name FROM vendor_templates WHERE vendor_template_archived_at IS NULL ORDER BY vendor_template_name ASC");
                     while ($row = mysqli_fetch_assoc($sql_vendor_templates)) {
                         $vendor_template_id = intval($row['vendor_template_id']);
                         $vendor_template_name = escapeHtml($row['vendor_template_name']);
diff --git a/agent/modals/vendor/vendor_edit.php b/agent/modals/vendor/vendor_edit.php
index 290cf17ae..e79768fd1 100644
--- a/agent/modals/vendor/vendor_edit.php
+++ b/agent/modals/vendor/vendor_edit.php
@@ -6,7 +6,10 @@ enforceUserPermission('module_client', 2);
 
 $vendor_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM vendors WHERE vendor_id = $vendor_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT vendor_account_number, vendor_client_id, vendor_code, vendor_contact_name,
+    vendor_description, vendor_email, vendor_extension, vendor_hours, vendor_name,
+    vendor_notes, vendor_phone, vendor_phone_country_code, vendor_sla, vendor_template_id,
+    vendor_website FROM vendors WHERE vendor_id = $vendor_id LIMIT 1");
 
 $row = mysqli_fetch_assoc($sql);
 $vendor_name = escapeHtml($row['vendor_name']);
@@ -112,7 +115,7 @@ ob_start();
                             <option value="0">- None -</option>
                             <?php
 
-                            $sql_vendor_templates = mysqli_query($mysqli, "SELECT * FROM vendor_templates WHERE vendor_template_archived_at IS NULL ORDER BY vendor_template_name ASC");
+                            $sql_vendor_templates = mysqli_query($mysqli, "SELECT vendor_template_id, vendor_template_name FROM vendor_templates WHERE vendor_template_archived_at IS NULL ORDER BY vendor_template_name ASC");
                             while ($row = mysqli_fetch_assoc($sql_vendor_templates)) {
                                 $vendor_template_id_select = $row['vendor_template_id'];
                                 $vendor_template_name_select = escapeHtml($row['vendor_template_name']); ?>
diff --git a/agent/networks.php b/agent/networks.php
index 68d8dec56..23ae73e91 100644
--- a/agent/networks.php
+++ b/agent/networks.php
@@ -58,12 +58,14 @@ if ($client_url && isset($_GET['location']) && !empty($_GET['location'])) {
 
 $sql = mysqli_query(
     $mysqli,
-    "SELECT SQL_CALC_FOUND_ROWS * FROM networks
+    "SELECT SQL_CALC_FOUND_ROWS client_id, client_name, location_name, network, network_archived_at, network_description,
+        network_dhcp_range, network_gateway, network_id, network_location_id, network_name,
+        network_primary_dns, network_secondary_dns, network_vlan FROM networks
     LEFT JOIN clients ON client_id = network_client_id
     LEFT JOIN locations ON location_id = network_location_id
     WHERE $archive_query
     AND (network_name LIKE '%$q%' OR network_description LIKE '%$q%' OR network_vlan LIKE '%$q%' OR network LIKE '%$q%' OR network_gateway LIKE '%$q%' OR network_subnet LIKE '%$q%' OR network_primary_dns LIKE '%$q%' OR network_secondary_dns LIKE '%$q%' OR network_dhcp_range LIKE '%$q%' OR location_name LIKE '%$q%' OR client_name LIKE '%$q%')
-    $access_permission_query
+    " . clientScopeSql('network_client_id') . "
     $location_query
     $client_query
     ORDER BY $sort $order LIMIT $record_from, $record_to"
@@ -153,7 +155,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                                 FROM clients
                                 JOIN networks ON network_client_id = client_id
                                 WHERE $archive_query
-                                $access_permission_query
+                                " . clientScopeSql('clients.client_id') . "
                                 ORDER BY client_name ASC
                             ");
                             while ($row = mysqli_fetch_assoc($sql_clients_filter)) {
diff --git a/agent/notifications.php b/agent/notifications.php
index 6140d4fc8..2465833ae 100644
--- a/agent/notifications.php
+++ b/agent/notifications.php
@@ -18,7 +18,8 @@ if (isset($_GET['dismissed'])) {
 
 $sql = mysqli_query(
     $mysqli,
-    "SELECT SQL_CALC_FOUND_ROWS * FROM notifications
+    "SELECT SQL_CALC_FOUND_ROWS client_id, client_name, notification, notification_dismissed_at, notification_id,
+        notification_timestamp, notification_type FROM notifications
     LEFT JOIN clients ON notification_client_id = client_id
     WHERE (notification_type LIKE '%$q%' OR notification LIKE '%$q%')
     AND DATE(notification_timestamp) BETWEEN '$dtf' AND '$dtt'
diff --git a/agent/post.php b/agent/post.php
index 9c498ba67..810918239 100644
--- a/agent/post.php
+++ b/agent/post.php
@@ -10,8 +10,12 @@ require_once __DIR__ . "/../includes/check_login.php";
 // Only allow running post files via inclusion (prevents people/bots poking them directly)
 define('FROM_POST_HANDLER', true);
 
-// Load all agent module POST logic
+// Load all agent module POST logic.
 // TODO: selectively load per-module like admin does, keyed off request path (not referer)
+// *_model.php is a RESERVED suffix: those files are not handlers, they are inline
+// field-parsing fragments that read $_POST at include time, so the glob must not
+// pull them in. A handler named *_model.php is silently never loaded - name entity
+// handlers around it (admin/post/ai_models.php, not ai_model.php).
 foreach (glob(__DIR__ . "/post/*.php") as $user_module) {
     if (!str_ends_with($user_module, '_model.php')) {
         require_once $user_module;
@@ -21,3 +25,11 @@ foreach (glob(__DIR__ . "/post/*.php") as $user_module) {
 // Logout is shared between portals
 require_once __DIR__ . "/../post/logout.php";
 require_once __DIR__ . "/../post/misc.php";
+
+// Every handler above exits or redirects, so getting here means no handler claimed
+// the request - a blank page and no trace of why. Log it; the usual cause is a
+// handler file that never loaded.
+if ($_SERVER['REQUEST_METHOD'] === 'POST') {
+    $unhandled = implode(', ', array_slice(array_keys($_POST), 0, 10));
+    logApp('Request', 'warning', "Unhandled POST to agent/post.php - no handler matched. Fields: $unhandled");
+}
diff --git a/agent/post/asset.php b/agent/post/asset.php
index b9be4e687..871cb7698 100644
--- a/agent/post/asset.php
+++ b/agent/post/asset.php
@@ -111,7 +111,7 @@ if (isset($_POST['edit_asset'])) {
 
     mysqli_query($mysqli,"UPDATE assets SET asset_name = '$name', asset_description = '$description', asset_type = '$type', asset_make = '$make', asset_model = '$model', asset_serial = '$serial', asset_os = '$os', asset_uri = '$uri', asset_uri_2 = '$uri_2', asset_uri_client = '$uri_client', asset_location_id = $location, asset_vendor_id = $vendor, asset_contact_id = $contact, asset_status = '$status', asset_purchase_reference = '$purchase_reference', asset_purchase_date = $purchase_date, asset_warranty_expire = $warranty_expire, asset_install_date = $install_date, asset_physical_location = '$physical_location', asset_notes = '$notes', asset_favorite = $favorite WHERE asset_id = $asset_id");
 
-    $sql_interfaces = mysqli_query($mysqli, "SELECT * FROM asset_interfaces WHERE interface_asset_id = $asset_id AND interface_primary = 1");
+    $sql_interfaces = mysqli_query($mysqli, "SELECT 1 FROM asset_interfaces WHERE interface_asset_id = $asset_id AND interface_primary = 1");
 
     if(mysqli_num_rows($sql_interfaces) == 0 ) {
         // Add Primary Interface
@@ -387,7 +387,7 @@ if (isset($_POST['bulk_assign_asset_tags'])) {
                 foreach($_POST['tags'] as $tag) {
                     $tag = intval($tag);
 
-                    $sql = mysqli_query($mysqli,"SELECT * FROM asset_tags WHERE asset_tag_asset_id = $asset_id AND asset_tag_tag_id = $tag");
+                    $sql = mysqli_query($mysqli,"SELECT 1 FROM asset_tags WHERE asset_tag_asset_id = $asset_id AND asset_tag_tag_id = $tag");
                     if (mysqli_num_rows($sql) == 0) {
                         mysqli_query($mysqli, "INSERT INTO asset_tags SET asset_tag_asset_id = $asset_id, asset_tag_tag_id = $tag");
                     }
@@ -540,7 +540,7 @@ if (isset($_POST['bulk_transfer_client_asset'])) {
             $new_asset_id = mysqli_insert_id($mysqli);
 
             // Transfer all Interfaces over too
-            $sql_interfaces = mysqli_query($mysqli, "SELECT * FROM asset_interfaces WHERE interface_asset_id = $current_asset_id");
+            $sql_interfaces = mysqli_query($mysqli, "SELECT interface_mac, interface_name, interface_primary FROM asset_interfaces WHERE interface_asset_id = $current_asset_id");
 
             while ($row = mysqli_fetch_assoc($sql_interfaces)) {
                 $interface_name = escapeSql($row['interface_name']);
@@ -1174,7 +1174,7 @@ if (isset($_POST["import_assets_csv"])) {
             // Name
             if (isset($column[0])) {
                 $name = escapeSql($column[0]);
-                if (mysqli_num_rows(mysqli_query($mysqli,"SELECT * FROM assets WHERE asset_name = '$name' AND asset_client_id = $client_id")) > 0) {
+                if (mysqli_num_rows(mysqli_query($mysqli,"SELECT 1 FROM assets WHERE asset_name = '$name' AND asset_client_id = $client_id")) > 0) {
                     $duplicate_detect = 1;
                 }
             }
@@ -1224,7 +1224,7 @@ if (isset($_POST["import_assets_csv"])) {
             if (!empty($column[8])) {
                 $contact = escapeSql($column[8]);
                 if ($contact) {
-                    $sql_contact = mysqli_query($mysqli,"SELECT * FROM contacts WHERE contact_name = '$contact' AND contact_client_id = $client_id");
+                    $sql_contact = mysqli_query($mysqli,"SELECT contact_id FROM contacts WHERE contact_name = '$contact' AND contact_client_id = $client_id");
                     $row = mysqli_fetch_assoc($sql_contact);
                     $contact_id = intval($row['contact_id']);
                 }
@@ -1234,7 +1234,7 @@ if (isset($_POST["import_assets_csv"])) {
             if (!empty($column[9])) {
                 $location = escapeSql($column[9]);
                 if ($location) {
-                    $sql_location = mysqli_query($mysqli,"SELECT * FROM locations WHERE location_name = '$location' AND location_client_id = $client_id");
+                    $sql_location = mysqli_query($mysqli,"SELECT location_id FROM locations WHERE location_name = '$location' AND location_client_id = $client_id");
                     $row = mysqli_fetch_assoc($sql_location);
                     $location_id = intval($row['location_id']);
                 }
@@ -1316,7 +1316,7 @@ if (isset($_GET['download_assets_csv_template'])) {
 
 }
 
-if (isset($_POST['export_assets'])) {
+if (isExportRequest('export_assets')) {
 
     validateCSRFToken();
 
@@ -1442,7 +1442,7 @@ if (isset($_POST['export_assets'])) {
         $tag_query
         AND (asset_name LIKE '%$q%' OR asset_description LIKE '%$q%' OR asset_type LIKE '%$q%' OR interface_ip LIKE '%$q%' OR interface_ipv6 LIKE '%$q%' OR interface_mac LIKE '%$q%' OR asset_make LIKE '%$q%' OR asset_model LIKE '%$q%' OR asset_serial LIKE '%$q%' OR asset_os LIKE '%$q%' OR contact_name LIKE '%$q%' OR location_name LIKE '%$q%' OR client_name LIKE '%$q%' OR tag_name LIKE '%$q%')
         AND ($type_query)
-        $access_permission_query
+        " . clientScopeSql('asset_client_id') . "
         $location_query
         $expire_query
         $client_query
@@ -1911,7 +1911,7 @@ if (isset($_POST["import_client_asset_interfaces_csv"])) {
     $file_name = $_FILES["file"]["tmp_name"];
 
     // Get Asset Details for logging
-    $sql_asset = mysqli_query($mysqli,"SELECT * FROM assets WHERE asset_id = $asset_id");
+    $sql_asset = mysqli_query($mysqli,"SELECT asset_client_id, asset_name FROM assets WHERE asset_id = $asset_id");
     $row = mysqli_fetch_assoc($sql_asset);
     $client_id = intval($row['asset_client_id']);
     $asset_name = escapeSql($row['asset_name']);
@@ -1989,7 +1989,7 @@ if (isset($_POST["import_client_asset_interfaces_csv"])) {
             if (!empty($column[7])) {
                 $network = escapeSql($column[7]);
                 if ($network) {
-                    $sql_network = mysqli_query($mysqli,"SELECT * FROM networks WHERE network_name = '$network' AND network_archived_at IS NULL AND network_client_id = $client_id");
+                    $sql_network = mysqli_query($mysqli,"SELECT network_id FROM networks WHERE network_name = '$network' AND network_archived_at IS NULL AND network_client_id = $client_id");
                     $row = mysqli_fetch_assoc($sql_network);
                     $network_id = intval($row['network_id']);
                 }
@@ -2056,7 +2056,7 @@ if (isset($_GET['download_client_asset_interfaces_csv_template'])) {
 
 }
 
-if (isset($_POST['export_asset_interfaces'])) {
+if (isExportRequest('export_asset_interfaces')) {
 
     validateCSRFToken();
 
diff --git a/agent/post/certificate.php b/agent/post/certificate.php
index fd9c1dd75..8a91aa6b8 100644
--- a/agent/post/certificate.php
+++ b/agent/post/certificate.php
@@ -338,7 +338,7 @@ if (isset($_POST['bulk_delete_certificates'])) {
 
 }
 
-if (isset($_POST['export_certificates'])) {
+if (isExportRequest('export_certificates')) {
 
     validateCSRFToken();
 
@@ -408,7 +408,7 @@ if (isset($_POST['export_certificates'])) {
         LEFT JOIN clients ON client_id = certificate_client_id
         WHERE $archive_query
         AND (certificate_name LIKE '%$q%' OR certificate_domain LIKE '%$q%' OR certificate_description LIKE '%$q%' OR certificate_issued_by LIKE '%$q%' OR client_name LIKE '%$q%')
-        $access_permission_query
+        " . clientScopeSql('certificate_client_id') . "
         $client_query
         $expire_query
         ORDER BY certificate_name ASC"
diff --git a/agent/post/client.php b/agent/post/client.php
index c31e96ee8..d056cb969 100644
--- a/agent/post/client.php
+++ b/agent/post/client.php
@@ -216,7 +216,7 @@ if (isset($_GET['archive_client'])) {
     mysqli_query($mysqli, "UPDATE clients SET client_archived_at = NOW() WHERE client_id = $client_id");
 
     // Stop recurring invoices
-    $sql_recurring_invoices = mysqli_query($mysqli, "SELECT * FROM recurring_invoices WHERE recurring_invoice_client_id = $client_id AND recurring_invoice_status = 1");
+    $sql_recurring_invoices = mysqli_query($mysqli, "SELECT recurring_invoice_id FROM recurring_invoices WHERE recurring_invoice_client_id = $client_id AND recurring_invoice_status = 1");
     while ($row = mysqli_fetch_assoc($sql_recurring_invoices)) {
         $recurring_invoice_id = intval($row['recurring_invoice_id']);
         mysqli_query($mysqli,"UPDATE recurring_invoices SET recurring_invoice_status = 0 WHERE recurring_invoice_id = $recurring_invoice_id AND recurring_invoice_client_id = $client_id");
@@ -356,7 +356,7 @@ if (isset($_GET['delete_client'])) {
 
 }
 
-if (isset($_POST['export_clients'])) {
+if (isExportRequest('export_clients')) {
 
     validateCSRFToken();
 
@@ -452,7 +452,7 @@ if (isset($_POST['export_clients'])) {
           AND $archive_query
           AND DATE(client_created_at) BETWEEN '$dtf' AND '$dtt'
           $leads_query
-          $access_permission_query
+          " . clientScopeSql('clients.client_id') . "
           $tag_query
           $industry_query
           $referral_query
@@ -528,7 +528,7 @@ if (isset($_POST["import_clients_csv"])) {
             $duplicate_detect = 0;
             if (isset($column[0])) {
                 $name = escapeSql($column[0]);
-                if (mysqli_num_rows(mysqli_query($mysqli,"SELECT * FROM clients WHERE client_name = '$name'")) > 0) {
+                if (mysqli_num_rows(mysqli_query($mysqli,"SELECT 1 FROM clients WHERE client_name = '$name'")) > 0) {
                     $duplicate_detect = 1;
                 }
             }
@@ -741,7 +741,7 @@ if (isset($_POST['bulk_add_client_ticket'])) {
 
     // Check to see if adding a ticket by template
     if($ticket_template_id) {
-        $sql = mysqli_query($mysqli, "SELECT * FROM ticket_templates WHERE ticket_template_id = $ticket_template_id");
+        $sql = mysqli_query($mysqli, "SELECT ticket_template_details, ticket_template_subject FROM ticket_templates WHERE ticket_template_id = $ticket_template_id");
         $row = mysqli_fetch_assoc($sql);
 
         // Override Template Subject
@@ -751,7 +751,7 @@ if (isset($_POST['bulk_add_client_ticket'])) {
         $details = mysqli_escape_string($mysqli, $row['ticket_template_details']);
 
         // Get Associated Tasks from the ticket template
-        $sql_task_templates = mysqli_query($mysqli, "SELECT * FROM task_templates WHERE task_template_ticket_template_id = $ticket_template_id");
+        $sql_task_templates = mysqli_query($mysqli, "SELECT task_template_name, task_template_order FROM task_templates WHERE task_template_ticket_template_id = $ticket_template_id");
 
     }
 
@@ -764,7 +764,7 @@ if (isset($_POST['bulk_add_client_ticket'])) {
         foreach ($_POST['client_ids'] as $client_id) {
             $client_id = intval($client_id);
 
-            $sql = mysqli_query($mysqli, "SELECT * FROM clients WHERE client_id = $client_id");
+            $sql = mysqli_query($mysqli, "SELECT client_name FROM clients WHERE client_id = $client_id");
             $row = mysqli_fetch_assoc($sql);
 
             $client_name = escapeSql($row['client_name']);
@@ -992,7 +992,7 @@ if (isset($_POST['bulk_assign_client_tags'])) {
                 foreach($_POST['bulk_tags'] as $tag) {
                     $tag = intval($tag);
 
-                    $sql = mysqli_query($mysqli,"SELECT * FROM client_tags WHERE client_id = $client_id AND tag_id = $tag");
+                    $sql = mysqli_query($mysqli,"SELECT 1 FROM client_tags WHERE client_id = $client_id AND tag_id = $tag");
                     if (mysqli_num_rows($sql) == 0) {
                         mysqli_query($mysqli, "INSERT INTO client_tags SET client_id = $client_id, tag_id = $tag");
                     }
@@ -1175,13 +1175,18 @@ if (isset($_POST["export_client_pdf"])) {
 
     validateCSRFToken();
 
-    // Enforce permissions
-    enforceUserPermission("module_client", 3);
-    enforceUserPermission("module_support", 1);
-    enforceUserPermission("module_sales", 1);
-    enforceUserPermission("module_financial", 1);
+    // The pack always carries the client's own record, so client read is the floor.
+    // Everything past that is gated per section in resolveClientPackSections() - a
+    // role missing one module loses that section, not the whole export.
+    enforceUserPermission('module_client');
 
-    $sql = mysqli_query($mysqli, "SELECT * FROM companies, settings WHERE companies.company_id = settings.company_id AND companies.company_id = 1");
+    $client_id = intval($_POST["client_id"]);
+    enforceClientAccess();
+
+    $pack = resolveClientPackSections();
+
+    $sql = mysqli_query($mysqli, "SELECT company_email, company_logo, company_name, company_phone, company_phone_country_code,
+        company_website FROM companies, settings WHERE companies.company_id = settings.company_id AND companies.company_id = 1");
     $row = mysqli_fetch_assoc($sql);
     $company_name = escapeHtml($row['company_name']);
     $company_phone_country_code = escapeHtml($row['company_phone_country_code']);
@@ -1190,30 +1195,6 @@ if (isset($_POST["export_client_pdf"])) {
     $company_website = escapeHtml($row['company_website']);
     $company_logo = escapeHtml($row['company_logo']);
 
-    $client_id = intval($_POST["client_id"]);
-    $export_contacts = intval($_POST["export_contacts"]);
-    $export_locations = intval($_POST["export_locations"]);
-    $export_assets = intval($_POST["export_assets"]);
-    $export_software = intval($_POST["export_software"]);
-    $export_credentials = 0;
-    if (lookupUserPermission("module_credential") >= 1) {
-        $export_credentials = intval($_POST["export_credentials"] ?? 0);
-    }
-    $export_networks = intval($_POST["export_networks"]);
-    $export_certificates = intval($_POST["export_certificates"]);
-    $export_domains = intval($_POST["export_domains"]);
-    $export_tickets = intval($_POST["export_tickets"]);
-    $export_recurring_tickets = intval($_POST["export_recurring_tickets"]);
-    $export_vendors = intval($_POST["export_vendors"]);
-    $export_invoices = intval($_POST["export_invoices"]);
-    $export_recurring_invoices = intval($_POST["export_recurring_invoices"]);
-    $export_quotes = intval($_POST["export_quotes"]);
-    $export_payments = intval($_POST["export_payments"]);
-    $export_trips = intval($_POST["export_trips"]);
-    $export_logs = intval($_POST["export_logs"]);
-
-    enforceClientAccess();
-
     logAudit("Client", "Export", "$session_name exported client data to a PDF file", $client_id, $client_id);
 
     // Get client record (joining primary contact and primary location)
@@ -1240,19 +1221,19 @@ if (isset($_POST["export_client_pdf"])) {
     $client_website = escapeHtml($row["client_website"]);
 
     // Other queries remain unchanged
-    $sql_contacts = mysqli_query($mysqli, "SELECT * FROM contacts WHERE contact_client_id = $client_id AND contact_archived_at IS NULL ORDER BY contact_name ASC");
-    $sql_locations = mysqli_query($mysqli, "SELECT * FROM locations WHERE location_client_id = $client_id AND location_archived_at IS NULL ORDER BY location_name ASC");
-    $sql_vendors = mysqli_query($mysqli, "SELECT * FROM vendors WHERE vendor_client_id = $client_id AND vendor_archived_at IS NULL ORDER BY vendor_name ASC");
-    $sql_credentials = mysqli_query($mysqli, "SELECT * FROM credentials WHERE credential_client_id = $client_id ORDER BY credential_name ASC");
-    $sql_assets = mysqli_query($mysqli, "SELECT * FROM assets
+    $sql_contacts = $pack['contacts'] ? mysqli_query($mysqli, "SELECT * FROM contacts WHERE contact_client_id = $client_id AND contact_archived_at IS NULL ORDER BY contact_name ASC") : false;
+    $sql_locations = $pack['locations'] ? mysqli_query($mysqli, "SELECT * FROM locations WHERE location_client_id = $client_id AND location_archived_at IS NULL ORDER BY location_name ASC") : false;
+    $sql_vendors = $pack['vendors'] ? mysqli_query($mysqli, "SELECT * FROM vendors WHERE vendor_client_id = $client_id AND vendor_archived_at IS NULL ORDER BY vendor_name ASC") : false;
+    $sql_credentials = $pack['credentials'] ? mysqli_query($mysqli, "SELECT * FROM credentials WHERE credential_client_id = $client_id ORDER BY credential_name ASC") : false;
+    $sql_assets = $pack['assets'] ? mysqli_query($mysqli, "SELECT 1 FROM assets
         LEFT JOIN contacts ON asset_contact_id = contact_id
         LEFT JOIN locations ON asset_location_id = location_id
         LEFT JOIN asset_interfaces ON interface_asset_id = asset_id AND interface_primary = 1
         WHERE asset_client_id = $client_id
         AND asset_archived_at IS NULL
         ORDER BY asset_type ASC"
-    );
-    $sql_asset_workstations = mysqli_query($mysqli, "SELECT * FROM assets
+    ) : false;
+    $sql_asset_workstations = $pack['assets'] ? mysqli_query($mysqli, "SELECT * FROM assets
         LEFT JOIN contacts ON asset_contact_id = contact_id
         LEFT JOIN locations ON asset_location_id = location_id
         LEFT JOIN asset_interfaces ON interface_asset_id = asset_id AND interface_primary = 1
@@ -1260,31 +1241,31 @@ if (isset($_POST["export_client_pdf"])) {
         AND (asset_type = 'desktop' OR asset_type = 'laptop')
         AND asset_archived_at IS NULL
         ORDER BY asset_name ASC"
-    );
-    $sql_asset_servers = mysqli_query($mysqli, "SELECT * FROM assets
+    ) : false;
+    $sql_asset_servers = $pack['assets'] ? mysqli_query($mysqli, "SELECT * FROM assets
         LEFT JOIN locations ON asset_location_id = location_id
         LEFT JOIN asset_interfaces ON interface_asset_id = asset_id AND interface_primary = 1
         WHERE asset_client_id = $client_id
         AND asset_type = 'server'
         AND asset_archived_at IS NULL
         ORDER BY asset_name ASC"
-    );
-    $sql_asset_vms = mysqli_query($mysqli, "SELECT * FROM assets
+    ) : false;
+    $sql_asset_vms = $pack['assets'] ? mysqli_query($mysqli, "SELECT * FROM assets
         LEFT JOIN asset_interfaces ON interface_asset_id = asset_id AND interface_primary = 1
         WHERE asset_client_id = $client_id
         AND asset_type = 'virtual machine'
         AND asset_archived_at IS NULL
         ORDER BY asset_name ASC"
-    );
-    $sql_asset_network = mysqli_query($mysqli, "SELECT * FROM assets
+    ) : false;
+    $sql_asset_network = $pack['assets'] ? mysqli_query($mysqli, "SELECT * FROM assets
         LEFT JOIN locations ON asset_location_id = location_id
         LEFT JOIN asset_interfaces ON interface_asset_id = asset_id AND interface_primary = 1
         WHERE asset_client_id = $client_id
         AND (asset_type = 'Firewall/Router' OR asset_type = 'Switch' OR asset_type = 'Access Point')
         AND asset_archived_at IS NULL
         ORDER BY asset_type ASC"
-    );
-    $sql_asset_other = mysqli_query($mysqli, "SELECT * FROM assets
+    ) : false;
+    $sql_asset_other = $pack['assets'] ? mysqli_query($mysqli, "SELECT * FROM assets
         LEFT JOIN contacts ON asset_contact_id = contact_id
         LEFT JOIN locations ON asset_location_id = location_id
         LEFT JOIN asset_interfaces ON interface_asset_id = asset_id AND interface_primary = 1
@@ -1292,13 +1273,13 @@ if (isset($_POST["export_client_pdf"])) {
         AND (asset_type NOT LIKE 'laptop' AND asset_type NOT LIKE 'desktop' AND asset_type NOT LIKE 'server' AND asset_type NOT LIKE 'virtual machine' AND asset_type NOT LIKE 'firewall/router' AND asset_type NOT LIKE 'switch' AND asset_type NOT LIKE 'access point')
         AND asset_archived_at IS NULL
         ORDER BY asset_type ASC"
-    );
-    $sql_networks = mysqli_query($mysqli, "SELECT * FROM networks WHERE network_client_id = $client_id AND network_archived_at IS NULL ORDER BY network_name ASC");
-    $sql_domains = mysqli_query($mysqli, "SELECT * FROM domains WHERE domain_client_id = $client_id AND domain_archived_at IS NULL ORDER BY domain_name ASC");
-    $sql_certficates = mysqli_query($mysqli, "SELECT * FROM certificates WHERE certificate_client_id = $client_id AND certificate_archived_at IS NULL ORDER BY certificate_name ASC");
-    $sql_software = mysqli_query($mysqli, "SELECT * FROM software WHERE software_client_id = $client_id AND software_archived_at IS NULL ORDER BY software_name ASC");
+    ) : false;
+    $sql_networks = $pack['networks'] ? mysqli_query($mysqli, "SELECT * FROM networks WHERE network_client_id = $client_id AND network_archived_at IS NULL ORDER BY network_name ASC") : false;
+    $sql_domains = $pack['domains'] ? mysqli_query($mysqli, "SELECT * FROM domains WHERE domain_client_id = $client_id AND domain_archived_at IS NULL ORDER BY domain_name ASC") : false;
+    $sql_certficates = $pack['certificates'] ? mysqli_query($mysqli, "SELECT * FROM certificates WHERE certificate_client_id = $client_id AND certificate_archived_at IS NULL ORDER BY certificate_name ASC") : false;
+    $sql_software = $pack['software'] ? mysqli_query($mysqli, "SELECT * FROM software WHERE software_client_id = $client_id AND software_archived_at IS NULL ORDER BY software_name ASC") : false;
 
-    $sql_user_licenses = mysqli_query($mysqli, "
+    $sql_user_licenses = $pack['software'] ? mysqli_query($mysqli, "
         SELECT
             contact_name,
             software_name
@@ -1314,9 +1295,9 @@ if (isset($_POST["export_client_pdf"])) {
         AND contact_client_id = $client_id
         ORDER BY
             contact_name, software_name;"
-    );
+    ) : false;
 
-    $sql_asset_licenses = mysqli_query($mysqli, "
+    $sql_asset_licenses = $pack['software'] ? mysqli_query($mysqli, "
         SELECT
             asset_name,
             software_name
@@ -1332,7 +1313,7 @@ if (isset($_POST["export_client_pdf"])) {
         AND asset_client_id = $client_id
         ORDER BY
             asset_name, software_name;"
-    );
+    ) : false;
 
     require_once("../libs/TCPDF/tcpdf.php");
 
@@ -1425,7 +1406,7 @@ if (isset($_POST["export_client_pdf"])) {
     // Add bookmarks and TOC entries for each major section:
 
     // Contacts Section
-    if (mysqli_num_rows($sql_contacts) > 0 && $export_contacts == 1) {
+    if ($pack['contacts'] == 1 && mysqli_num_rows($sql_contacts) > 0) {
         $pdf->Bookmark("Contacts", 0, 0, "", "B", array(0,0,0));
         $html .= "
         <h2 class='section-title'>Contacts</h2>
@@ -1470,7 +1451,7 @@ if (isset($_POST["export_client_pdf"])) {
     }
 
     // Locations Section
-    if (mysqli_num_rows($sql_locations) > 0 && $export_locations == 1) {
+    if ($pack['locations'] == 1 && mysqli_num_rows($sql_locations) > 0) {
         $pdf->Bookmark("Locations", 0, 0, "", "B", array(0,0,0));
         $html .= "
         <h2 class='section-title'>Locations</h2>
@@ -1505,7 +1486,7 @@ if (isset($_POST["export_client_pdf"])) {
     }
 
     // Vendors Section
-    if (mysqli_num_rows($sql_vendors) > 0 && $export_vendors == 1) {
+    if ($pack['vendors'] == 1 && mysqli_num_rows($sql_vendors) > 0) {
         $pdf->Bookmark("Vendors", 0, 0, "", "B", array(0,0,0));
         $html .= "
         <h2 class='section-title'>Vendors</h2>
@@ -1542,7 +1523,7 @@ if (isset($_POST["export_client_pdf"])) {
     }
 
     // Credentials Section
-    if (mysqli_num_rows($sql_credentials) > 0 && $export_credentials == 1) {
+    if ($pack['credentials'] == 1 && mysqli_num_rows($sql_credentials) > 0) {
         $pdf->Bookmark("Credentials", 0, 0, "", "B", array(0,0,0));
         $html .= "
         <h2 class='section-title'>Credentials</h2>
@@ -1581,14 +1562,14 @@ if (isset($_POST["export_client_pdf"])) {
     }
 
     // Assets Section Header
-    if (mysqli_num_rows($sql_assets) > 0 && $export_assets == 1) {
+    if ($pack['assets'] == 1 && mysqli_num_rows($sql_assets) > 0) {
         $pdf->Bookmark("Assets", 0, 0, "", "B", array(0,0,0));
         $html .= "
         <h2 class='section-title'>Assets</h2>";
     }
 
     // Workstations
-    if (mysqli_num_rows($sql_asset_workstations) > 0 && $export_assets == 1) {
+    if ($pack['assets'] == 1 && mysqli_num_rows($sql_asset_workstations) > 0) {
         $pdf->Bookmark("Workstations", 1, 0, "", "", array(0,0,0));
         $html .= "
         <h3 class='subsection-title'>Workstations</h3>
@@ -1640,7 +1621,7 @@ if (isset($_POST["export_client_pdf"])) {
     }
 
     // Servers
-    if (mysqli_num_rows($sql_asset_servers) > 0 && $export_assets == 1) {
+    if ($pack['assets'] == 1 && mysqli_num_rows($sql_asset_servers) > 0) {
         $pdf->Bookmark("Servers", 1, 0, "", "", array(0,0,0));
         $html .= "
         <h3 class='subsection-title'>Servers</h3>
@@ -1689,7 +1670,7 @@ if (isset($_POST["export_client_pdf"])) {
     }
 
     // Virtual Machines
-    if (mysqli_num_rows($sql_asset_vms) > 0 && $export_assets == 1) {
+    if ($pack['assets'] == 1 && mysqli_num_rows($sql_asset_vms) > 0) {
         $pdf->Bookmark("Virtual Machines", 1, 0, "", "", array(0,0,0));
         $html .= "
         <h3 class='subsection-title'>Virtual Machines</h3>
@@ -1722,7 +1703,7 @@ if (isset($_POST["export_client_pdf"])) {
     }
 
     // Network Devices
-    if (mysqli_num_rows($sql_asset_network) > 0 && $export_assets == 1) {
+    if ($pack['assets'] == 1 && mysqli_num_rows($sql_asset_network) > 0) {
         $pdf->Bookmark("Network Devices", 1, 0, "", "", array(0,0,0));
         $html .= "
         <h3 class='subsection-title'>Network Devices</h3>
@@ -1771,7 +1752,7 @@ if (isset($_POST["export_client_pdf"])) {
     }
 
     // Other Devices
-    if (mysqli_num_rows($sql_asset_other) > 0 && $export_assets == 1) {
+    if ($pack['assets'] == 1 && mysqli_num_rows($sql_asset_other) > 0) {
         $pdf->Bookmark("Other Devices", 1, 0, "", "", array(0,0,0));
         $html .= "
         <h3 class='subsection-title'>Other Devices</h3>
@@ -1820,7 +1801,7 @@ if (isset($_POST["export_client_pdf"])) {
     }
 
     // Software Section
-    if (mysqli_num_rows($sql_software) > 0 && $export_software == 1) {
+    if ($pack['software'] == 1 && mysqli_num_rows($sql_software) > 0) {
         $pdf->Bookmark("Software", 0, 0, "", "B", array(0,0,0));
         $html .= "
         <h2 class='section-title'>Software</h2>
@@ -1862,7 +1843,7 @@ if (isset($_POST["export_client_pdf"])) {
     }
 
     // User Assigned Software Licenses
-    if (mysqli_num_rows($sql_user_licenses) > 0 && $export_software == 1) {
+    if ($pack['software'] == 1 && mysqli_num_rows($sql_user_licenses) > 0) {
         $pdf->Bookmark("User Assigned Licenses", 0, 0, "", "B", array(0,0,0));
         $html .= "
         <h2 class='section-title'>User Assigned Licenses</h2>
@@ -1889,7 +1870,7 @@ if (isset($_POST["export_client_pdf"])) {
     }
 
     // Asset Assigned Software Licenses
-    if (mysqli_num_rows($sql_asset_licenses) > 0 && $export_software == 1) {
+    if ($pack['software'] == 1 && mysqli_num_rows($sql_asset_licenses) > 0) {
         $pdf->Bookmark("Asset Assigned Licenses", 0, 0, "", "B", array(0,0,0));
         $html .= "
         <h2 class='section-title'>Asset Assigned Licenses</h2>
@@ -1916,7 +1897,7 @@ if (isset($_POST["export_client_pdf"])) {
     }
 
     // Networks Section
-    if (mysqli_num_rows($sql_networks) > 0 && $export_networks == 1) {
+    if ($pack['networks'] == 1 && mysqli_num_rows($sql_networks) > 0) {
         $pdf->Bookmark("Networks", 0, 0, "", "B", array(0,0,0));
         $html .= "
         <h2 class='section-title'>Networks</h2>
@@ -1952,7 +1933,7 @@ if (isset($_POST["export_client_pdf"])) {
     }
 
     // Domains Section
-    if (mysqli_num_rows($sql_domains) > 0 && $export_domains == 1) {
+    if ($pack['domains'] == 1 && mysqli_num_rows($sql_domains) > 0) {
         $pdf->Bookmark("Domains", 0, 0, "", "B", array(0,0,0));
         $html .= "
         <h2 class='section-title'>Domains</h2>
@@ -1979,7 +1960,7 @@ if (isset($_POST["export_client_pdf"])) {
     }
 
     // Certificates Section
-    if (mysqli_num_rows($sql_certficates) > 0 && $export_certificates == 1) {
+    if ($pack['certificates'] == 1 && mysqli_num_rows($sql_certficates) > 0) {
         $pdf->Bookmark("Certificates", 0, 0, "", "B", array(0,0,0));
         $html .= "
         <h2 class='section-title'>Certificates</h2>
diff --git a/agent/post/contact.php b/agent/post/contact.php
index 2a8ff379c..5b3b3e3dc 100644
--- a/agent/post/contact.php
+++ b/agent/post/contact.php
@@ -544,7 +544,7 @@ if (isset($_POST['bulk_assign_contact_tags'])) {
                 foreach($_POST['bulk_tags'] as $tag) {
                     $tag = intval($tag);
 
-                    $sql = mysqli_query($mysqli,"SELECT * FROM contact_tags WHERE contact_id = $contact_id AND tag_id = $tag");
+                    $sql = mysqli_query($mysqli,"SELECT 1 FROM contact_tags WHERE contact_id = $contact_id AND tag_id = $tag");
                     if (mysqli_num_rows($sql) == 0) {
                         mysqli_query($mysqli, "INSERT INTO contact_tags SET contact_id = $contact_id, tag_id = $tag");
                     }
@@ -584,7 +584,7 @@ if (isset($_POST['send_bulk_mail_now'])) {
         foreach($_POST['contact_ids'] as $contact_id) {
             $contact_id = intval($contact_id);
 
-            $sql = mysqli_query($mysqli,"SELECT * FROM contacts WHERE contact_id = $contact_id");
+            $sql = mysqli_query($mysqli,"SELECT contact_client_id, contact_email, contact_name FROM contacts WHERE contact_id = $contact_id");
             $row = mysqli_fetch_assoc($sql);
             $contact_name = escapeSql($row['contact_name']);
             $contact_email = escapeSql($row['contact_email']);
@@ -766,7 +766,7 @@ if (isset($_GET['anonymize_contact'])) {
     $contact_id = intval($_GET['anonymize_contact']);
 
     // Get contact & client info
-    $sql = mysqli_query($mysqli,"SELECT contact_name, contact_email, contact_client_id, contact_user_id FROM contacts WHERE contact_id = $contact_id");
+    $sql = mysqli_query($mysqli,"SELECT contact_name, contact_email, contact_phone, contact_client_id, contact_user_id FROM contacts WHERE contact_id = $contact_id");
     $row = mysqli_fetch_assoc($sql);
 
     $contact_name = escapeSql($row['contact_name']);
@@ -808,7 +808,7 @@ if (isset($_GET['anonymize_contact'])) {
 
 
     // Redact audit logs
-    $log_sql = mysqli_query($mysqli, "SELECT * FROM logs WHERE log_client_id =  $client_id");
+    $log_sql = mysqli_query($mysqli, "SELECT log_description, log_id FROM logs WHERE log_client_id =  $client_id");
     while ($log = mysqli_fetch_assoc($log_sql)) {
         $log_id = intval($log['log_id']);
         $description = $log['log_description'];
@@ -820,7 +820,7 @@ if (isset($_GET['anonymize_contact'])) {
 
 
     // Get all tickets this contact raised
-    $contact_tickets_sql = mysqli_query($mysqli, "SELECT * FROM tickets WHERE ticket_client_id = $client_id AND ticket_contact_id =  $contact_id");
+    $contact_tickets_sql = mysqli_query($mysqli, "SELECT ticket_details, ticket_id, ticket_subject FROM tickets WHERE ticket_client_id = $client_id AND ticket_contact_id =  $contact_id");
     while ($ticket = mysqli_fetch_assoc($contact_tickets_sql)) {
 
         $ticket_id = intval($ticket['ticket_id']);
@@ -839,7 +839,7 @@ if (isset($_GET['anonymize_contact'])) {
         mysqli_query($mysqli,"UPDATE tickets SET ticket_details = '$details' WHERE ticket_id = $ticket_id");
 
         // Redact contact name or email in the replies of all tickets they raised
-        $ticket_replies_sql = mysqli_query($mysqli, "SELECT * FROM ticket_replies WHERE ticket_reply_ticket_id = $ticket_id");
+        $ticket_replies_sql = mysqli_query($mysqli, "SELECT ticket_reply, ticket_reply_id FROM ticket_replies WHERE ticket_reply_ticket_id = $ticket_id");
 
         while($ticket_reply = mysqli_fetch_assoc($ticket_replies_sql)) {
             $ticket_reply_id = intval($ticket_reply['ticket_reply_id']);
@@ -938,7 +938,7 @@ if (isset($_GET['delete_contact'])) {
     $contact_id = intval($_GET['delete_contact']);
 
     // Get Contact Name and Client ID for logging and alert message
-    $sql = mysqli_query($mysqli,"SELECT contact_name, contact_client_id FROM contacts WHERE contact_id = $contact_id");
+    $sql = mysqli_query($mysqli,"SELECT contact_name, contact_client_id, contact_user_id FROM contacts WHERE contact_id = $contact_id");
     $row = mysqli_fetch_assoc($sql);
     $contact_name = escapeSql($row['contact_name']);
     $client_id = intval($row['contact_client_id']);
@@ -1262,7 +1262,7 @@ if (isset($_GET['unlink_contact_from_file'])) {
 
 }
 
-if (isset($_POST['export_contacts'])) {
+if (isExportRequest('export_contacts')) {
 
     validateCSRFToken();
 
@@ -1349,7 +1349,7 @@ if (isset($_POST['export_contacts'])) {
         WHERE $archive_query
         $tag_query
         AND (contact_name LIKE '%$q%' OR contact_title LIKE '%$q%' OR location_name LIKE '%$q%' OR contact_email LIKE '%$q%' OR contact_department LIKE '%$q%' OR contact_phone LIKE '%$q%' OR contact_mobile LIKE '%$q%' OR client_name LIKE '%$q%' OR tag_name LIKE '%$q%')
-        $access_permission_query
+        " . clientScopeSql('contact_client_id') . "
         $client_query
         $location_query
         GROUP BY contact_id
@@ -1428,7 +1428,7 @@ if (isset($_POST["import_contacts_csv"])) {
             $duplicate_detect = 0;
             if (isset($column[0])) {
                 $name = escapeSql($column[0]);
-                if (mysqli_num_rows(mysqli_query($mysqli,"SELECT * FROM contacts WHERE contact_name = '$name' AND contact_client_id = $client_id")) > 0) {
+                if (mysqli_num_rows(mysqli_query($mysqli,"SELECT 1 FROM contacts WHERE contact_name = '$name' AND contact_client_id = $client_id")) > 0) {
                     $duplicate_detect = 1;
                 }
             }
@@ -1452,7 +1452,7 @@ if (isset($_POST["import_contacts_csv"])) {
             }
             if (isset($column[7])) {
                 $location = escapeSql($column[7]);
-                $sql_location = mysqli_query($mysqli,"SELECT * FROM locations WHERE location_name = '$location' AND location_client_id = $client_id");
+                $sql_location = mysqli_query($mysqli,"SELECT location_id FROM locations WHERE location_name = '$location' AND location_client_id = $client_id");
                 $row = mysqli_fetch_assoc($sql_location);
                 $location_id = intval($row['location_id']);
             }
diff --git a/agent/post/credential.php b/agent/post/credential.php
index 23d3a9c6e..a884a43e6 100644
--- a/agent/post/credential.php
+++ b/agent/post/credential.php
@@ -194,7 +194,7 @@ if (isset($_POST['bulk_assign_credential_tags'])) {
                 foreach($_POST['bulk_tags'] as $tag) {
                     $tag = intval($tag);
 
-                    $sql = mysqli_query($mysqli,"SELECT * FROM credential_tags WHERE credential_id = $credential_id AND tag_id = $tag");
+                    $sql = mysqli_query($mysqli,"SELECT 1 FROM credential_tags WHERE credential_id = $credential_id AND tag_id = $tag");
                     if (mysqli_num_rows($sql) == 0) {
                         mysqli_query($mysqli, "INSERT INTO credential_tags SET credential_id = $credential_id, tag_id = $tag");
                     }
@@ -410,7 +410,7 @@ if (isset($_POST['bulk_delete_credentials'])) {
 
 }
 
-if (isset($_POST['export_credentials'])) {
+if (isExportRequest('export_credentials')) {
 
     validateCSRFToken();
 
@@ -487,7 +487,7 @@ if (isset($_POST['export_credentials'])) {
         WHERE $archive_query
         $tag_query
         AND (c.credential_name LIKE '%$q%' OR c.credential_description LIKE '%$q%' OR c.credential_uri LIKE '%$q%' OR tag_name LIKE '%$q%' OR client_name LIKE '%$q%')
-        $access_permission_query
+        " . clientScopeSql('credential_client_id') . "
         $client_query
         GROUP BY c.credential_id
         ORDER BY c.credential_name ASC"
@@ -584,7 +584,7 @@ if (isset($_POST["import_credentials_csv"])) {
             // Name
             if (isset($column[0])) {
                 $name = escapeSql($column[0]);
-                if (mysqli_num_rows(mysqli_query($mysqli,"SELECT * FROM credentials WHERE credential_name = '$name' AND credential_client_id = $client_id")) > 0){
+                if (mysqli_num_rows(mysqli_query($mysqli,"SELECT 1 FROM credentials WHERE credential_name = '$name' AND credential_client_id = $client_id")) > 0){
                     $duplicate_detect = 1;
                 }
             }
diff --git a/agent/post/document.php b/agent/post/document.php
index de29e063a..4d039bc16 100644
--- a/agent/post/document.php
+++ b/agent/post/document.php
@@ -70,7 +70,7 @@ if (isset($_POST['add_document_from_template'])) {
     // Get template
     $sql_document = mysqli_query(
         $mysqli,
-        "SELECT * FROM document_templates
+        "SELECT document_template_content, document_template_name FROM document_templates
          WHERE document_template_id = $document_template_id"
     );
 
@@ -154,7 +154,8 @@ if (isset($_POST['edit_document'])) {
     // 1) Load the current document to create a version
     $sql_original_document = mysqli_query(
         $mysqli,
-        "SELECT * FROM documents
+        "SELECT document_content, document_created_at, document_created_by, document_description,
+            document_name, document_updated_at, document_updated_by FROM documents
          WHERE document_client_id = $client_id
            AND document_id = $document_id"
     );
diff --git a/agent/post/domain.php b/agent/post/domain.php
index f0b09e0f9..5b3e32c3c 100644
--- a/agent/post/domain.php
+++ b/agent/post/domain.php
@@ -207,7 +207,7 @@ if (isset($_GET['archive_domain'])) {
     $domain_id = intval($_GET['archive_domain']);
 
     //Get domain Name
-    $sql = mysqli_query($mysqli,"SELECT * FROM domains WHERE domain_id = $domain_id");
+    $sql = mysqli_query($mysqli,"SELECT domain_client_id, domain_name FROM domains WHERE domain_id = $domain_id");
     $row = mysqli_fetch_assoc($sql);
     $domain_name = escapeSql($row['domain_name']);
     $client_id = intval($row['domain_client_id']);
@@ -455,7 +455,7 @@ if (isset($_POST['bulk_refresh_domains'])) {
 
 }
 
-if (isset($_POST['export_domains'])) {
+if (isExportRequest('export_domains')) {
 
     validateCSRFToken();
 
@@ -530,7 +530,7 @@ if (isset($_POST['export_domains'])) {
         LEFT JOIN vendors AS webhost ON domains.domain_webhost = webhost.vendor_id
         WHERE (domains.domain_name LIKE '%$q%' OR domains.domain_description LIKE '%$q%' OR registrar.vendor_name LIKE '%$q%' OR webhost.vendor_name LIKE '%$q%' OR client_name LIKE '%$q%')
         AND $archive_query
-        $access_permission_query
+        " . clientScopeSql('domain_client_id') . "
         $client_query
         $expire_query
         ORDER BY domains.domain_name ASC"
diff --git a/agent/post/event.php b/agent/post/event.php
index 449de8673..e1b9044f4 100644
--- a/agent/post/event.php
+++ b/agent/post/event.php
@@ -50,7 +50,7 @@ if (isset($_GET['delete_calendar'])) {
     $calendar_id = intval($_GET['delete_calendar']);
 
     // Get Calendar Name
-    $sql = mysqli_query($mysqli,"SELECT * FROM calendars WHERE calendar_id = $calendar_id");
+    $sql = mysqli_query($mysqli,"SELECT calendar_name FROM calendars WHERE calendar_id = $calendar_id");
     $row = mysqli_fetch_assoc($sql);
     $calendar_name = escapeSql($row['calendar_name']);
 
@@ -192,7 +192,8 @@ if (isset($_POST['add_event'])) {
         $contact_name = escapeSql($row['contact_name']);
         $contact_email = escapeSql($row['contact_email']);
 
-        $sql_company = mysqli_query($mysqli,"SELECT * FROM companies WHERE company_id = 1");
+        $sql_company = mysqli_query($mysqli,"SELECT company_address, company_city, company_country, company_email, company_logo, company_name,
+            company_phone, company_state, company_website, company_zip FROM companies WHERE company_id = 1");
         $row = mysqli_fetch_assoc($sql_company);
         $company_name = escapeSql($row['company_name']);
         $company_country = escapeSql($row['company_country']);
@@ -266,7 +267,8 @@ if (isset($_POST['edit_event'])) {
         $contact_name = escapeSql($row['contact_name']);
         $contact_email = escapeSql($row['contact_email']);
 
-        $sql_company = mysqli_query($mysqli,"SELECT * FROM companies WHERE company_id = 1");
+        $sql_company = mysqli_query($mysqli,"SELECT company_address, company_city, company_country, company_email, company_logo, company_name,
+            company_phone, company_state, company_website, company_zip FROM companies WHERE company_id = 1");
         $row = mysqli_fetch_assoc($sql_company);
         $company_name = escapeSql($row['company_name']);
         $company_country = escapeSql($row['company_country']);
@@ -323,7 +325,7 @@ if (isset($_GET['delete_event'])) {
     $event_id = intval($_GET['delete_event']);
 
     // Get Event Title
-    $sql = mysqli_query($mysqli,"SELECT * FROM calendar_events WHERE event_id = $event_id");
+    $sql = mysqli_query($mysqli,"SELECT event_client_id, event_title FROM calendar_events WHERE event_id = $event_id");
     $row = mysqli_fetch_assoc($sql);
     $event_title = escapeSql($row['event_title']);
     $client_id = intval($row['event_client_id']);
diff --git a/agent/post/expense.php b/agent/post/expense.php
index 213a1b737..d2f5c39a6 100644
--- a/agent/post/expense.php
+++ b/agent/post/expense.php
@@ -104,7 +104,7 @@ if (isset($_GET['delete_expense'])) {
 
     $expense_id = intval($_GET['delete_expense']);
 
-    $sql = mysqli_query($mysqli,"SELECT * FROM expenses WHERE expense_id = $expense_id");
+    $sql = mysqli_query($mysqli,"SELECT expense_client_id, expense_description, expense_receipt FROM expenses WHERE expense_id = $expense_id");
     $row = mysqli_fetch_assoc($sql);
     $expense_receipt = escapeSql($row['expense_receipt']);
     $expense_description = escapeSql($row['expense_description']);
@@ -270,7 +270,7 @@ if (isset($_POST['bulk_delete_expenses'])) {
 
             $expense_id = intval($expense_id);
 
-            $sql = mysqli_query($mysqli,"SELECT * FROM expenses WHERE expense_id = $expense_id");
+            $sql = mysqli_query($mysqli,"SELECT expense_client_id, expense_description, expense_receipt FROM expenses WHERE expense_id = $expense_id");
             $row = mysqli_fetch_assoc($sql);
             $expense_description = escapeSql($row['expense_description']);
             $expense_receipt = escapeSql($row['expense_receipt']);
@@ -298,7 +298,7 @@ if (isset($_POST['bulk_delete_expenses'])) {
 
 }
 
-if (isset($_POST['export_expenses'])) {
+if (isExportRequest('export_expenses')) {
 
     validateCSRFToken();
 
@@ -370,7 +370,7 @@ if (isset($_POST['export_expenses'])) {
         $category_query
         AND (vendor_name LIKE '%$q%' OR client_name LIKE '%$q%' OR category_name LIKE '%$q%' OR account_name LIKE '%$q%' OR expense_description LIKE '%$q%' OR expense_amount LIKE '%$q%')
         $account_query
-        $access_permission_query
+        " . clientScopeSql('expense_client_id') . "
         ORDER BY expense_date ASC"
     );
 
diff --git a/agent/post/file.php b/agent/post/file.php
index 5005f274c..f2d656e34 100644
--- a/agent/post/file.php
+++ b/agent/post/file.php
@@ -267,7 +267,7 @@ if (isset($_POST['bulk_archive_files'])) {
 
             $file_id = intval($file_id);
 
-            $sql_file = mysqli_query($mysqli,"SELECT * FROM files WHERE file_id = $file_id");
+            $sql_file = mysqli_query($mysqli,"SELECT file_client_id, file_name FROM files WHERE file_id = $file_id");
             $row = mysqli_fetch_assoc($sql_file);
             $client_id = intval($row['file_client_id']);
             $file_name = escapeSql($row['file_name']);
@@ -411,7 +411,7 @@ if (isset($_POST['bulk_restore_files'])) {
 
             $file_id = intval($file_id);
 
-            $sql_file = mysqli_query($mysqli,"SELECT * FROM files WHERE file_id = $file_id");
+            $sql_file = mysqli_query($mysqli,"SELECT file_client_id, file_name FROM files WHERE file_id = $file_id");
             $row = mysqli_fetch_assoc($sql_file);
             $client_id = intval($row['file_client_id']);
             $file_name = escapeSql($row['file_name']);
diff --git a/agent/post/folder.php b/agent/post/folder.php
index d9c2ba43d..023d34247 100644
--- a/agent/post/folder.php
+++ b/agent/post/folder.php
@@ -78,7 +78,7 @@ if (isset($_GET['delete_folder'])) {
     mysqli_query($mysqli,"DELETE FROM folders WHERE folder_id = $folder_id");
 
     // Move files in deleted folder back to the root folder /
-    $sql_documents = mysqli_query($mysqli,"SELECT * FROM documents WHERE document_folder_id = $folder_id");
+    $sql_documents = mysqli_query($mysqli,"SELECT document_id FROM documents WHERE document_folder_id = $folder_id");
     while($row = mysqli_fetch_assoc($sql_documents)) {
         $document_id = intval($row['document_id']);
 
diff --git a/agent/post/income.php b/agent/post/income.php
index 40cf87cd6..c24c04b42 100644
--- a/agent/post/income.php
+++ b/agent/post/income.php
@@ -307,7 +307,7 @@ if (isset($_POST['bulk_edit_income_method'])) {
 
 }
 
-if (isset($_POST['export_income'])) {
+if (isExportRequest('export_income')) {
 
     validateCSRFToken();
 
@@ -439,7 +439,7 @@ if (isset($_POST['export_income'])) {
             LEFT JOIN categories ON invoice_category_id = category_id
             WHERE payment_archived_at IS NULL
             $payment_client_query
-            $access_permission_query
+            " . clientScopeSql('invoice_client_id') . "
 
             UNION ALL
 
diff --git a/agent/post/invoice.php b/agent/post/invoice.php
index 48b0d8cae..5cc734be5 100644
--- a/agent/post/invoice.php
+++ b/agent/post/invoice.php
@@ -74,7 +74,7 @@ if (isset($_POST['edit_invoice'])) {
     enforceClientAccess();
 
     // Calculate new total
-    $sql = mysqli_query($mysqli,"SELECT * FROM invoice_items WHERE item_invoice_id = $invoice_id");
+    $sql = mysqli_query($mysqli,"SELECT item_total FROM invoice_items WHERE item_invoice_id = $invoice_id");
     $invoice_amount = 0;
     while($row = mysqli_fetch_assoc($sql)) {
         $item_total = floatval($row['item_total']);
@@ -103,7 +103,9 @@ if (isset($_POST['add_invoice_copy'])) {
     $date = escapeSql($_POST['date']);
 
     //Get Net Terms
-    $sql = mysqli_query($mysqli,"SELECT * FROM clients, invoices WHERE client_id = invoice_client_id AND invoice_id = $invoice_id");
+    $sql = mysqli_query($mysqli,"SELECT client_net_terms, invoice_amount, invoice_category_id, invoice_client_id,
+        invoice_currency_code, invoice_discount_amount, invoice_note, invoice_number,
+        invoice_prefix, invoice_scope FROM clients, invoices WHERE client_id = invoice_client_id AND invoice_id = $invoice_id");
     $row = mysqli_fetch_assoc($sql);
     $client_net_terms = intval($row['client_net_terms']);
     $invoice_scope = escapeSql($row['invoice_scope']);
@@ -138,7 +140,8 @@ if (isset($_POST['add_invoice_copy'])) {
 
     mysqli_query($mysqli,"INSERT INTO history SET history_status = 'Draft', history_description = 'Copied INVOICE!', history_invoice_id = $new_invoice_id");
 
-    $sql_items = mysqli_query($mysqli,"SELECT * FROM invoice_items WHERE item_invoice_id = $invoice_id");
+    $sql_items = mysqli_query($mysqli,"SELECT item_description, item_id, item_name, item_order, item_price, item_quantity, item_subtotal,
+        item_tax, item_tax_id, item_total FROM invoice_items WHERE item_invoice_id = $invoice_id");
     while($row = mysqli_fetch_assoc($sql_items)) {
         $item_id = intval($row['item_id']);
         $item_name = escapeSql($row['item_name']);
@@ -271,21 +274,21 @@ if (isset($_GET['delete_invoice'])) {
     mysqli_query($mysqli,"DELETE FROM invoices WHERE invoice_id = $invoice_id");
 
     //Delete Items Associated with the Invoice
-    $sql = mysqli_query($mysqli,"SELECT * FROM invoice_items WHERE item_invoice_id = $invoice_id");
+    $sql = mysqli_query($mysqli,"SELECT item_id FROM invoice_items WHERE item_invoice_id = $invoice_id");
     while($row = mysqli_fetch_assoc($sql)) {
         $item_id = intval($row['item_id']);
         mysqli_query($mysqli,"DELETE FROM invoice_items WHERE item_id = $item_id");
     }
 
     //Delete History Associated with the Invoice
-    $sql = mysqli_query($mysqli,"SELECT * FROM history WHERE history_invoice_id = $invoice_id");
+    $sql = mysqli_query($mysqli,"SELECT history_id FROM history WHERE history_invoice_id = $invoice_id");
     while($row = mysqli_fetch_assoc($sql)) {
         $history_id = intval($row['history_id']);
         mysqli_query($mysqli,"DELETE FROM history WHERE history_id = $history_id");
     }
 
     //Delete Payments Associated with the Invoice
-    $sql = mysqli_query($mysqli,"SELECT * FROM payments WHERE payment_invoice_id = $invoice_id");
+    $sql = mysqli_query($mysqli,"SELECT payment_id FROM payments WHERE payment_invoice_id = $invoice_id");
     while($row = mysqli_fetch_assoc($sql)) {
         $payment_id = intval($row['payment_id']);
         mysqli_query($mysqli,"DELETE FROM payments WHERE payment_id = $payment_id");
@@ -352,7 +355,7 @@ if (isset($_POST['add_invoice_item'])) {
 
     // Tax
     if ($tax_id > 0) {
-        $sql = mysqli_query($mysqli,"SELECT * FROM taxes WHERE tax_id = $tax_id");
+        $sql = mysqli_query($mysqli,"SELECT tax_percent FROM taxes WHERE tax_id = $tax_id");
         $row = mysqli_fetch_assoc($sql);
         $tax_percent = floatval($row['tax_percent']);
         $tax_amount = $subtotal * $tax_percent / 100;
@@ -365,14 +368,14 @@ if (isset($_POST['add_invoice_item'])) {
     mysqli_query($mysqli,"INSERT INTO invoice_items SET item_name = '$name', item_description = '$description', item_quantity = $qty, item_price = $price, item_subtotal = $subtotal, item_tax = $tax_amount, item_total = $total, item_order = $item_order, item_tax_id = $tax_id, item_product_id = $product_id, item_invoice_id = $invoice_id");
 
     // Get Discount and Invoice Details
-    $sql = mysqli_query($mysqli,"SELECT * FROM invoices WHERE invoice_id = $invoice_id");
+    $sql = mysqli_query($mysqli,"SELECT invoice_discount_amount, invoice_number, invoice_prefix FROM invoices WHERE invoice_id = $invoice_id");
     $row = mysqli_fetch_assoc($sql);
     $invoice_prefix = escapeSql($row['invoice_prefix']);
     $invoice_number = intval($row['invoice_number']);
     $invoice_discount = floatval($row['invoice_discount_amount']);
 
     //add up all line items
-    $sql = mysqli_query($mysqli,"SELECT * FROM invoice_items WHERE item_invoice_id = $invoice_id");
+    $sql = mysqli_query($mysqli,"SELECT item_total FROM invoice_items WHERE item_invoice_id = $invoice_id");
     $invoice_total = 0;
     while($row = mysqli_fetch_assoc($sql)) {
         $item_total = floatval($row['item_total']);
@@ -400,7 +403,7 @@ if (isset($_POST['invoice_note'])) {
     $note = escapeSql($_POST['note']);
 
     // Get Invoice Details for logging
-    $sql = mysqli_query($mysqli,"SELECT * FROM invoices WHERE invoice_id = $invoice_id");
+    $sql = mysqli_query($mysqli,"SELECT invoice_client_id, invoice_number, invoice_prefix FROM invoices WHERE invoice_id = $invoice_id");
     $row = mysqli_fetch_assoc($sql);
     $invoice_prefix = escapeSql($row['invoice_prefix']);
     $invoice_number = intval($row['invoice_number']);
@@ -435,7 +438,7 @@ if (isset($_POST['edit_invoice_item'])) {
     $subtotal = $price * $qty;
 
     if ($tax_id > 0) {
-        $sql = mysqli_query($mysqli,"SELECT * FROM taxes WHERE tax_id = $tax_id");
+        $sql = mysqli_query($mysqli,"SELECT tax_percent FROM taxes WHERE tax_id = $tax_id");
         $row = mysqli_fetch_assoc($sql);
         $tax_percent = floatval($row['tax_percent']);
         $tax_amount = $subtotal * $tax_percent / 100;
@@ -451,7 +454,7 @@ if (isset($_POST['edit_invoice_item'])) {
     $invoice_id = intval($row['item_invoice_id']);
 
     //Get Discount Amount
-    $sql = mysqli_query($mysqli,"SELECT * FROM invoices WHERE invoice_id = $invoice_id");
+    $sql = mysqli_query($mysqli,"SELECT invoice_client_id, invoice_discount_amount, invoice_number, invoice_prefix FROM invoices WHERE invoice_id = $invoice_id");
     $row = mysqli_fetch_assoc($sql);
     $invoice_prefix = escapeSql($row['invoice_prefix']);
     $invoice_number = intval($row['invoice_number']);
@@ -485,7 +488,8 @@ if (isset($_GET['delete_invoice_item'])) {
 
     $item_id = intval($_GET['delete_invoice_item']);
 
-    $sql = mysqli_query($mysqli,"SELECT * FROM invoice_items WHERE item_id = $item_id");
+    $sql = mysqli_query($mysqli,"SELECT item_invoice_id, item_name, item_product_id, item_quantity, item_subtotal, item_tax,
+        item_total FROM invoice_items WHERE item_id = $item_id");
     $row = mysqli_fetch_assoc($sql);
     $invoice_id = intval($row['item_invoice_id']);
     $item_name = escapeSql($row['item_name']);
@@ -495,7 +499,7 @@ if (isset($_GET['delete_invoice_item'])) {
     $item_tax = floatval($row['item_tax']);
     $item_total = floatval($row['item_total']);
 
-    $sql = mysqli_query($mysqli,"SELECT * FROM invoices WHERE invoice_id = $invoice_id");
+    $sql = mysqli_query($mysqli,"SELECT invoice_amount, invoice_client_id, invoice_number, invoice_prefix FROM invoices WHERE invoice_id = $invoice_id");
     $row = mysqli_fetch_assoc($sql);
     $invoice_prefix = escapeSql($row['invoice_prefix']);
     $invoice_number = intval($row['invoice_number']);
@@ -530,7 +534,9 @@ if (isset($_GET['email_invoice'])) {
 
     $invoice_id = intval($_GET['email_invoice']);
 
-    $sql = mysqli_query($mysqli,"SELECT * FROM invoices
+    $sql = mysqli_query($mysqli,"SELECT client_id, client_name, contact_email, contact_name, invoice_amount, invoice_currency_code,
+        invoice_date, invoice_due, invoice_id, invoice_number, invoice_prefix, invoice_scope,
+        invoice_status, invoice_url_key FROM invoices
         LEFT JOIN clients ON invoice_client_id = client_id
         LEFT JOIN contacts ON clients.client_id = contacts.contact_client_id AND contact_primary = 1
         WHERE invoice_id = $invoice_id"
@@ -554,7 +560,8 @@ if (isset($_GET['email_invoice'])) {
 
     enforceClientAccess();
 
-    $sql = mysqli_query($mysqli,"SELECT * FROM companies WHERE company_id = 1");
+    $sql = mysqli_query($mysqli,"SELECT company_address, company_city, company_country, company_email, company_logo, company_name,
+        company_phone, company_phone_country_code, company_state, company_website, company_zip FROM companies WHERE company_id = 1");
     $row = mysqli_fetch_assoc($sql);
 
     $company_name = escapeSql($row['company_name']);
@@ -650,7 +657,7 @@ if (isset($_GET['email_invoice'])) {
 
 }
 
-if (isset($_POST['export_invoices'])) {
+if (isExportRequest('export_invoices')) {
 
     validateCSRFToken();
 
@@ -730,7 +737,7 @@ if (isset($_POST['export_invoices'])) {
         $category_query
         AND DATE(invoice_date) BETWEEN '$dtf' AND '$dtt'
         AND (CONCAT(invoice_prefix,invoice_number) LIKE '%$q%' OR invoice_scope LIKE '%$q%' OR client_name LIKE '%$q%' OR invoice_status LIKE '%$q%' OR invoice_amount LIKE '%$q%' OR category_name LIKE '%$q%')
-        $access_permission_query
+        " . clientScopeSql('invoice_client_id') . "
         $client_query
         ORDER BY invoice_number ASC"
     );
@@ -818,12 +825,18 @@ if (isset($_GET['export_invoice_pdf'])) {
 
     $sql = mysqli_query(
         $mysqli,
-        "SELECT * FROM invoices
+        "SELECT client_currency_code, client_id, client_name, client_net_terms, client_website,
+            contact_email, contact_extension, contact_mobile, contact_mobile_country_code,
+            contact_phone, contact_phone_country_code, invoice_amount, invoice_category_id,
+            invoice_created_at, invoice_currency_code, invoice_date, invoice_discount_amount,
+            invoice_due, invoice_id, invoice_note, invoice_number, invoice_prefix, invoice_scope,
+            invoice_status, invoice_url_key, location_address, location_city, location_country,
+            location_state, location_zip FROM invoices
         LEFT JOIN clients ON invoice_client_id = client_id
         LEFT JOIN contacts ON clients.client_id = contacts.contact_client_id AND contact_primary = 1
         LEFT JOIN locations ON clients.client_id = locations.location_client_id AND location_primary = 1
         WHERE invoice_id = $invoice_id
-        $access_permission_query
+        " . clientScopeSql('invoice_client_id') . "
         LIMIT 1"
     );
 
@@ -864,7 +877,9 @@ if (isset($_GET['export_invoice_pdf'])) {
 
     enforceClientAccess();
 
-    $sql = mysqli_query($mysqli, "SELECT * FROM companies WHERE company_id = 1");
+    $sql = mysqli_query($mysqli, "SELECT company_address, company_city, company_country, company_email, company_id, company_logo,
+        company_name, company_phone, company_phone_country_code, company_state, company_tax_id,
+        company_website, company_zip FROM companies WHERE company_id = 1");
     $row = mysqli_fetch_assoc($sql);
     $company_id = intval($row['company_id']);
     $company_name = escapeHtml($row['company_name']);
@@ -974,7 +989,7 @@ if (isset($_GET['export_invoice_pdf'])) {
     $sub_total = 0;
     $total_tax = 0;
 
-    $sql_items = mysqli_query($mysqli, "SELECT * FROM invoice_items WHERE item_invoice_id = $invoice_id ORDER BY item_order ASC");
+    $sql_items = mysqli_query($mysqli, "SELECT item_description, item_name, item_price, item_quantity, item_tax, item_total FROM invoice_items WHERE item_invoice_id = $invoice_id ORDER BY item_order ASC");
     while ($item = mysqli_fetch_assoc($sql_items)) {
         $name = $item['item_name'];
         $desc = $item['item_description'];
@@ -1047,12 +1062,14 @@ if (isset($_GET['export_invoice_packing_slip'])) {
 
     $sql = mysqli_query(
         $mysqli,
-        "SELECT * FROM invoices
+        "SELECT client_id, client_name, contact_email, contact_extension, contact_phone,
+            contact_phone_country_code, invoice_date, invoice_id, invoice_number, invoice_prefix,
+            location_address, location_city, location_country, location_state, location_zip FROM invoices
         LEFT JOIN clients ON invoice_client_id = client_id
         LEFT JOIN contacts ON clients.client_id = contacts.contact_client_id AND contact_primary = 1
         LEFT JOIN locations ON clients.client_id = locations.location_client_id AND location_primary = 1
         WHERE invoice_id = $invoice_id
-        $access_permission_query
+        " . clientScopeSql('invoice_client_id') . "
         LIMIT 1"
     );
 
@@ -1075,7 +1092,9 @@ if (isset($_GET['export_invoice_packing_slip'])) {
 
     enforceClientAccess();
 
-    $sql = mysqli_query($mysqli, "SELECT * FROM companies WHERE company_id = 1");
+    $sql = mysqli_query($mysqli, "SELECT company_address, company_city, company_country, company_email, company_id, company_logo,
+        company_name, company_phone, company_phone_country_code, company_state, company_website,
+        company_zip FROM companies WHERE company_id = 1");
     $row = mysqli_fetch_assoc($sql);
     $company_id = intval($row['company_id']);
     $company_name = escapeHtml($row['company_name']);
@@ -1140,7 +1159,7 @@ if (isset($_GET['export_invoice_packing_slip'])) {
     $sub_total = 0;
     $total_tax = 0;
 
-    $sql_items = mysqli_query($mysqli, "SELECT * FROM invoice_items WHERE item_invoice_id = $invoice_id ORDER BY item_order ASC");
+    $sql_items = mysqli_query($mysqli, "SELECT item_name, item_quantity FROM invoice_items WHERE item_invoice_id = $invoice_id ORDER BY item_order ASC");
     while ($item = mysqli_fetch_assoc($sql_items)) {
         $name = $item['item_name'];
         $qty = $item['item_quantity'];
@@ -1205,7 +1224,7 @@ if (isset($_POST['bulk_edit_invoice_category'])) {
             $invoice_id = intval($invoice_id);
 
             // Get Invoice Details for Logging
-            $sql = mysqli_query($mysqli,"SELECT * FROM invoices WHERE invoice_id = $invoice_id");
+            $sql = mysqli_query($mysqli,"SELECT invoice_client_id, invoice_number, invoice_prefix, invoice_scope FROM invoices WHERE invoice_id = $invoice_id");
             $row = mysqli_fetch_assoc($sql);
             $invoice_prefix = escapeSql($row['invoice_prefix']);
             $invoice_number = intval($row['invoice_number']);
diff --git a/agent/post/location.php b/agent/post/location.php
index 9401ea1f0..01619678c 100644
--- a/agent/post/location.php
+++ b/agent/post/location.php
@@ -242,7 +242,7 @@ if (isset($_POST['bulk_assign_location_tags'])) {
                 foreach($_POST['bulk_tags'] as $tag) {
                     $tag = intval($tag);
 
-                    $sql = mysqli_query($mysqli,"SELECT * FROM location_tags WHERE location_id = $location_id AND tag_id = $tag");
+                    $sql = mysqli_query($mysqli,"SELECT 1 FROM location_tags WHERE location_id = $location_id AND tag_id = $tag");
                     if (mysqli_num_rows($sql) == 0) {
                         mysqli_query($mysqli, "INSERT INTO location_tags SET location_id = $location_id, tag_id = $tag");
                     }
@@ -388,7 +388,7 @@ if (isset($_POST['bulk_delete_locations'])) {
 
 }
 
-if (isset($_POST['export_locations'])) {
+if (isExportRequest('export_locations')) {
 
     validateCSRFToken();
 
@@ -463,7 +463,7 @@ if (isset($_POST['export_locations'])) {
         WHERE $archive_query
         $tag_query
         AND (location_name LIKE '%$q%' OR location_description LIKE '%$q%' OR location_address LIKE '%$q%' OR location_city LIKE '%$q%' OR location_state LIKE '%$q%' OR location_zip LIKE '%$q%' OR location_country LIKE '%$q%' OR location_phone LIKE '%$q%' OR client_name LIKE '%$q%' OR tag_name LIKE '%$q%')
-        $access_permission_query
+        " . clientScopeSql('location_client_id') . "
         $client_query
         GROUP BY location_id
         ORDER BY location_name ASC"
@@ -541,7 +541,7 @@ if (isset($_POST["import_locations_csv"])) {
             $duplicate_detect = 0;
             if(isset($column[0])){
                 $name = escapeSql($column[0]);
-                if(mysqli_num_rows(mysqli_query($mysqli,"SELECT * FROM locations WHERE location_name = '$name' AND location_client_id = $client_id")) > 0){
+                if(mysqli_num_rows(mysqli_query($mysqli,"SELECT 1 FROM locations WHERE location_name = '$name' AND location_client_id = $client_id")) > 0){
                     $duplicate_detect = 1;
                 }
             }
diff --git a/agent/post/network.php b/agent/post/network.php
index f546b8b29..0e2b1f2c1 100644
--- a/agent/post/network.php
+++ b/agent/post/network.php
@@ -172,7 +172,7 @@ if (isset($_POST['bulk_delete_networks'])) {
 
 }
 
-if (isset($_POST['export_networks'])) {
+if (isExportRequest('export_networks')) {
 
     validateCSRFToken();
 
@@ -238,7 +238,7 @@ if (isset($_POST['export_networks'])) {
         LEFT JOIN locations ON location_id = network_location_id
         WHERE $archive_query
         AND (network_name LIKE '%$q%' OR network_description LIKE '%$q%' OR network_vlan LIKE '%$q%' OR network LIKE '%$q%' OR network_gateway LIKE '%$q%' OR network_primary_dns LIKE '%$q%' OR network_secondary_dns LIKE '%$q%' OR client_name LIKE '%$q%')
-        $access_permission_query
+        " . clientScopeSql('network_client_id') . "
         $location_query
         $client_query
         ORDER BY network_name ASC"
diff --git a/agent/post/payment.php b/agent/post/payment.php
index 4c4a79647..83c2c2996 100644
--- a/agent/post/payment.php
+++ b/agent/post/payment.php
@@ -43,7 +43,9 @@ if (isset($_POST['add_payment'])) {
         $total_payments_amount = floatval($row['payments_amount']);
 
         //Get the invoice total
-        $sql = mysqli_query($mysqli,"SELECT * FROM invoices
+        $sql = mysqli_query($mysqli,"SELECT client_name, contact_email, contact_extension, contact_mobile, contact_mobile_country_code,
+            contact_name, contact_phone, contact_phone_country_code, invoice_amount,
+            invoice_currency_code, invoice_number, invoice_prefix, invoice_url_key FROM invoices
             LEFT JOIN clients ON invoice_client_id = client_id
             LEFT JOIN contacts ON clients.client_id = contacts.contact_client_id AND contact_primary = 1
             WHERE invoice_id = $invoice_id"
@@ -62,7 +64,8 @@ if (isset($_POST['add_payment'])) {
         $contact_extension = preg_replace("/[^0-9]/", '',$row['contact_extension']);
         $contact_mobile = escapeSql(formatPhoneNumber($row['contact_mobile'], $row['contact_mobile_country_code']));
 
-        $sql = mysqli_query($mysqli,"SELECT * FROM companies WHERE company_id = 1");
+        $sql = mysqli_query($mysqli,"SELECT company_address, company_city, company_country, company_email, company_logo, company_name,
+            company_phone, company_phone_country_code, company_state, company_website, company_zip FROM companies WHERE company_id = 1");
         $row = mysqli_fetch_assoc($sql);
 
         $company_name = escapeSql($row['company_name']);
@@ -218,7 +221,7 @@ if (isset($_POST['apply_credit'])) {
     $invoice_id = intval($_POST['invoice_id']);
     $credit_amount_applied = floatval($_POST['credit_amount_applied']);
 
-    $sql = mysqli_query($mysqli, "SELECT * FROM invoices LEFT JOIN clients ON invoice_client_id = client_id WHERE invoice_id = $invoice_id");
+    $sql = mysqli_query($mysqli, "SELECT invoice_client_id, invoice_credit_amount, invoice_number, invoice_prefix, invoice_status FROM invoices LEFT JOIN clients ON invoice_client_id = client_id WHERE invoice_id = $invoice_id");
     $row = mysqli_fetch_assoc($sql);
 
     $invoice_prefix = escapeSql($row['invoice_prefix']);
@@ -329,7 +332,10 @@ if (isset($_POST['add_payment_stripe'])) {
     $saved_payment_id = intval($_POST['saved_payment_id']);
 
     // Get invoice details
-    $sql = mysqli_query($mysqli,"SELECT * FROM invoices
+    $sql = mysqli_query($mysqli,"SELECT client_id, client_name, contact_email, contact_extension, contact_mobile,
+        contact_mobile_country_code, contact_name, contact_phone, contact_phone_country_code,
+        invoice_amount, invoice_currency_code, invoice_number, invoice_prefix, invoice_status,
+        invoice_url_key FROM invoices
             LEFT JOIN clients ON invoice_client_id = client_id
             LEFT JOIN contacts ON client_id = contact_client_id AND contact_primary = 1
             WHERE invoice_id = $invoice_id"
@@ -353,7 +359,8 @@ if (isset($_POST['add_payment_stripe'])) {
     enforceClientAccess();
 
     // Get ITFlow company details
-    $sql = mysqli_query($mysqli,"SELECT * FROM companies WHERE company_id = 1");
+    $sql = mysqli_query($mysqli,"SELECT company_address, company_city, company_country, company_email, company_name, company_phone,
+        company_phone_country_code, company_state, company_website, company_zip FROM companies WHERE company_id = 1");
     $row = mysqli_fetch_assoc($sql);
     $company_name = escapeSql($row['company_name']);
     $company_country = escapeSql($row['company_country']);
@@ -370,7 +377,8 @@ if (isset($_POST['add_payment_stripe'])) {
     $config_invoice_from_email = escapeSql($config_invoice_from_email);
 
     // Get Client Payment Details
-    $sql = mysqli_query($mysqli, "SELECT * FROM client_saved_payment_methods LEFT JOIN payment_providers ON saved_payment_provider_id = payment_provider_id LEFT JOIN client_payment_provider ON saved_payment_client_id = client_id WHERE saved_payment_id = $saved_payment_id LIMIT 1");
+    $sql = mysqli_query($mysqli, "SELECT payment_provider_account, payment_provider_client, payment_provider_private_key,
+        payment_provider_public_key, saved_payment_description, saved_payment_provider_method FROM client_saved_payment_methods LEFT JOIN payment_providers ON saved_payment_provider_id = payment_provider_id LEFT JOIN client_payment_provider ON saved_payment_client_id = client_id WHERE saved_payment_id = $saved_payment_id LIMIT 1");
     $row = mysqli_fetch_assoc($sql);
 
     $public_key = escapeSql($row['payment_provider_public_key']);
@@ -651,7 +659,7 @@ if (isset($_GET['delete_payment'])) {
     $payment_id = intval($_GET['delete_payment']);
 
     // payments has no client column - the client comes from the invoice the payment sits on
-    $sql = mysqli_query($mysqli,"SELECT * FROM payments
+    $sql = mysqli_query($mysqli,"SELECT invoice_client_id, invoice_number, invoice_prefix, payment_invoice_id FROM payments
         LEFT JOIN invoices ON payment_invoice_id = invoice_id
         WHERE payment_id = $payment_id
         LIMIT 1"
diff --git a/agent/post/product.php b/agent/post/product.php
index 56555c4c4..aded5b520 100644
--- a/agent/post/product.php
+++ b/agent/post/product.php
@@ -244,7 +244,7 @@ if (isset($_POST['bulk_delete_products'])) {
 
 }
 
-if (isset($_POST['export_products'])) {
+if (isExportRequest('export_products')) {
 
     validateCSRFToken();
 
diff --git a/agent/post/project.php b/agent/post/project.php
index d55843961..194a78479 100644
--- a/agent/post/project.php
+++ b/agent/post/project.php
@@ -45,7 +45,8 @@ if (isset($_POST['add_project'])) {
     // If project template is selected add Ticket Templates and convert them to real tickets
     if($project_template_id) {
          // Get Associated Ticket Templates
-        $sql_ticket_templates = mysqli_query($mysqli, "SELECT * FROM ticket_templates, project_template_ticket_templates
+        $sql_ticket_templates = mysqli_query($mysqli, "SELECT ticket_template_details, project_template_ticket_templates.ticket_template_id,
+            ticket_template_order, ticket_template_subject FROM ticket_templates, project_template_ticket_templates
             WHERE ticket_templates.ticket_template_id = project_template_ticket_templates.ticket_template_id
             AND project_template_ticket_templates.project_template_id = $project_template_id");
         $ticket_template_count = mysqli_num_rows($sql_ticket_templates);
@@ -74,7 +75,7 @@ if (isset($_POST['add_project'])) {
 
             // Task Templates for Ticket template and add the to the ticket
             $sql_task_templates = mysqli_query($mysqli,
-                "SELECT * FROM task_templates WHERE task_template_ticket_template_id = $ticket_template_id");
+                "SELECT task_template_id, task_template_name, task_template_order FROM task_templates WHERE task_template_ticket_template_id = $ticket_template_id");
             $task_template_count = mysqli_num_rows($sql_task_templates);
 
             while ($row = mysqli_fetch_assoc($sql_task_templates)) {
diff --git a/agent/post/quote.php b/agent/post/quote.php
index 3021dacef..e41deae9e 100644
--- a/agent/post/quote.php
+++ b/agent/post/quote.php
@@ -79,7 +79,8 @@ if (isset($_POST['add_quote_copy'])) {
 
     $quote_number = mysqli_insert_id($mysqli);
 
-    $sql = mysqli_query($mysqli,"SELECT * FROM quotes WHERE quote_id = $quote_id");
+    $sql = mysqli_query($mysqli,"SELECT quote_amount, quote_category_id, quote_currency_code, quote_discount_amount, quote_note,
+        quote_number, quote_prefix, quote_scope FROM quotes WHERE quote_id = $quote_id");
     $row = mysqli_fetch_assoc($sql);
     $original_quote_prefix = escapeSql($row['quote_prefix']);
     $original_quote_number = escapeSql($row['quote_number']);
@@ -99,7 +100,8 @@ if (isset($_POST['add_quote_copy'])) {
 
     mysqli_query($mysqli,"INSERT INTO history SET history_status = 'Draft', history_description = 'Quote copied!', history_quote_id = $new_quote_id");
 
-    $sql_items = mysqli_query($mysqli,"SELECT * FROM quote_items WHERE item_quote_id = $quote_id");
+    $sql_items = mysqli_query($mysqli,"SELECT item_description, item_id, item_name, item_order, item_price, item_quantity, item_subtotal,
+        item_tax, item_tax_id, item_total FROM quote_items WHERE item_quote_id = $quote_id");
     while($row = mysqli_fetch_assoc($sql_items)) {
         $item_id = intval($row['item_id']);
         $item_name = escapeSql($row['item_name']);
@@ -134,7 +136,8 @@ if (isset($_POST['add_quote_to_invoice'])) {
     $quote_id = intval($_POST['quote_id']);
     $date = escapeSql($_POST['date']);
 
-    $sql = mysqli_query($mysqli,"SELECT * FROM clients, quotes WHERE client_id = quote_client_id AND quote_id = $quote_id");
+    $sql = mysqli_query($mysqli,"SELECT client_net_terms, quote_amount, quote_category_id, quote_client_id, quote_currency_code,
+        quote_discount_amount, quote_note, quote_number, quote_prefix, quote_scope FROM clients, quotes WHERE client_id = quote_client_id AND quote_id = $quote_id");
     $row = mysqli_fetch_assoc($sql);
     $client_net_terms = intval($row['client_net_terms']);
     $quote_prefix = escapeSql($row['quote_prefix']);
@@ -172,7 +175,8 @@ if (isset($_POST['add_quote_to_invoice'])) {
 
     mysqli_query($mysqli,"INSERT INTO history SET history_status = 'Draft', history_description = 'Invoice created from quote $quote_prefix$quote_number', history_invoice_id = $new_invoice_id");
 
-    $sql_items = mysqli_query($mysqli,"SELECT * FROM quote_items WHERE item_quote_id = $quote_id");
+    $sql_items = mysqli_query($mysqli,"SELECT item_description, item_id, item_name, item_order, item_price, item_quantity, item_subtotal,
+        item_tax, item_tax_id, item_total FROM quote_items WHERE item_quote_id = $quote_id");
     while($row = mysqli_fetch_assoc($sql_items)) {
         $item_id = intval($row['item_id']);
         $item_name = escapeSql($row['item_name']);
@@ -239,7 +243,7 @@ if (isset($_POST['add_quote_item'])) {
     $subtotal = $price * $qty;
 
     if ($tax_id > 0) {
-        $sql = mysqli_query($mysqli,"SELECT * FROM taxes WHERE tax_id = $tax_id");
+        $sql = mysqli_query($mysqli,"SELECT tax_percent FROM taxes WHERE tax_id = $tax_id");
         $row = mysqli_fetch_assoc($sql);
         $tax_percent = floatval($row['tax_percent']);
         $tax_amount = $subtotal * $tax_percent / 100;
@@ -252,7 +256,7 @@ if (isset($_POST['add_quote_item'])) {
     mysqli_query($mysqli,"INSERT INTO quote_items SET item_name = '$name', item_description = '$description', item_quantity = $qty, item_price = $price, item_subtotal = $subtotal, item_tax = $tax_amount, item_total = $total, item_tax_id = $tax_id, item_order = $item_order, item_quote_id = $quote_id");
 
     // Get Quote Details
-    $sql = mysqli_query($mysqli,"SELECT * FROM quotes WHERE quote_id = $quote_id");
+    $sql = mysqli_query($mysqli,"SELECT quote_client_id, quote_discount_amount, quote_number, quote_prefix FROM quotes WHERE quote_id = $quote_id");
     $row = mysqli_fetch_assoc($sql);
     $quote_prefix = escapeSql($row['quote_prefix']);
     $quote_number = escapeSql($row['quote_number']);
@@ -260,7 +264,7 @@ if (isset($_POST['add_quote_item'])) {
     $client_id = intval($row['quote_client_id']);
 
     //add up the total of all items
-    $sql = mysqli_query($mysqli,"SELECT * FROM quote_items WHERE item_quote_id = $quote_id");
+    $sql = mysqli_query($mysqli,"SELECT item_total FROM quote_items WHERE item_quote_id = $quote_id");
     $quote_amount = 0;
     while($row = mysqli_fetch_assoc($sql)) {
         $item_total = floatval($row['item_total']);
@@ -295,7 +299,7 @@ if (isset($_POST['edit_quote_item'])) {
     $subtotal = $price * $qty;
 
     if ($tax_id > 0) {
-        $sql = mysqli_query($mysqli,"SELECT * FROM taxes WHERE tax_id = $tax_id");
+        $sql = mysqli_query($mysqli,"SELECT tax_percent FROM taxes WHERE tax_id = $tax_id");
         $row = mysqli_fetch_assoc($sql);
         $tax_percent = floatval($row['tax_percent']);
         $tax_amount = $subtotal * $tax_percent / 100;
@@ -311,7 +315,7 @@ if (isset($_POST['edit_quote_item'])) {
     $quote_id = intval($row['item_quote_id']);
 
     //Get Discount Amount
-    $sql = mysqli_query($mysqli,"SELECT * FROM quotes WHERE quote_id = $quote_id");
+    $sql = mysqli_query($mysqli,"SELECT quote_client_id, quote_discount_amount, quote_number, quote_prefix FROM quotes WHERE quote_id = $quote_id");
     $row = mysqli_fetch_assoc($sql);
     $quote_prefix = escapeSql($row['quote_prefix']);
     $quote_number = intval($row['quote_number']);
@@ -347,7 +351,7 @@ if (isset($_POST['quote_note'])) {
     $note = escapeSql($_POST['note']);
 
     // Get Quote Details
-    $sql = mysqli_query($mysqli,"SELECT * FROM quotes WHERE quote_id = $quote_id");
+    $sql = mysqli_query($mysqli,"SELECT quote_client_id, quote_number, quote_prefix FROM quotes WHERE quote_id = $quote_id");
     $row = mysqli_fetch_assoc($sql);
     $quote_prefix = escapeSql($row['quote_prefix']);
     $quote_number = escapeSql($row['quote_number']);
@@ -376,7 +380,7 @@ if (isset($_POST['edit_quote'])) {
     $quote_id = intval($_POST['quote_id']);
 
     // Get Quote Details for logging
-    $sql = mysqli_query($mysqli,"SELECT * FROM quotes WHERE quote_id = $quote_id");
+    $sql = mysqli_query($mysqli,"SELECT quote_client_id, quote_number, quote_prefix FROM quotes WHERE quote_id = $quote_id");
     $row = mysqli_fetch_assoc($sql);
     $quote_prefix = escapeSql($row['quote_prefix']);
     $quote_number = escapeSql($row['quote_number']);
@@ -385,7 +389,7 @@ if (isset($_POST['edit_quote'])) {
     enforceClientAccess();
 
     //Calculate the new quote amount
-    $sql = mysqli_query($mysqli,"SELECT * FROM quote_items WHERE item_quote_id = $quote_id");
+    $sql = mysqli_query($mysqli,"SELECT item_total FROM quote_items WHERE item_quote_id = $quote_id");
     $quote_amount = 0;
     while($row = mysqli_fetch_assoc($sql)) {
         $item_total = floatval($row['item_total']);
@@ -412,7 +416,7 @@ if (isset($_GET['delete_quote'])) {
     $quote_id = intval($_GET['delete_quote']);
 
     // Get Quote Details for logging
-    $sql = mysqli_query($mysqli,"SELECT * FROM quotes WHERE quote_id = $quote_id");
+    $sql = mysqli_query($mysqli,"SELECT quote_client_id, quote_number, quote_prefix FROM quotes WHERE quote_id = $quote_id");
     $row = mysqli_fetch_assoc($sql);
     $quote_prefix = escapeSql($row['quote_prefix']);
     $quote_number = escapeSql($row['quote_number']);
@@ -423,14 +427,14 @@ if (isset($_GET['delete_quote'])) {
     mysqli_query($mysqli,"DELETE FROM quotes WHERE quote_id = $quote_id");
 
     //Delete Items Associated with the Quote
-    $sql = mysqli_query($mysqli,"SELECT * FROM quote_items WHERE item_quote_id = $quote_id");
+    $sql = mysqli_query($mysqli,"SELECT item_id FROM quote_items WHERE item_quote_id = $quote_id");
     while($row = mysqli_fetch_assoc($sql)) {;
         $item_id = intval($row['item_id']);
         mysqli_query($mysqli,"DELETE FROM quote_items WHERE item_id = $item_id");
     }
 
     //Delete History Associated with the Quote
-    $sql = mysqli_query($mysqli,"SELECT * FROM history WHERE history_quote_id = $quote_id");
+    $sql = mysqli_query($mysqli,"SELECT history_id FROM history WHERE history_quote_id = $quote_id");
     while($row = mysqli_fetch_assoc($sql)) {;
         $history_id = intval($row['history_id']);
         mysqli_query($mysqli,"DELETE FROM history WHERE history_id = $history_id");
@@ -457,7 +461,7 @@ if (isset($_GET['delete_quote_item'])) {
 
     $item_id = intval($_GET['delete_quote_item']);
 
-    $sql = mysqli_query($mysqli,"SELECT * FROM quote_items WHERE item_id = $item_id");
+    $sql = mysqli_query($mysqli,"SELECT item_name, item_quote_id, item_subtotal, item_tax, item_total FROM quote_items WHERE item_id = $item_id");
     $row = mysqli_fetch_assoc($sql);
     $item_name = escapeSql($row['item_name']);
     $quote_id = intval($row['item_quote_id']);
@@ -465,7 +469,7 @@ if (isset($_GET['delete_quote_item'])) {
     $item_tax = floatval($row['item_tax']);
     $item_total = floatval($row['item_total']);
 
-    $sql = mysqli_query($mysqli,"SELECT * FROM quotes WHERE quote_id = $quote_id");
+    $sql = mysqli_query($mysqli,"SELECT quote_amount, quote_client_id, quote_number, quote_prefix FROM quotes WHERE quote_id = $quote_id");
     $row = mysqli_fetch_assoc($sql);
     $quote_prefix = escapeSql($row['quote_prefix']);
     $quote_number = escapeSql($row['quote_number']);
@@ -495,7 +499,7 @@ if (isset($_GET['mark_quote_sent'])) {
 
     $quote_id = intval($_GET['mark_quote_sent']);
 
-    $sql = mysqli_query($mysqli,"SELECT * FROM quotes WHERE quote_id = $quote_id");
+    $sql = mysqli_query($mysqli,"SELECT quote_client_id, quote_number, quote_prefix FROM quotes WHERE quote_id = $quote_id");
     $row = mysqli_fetch_assoc($sql);
     $quote_prefix = escapeSql($row['quote_prefix']);
     $quote_number = escapeSql($row['quote_number']);
@@ -523,7 +527,7 @@ if (isset($_GET['accept_quote'])) {
 
     $quote_id = intval($_GET['accept_quote']);
 
-    $sql = mysqli_query($mysqli,"SELECT * FROM quotes WHERE quote_id = $quote_id");
+    $sql = mysqli_query($mysqli,"SELECT quote_client_id, quote_number, quote_prefix FROM quotes WHERE quote_id = $quote_id");
     $row = mysqli_fetch_assoc($sql);
     $quote_prefix = escapeSql($row['quote_prefix']);
     $quote_number = escapeSql($row['quote_number']);
@@ -553,7 +557,7 @@ if (isset($_GET['decline_quote'])) {
 
     $quote_id = intval($_GET['decline_quote']);
 
-    $sql = mysqli_query($mysqli,"SELECT * FROM quotes WHERE quote_id = $quote_id");
+    $sql = mysqli_query($mysqli,"SELECT quote_client_id, quote_number, quote_prefix FROM quotes WHERE quote_id = $quote_id");
     $row = mysqli_fetch_assoc($sql);
     $quote_prefix = escapeSql($row['quote_prefix']);
     $quote_number = escapeSql($row['quote_number']);
@@ -583,7 +587,9 @@ if (isset($_GET['email_quote'])) {
 
     $quote_id = intval($_GET['email_quote']);
 
-    $sql = mysqli_query($mysqli,"SELECT * FROM quotes
+    $sql = mysqli_query($mysqli,"SELECT client_id, client_name, contact_email, contact_name, quote_amount, quote_currency_code,
+        quote_date, quote_expire, quote_number, quote_prefix, quote_scope, quote_status,
+        quote_url_key FROM quotes
     LEFT JOIN clients ON quote_client_id = client_id
     LEFT JOIN contacts ON clients.client_id = contacts.contact_client_id AND contact_primary = 1
     WHERE quote_id = $quote_id"
@@ -606,7 +612,8 @@ if (isset($_GET['email_quote'])) {
 
     enforceClientAccess();
 
-    $sql = mysqli_query($mysqli,"SELECT * FROM companies WHERE company_id = 1");
+    $sql = mysqli_query($mysqli,"SELECT company_address, company_city, company_country, company_email, company_logo, company_name,
+        company_phone, company_phone_country_code, company_state, company_website, company_zip FROM companies WHERE company_id = 1");
     $row = mysqli_fetch_assoc($sql);
 
     $company_name = escapeSql($row['company_name']);
@@ -665,7 +672,7 @@ if (isset($_GET['mark_quote_invoiced'])) {
 
     $quote_id = intval($_GET['mark_quote_invoiced']);
 
-    $sql = mysqli_query($mysqli,"SELECT * FROM quotes WHERE quote_id = $quote_id");
+    $sql = mysqli_query($mysqli,"SELECT quote_client_id, quote_number, quote_prefix FROM quotes WHERE quote_id = $quote_id");
     $row = mysqli_fetch_assoc($sql);
     $quote_prefix = escapeSql($row['quote_prefix']);
     $quote_number = escapeSql($row['quote_number']);
@@ -685,7 +692,7 @@ if (isset($_GET['mark_quote_invoiced'])) {
 
 }
 
-if (isset($_POST['export_quotes'])) {
+if (isExportRequest('export_quotes')) {
 
     validateCSRFToken();
 
@@ -727,12 +734,12 @@ if (isset($_POST['export_quotes'])) {
 
     $sql = mysqli_query(
         $mysqli,
-        "SELECT * FROM quotes
+        "SELECT quote_number, quote_prefix FROM quotes
         LEFT JOIN clients ON quote_client_id = client_id
         LEFT JOIN categories ON quote_category_id = category_id
         WHERE (CONCAT(quote_prefix,quote_number) LIKE '%$q%' OR quote_scope LIKE '%$q%' OR category_name LIKE '%$q%' OR quote_status LIKE '%$q%' OR quote_amount LIKE '%$q%' OR client_name LIKE '%$q%')
         AND DATE(quote_date) BETWEEN '$dtf' AND '$dtt'
-        $access_permission_query
+        " . clientScopeSql('quote_client_id') . "
         $client_query
         ORDER BY quote_number ASC"
     );
@@ -769,12 +776,17 @@ if (isset($_GET['export_quote_pdf'])) {
 
     $sql = mysqli_query(
         $mysqli,
-        "SELECT * FROM quotes
+        "SELECT client_currency_code, client_id, client_name, client_net_terms, client_website,
+            contact_email, contact_extension, contact_mobile, contact_mobile_country_code,
+            contact_phone, contact_phone_country_code, location_address, location_city,
+            location_country, location_state, location_zip, quote_amount, quote_category_id,
+            quote_created_at, quote_currency_code, quote_date, quote_discount_amount, quote_expire,
+            quote_id, quote_note, quote_number, quote_prefix, quote_scope, quote_status, quote_url_key FROM quotes
         LEFT JOIN clients ON quote_client_id = client_id
         LEFT JOIN contacts ON clients.client_id = contacts.contact_client_id AND contact_primary = 1
         LEFT JOIN locations ON clients.client_id = locations.location_client_id AND location_primary = 1
         WHERE quote_id = $quote_id
-        $access_permission_query
+        " . clientScopeSql('quote_client_id') . "
         LIMIT 1"
     );
 
@@ -815,7 +827,9 @@ if (isset($_GET['export_quote_pdf'])) {
 
     enforceClientAccess();
 
-    $sql = mysqli_query($mysqli, "SELECT * FROM companies, settings WHERE companies.company_id = settings.company_id AND companies.company_id = 1");
+    $sql = mysqli_query($mysqli, "SELECT company_address, company_city, company_country, company_email, settings.company_id,
+        company_logo, company_name, company_phone, company_phone_country_code, company_state,
+        company_website, company_zip FROM companies, settings WHERE companies.company_id = settings.company_id AND companies.company_id = 1");
     $row = mysqli_fetch_assoc($sql);
 
     $company_id = intval($row['company_id']);
@@ -918,7 +932,7 @@ if (isset($_GET['export_quote_pdf'])) {
     $sub_total = 0;
     $total_tax = 0;
 
-    $sql_items = mysqli_query($mysqli, "SELECT * FROM quote_items WHERE item_quote_id = $quote_id ORDER BY item_order ASC");
+    $sql_items = mysqli_query($mysqli, "SELECT item_description, item_name, item_price, item_quantity, item_tax, item_total FROM quote_items WHERE item_quote_id = $quote_id ORDER BY item_order ASC");
     while ($item = mysqli_fetch_assoc($sql_items)) {
         $name = $item['item_name'];
         $desc = $item['item_description'];
diff --git a/agent/post/rack.php b/agent/post/rack.php
index afd5f871a..a98794257 100644
--- a/agent/post/rack.php
+++ b/agent/post/rack.php
@@ -211,7 +211,7 @@ if (isset($_POST['add_rack_unit'])) {
     }
 
     // Check if the unit range is already occupied
-    $check_sql = mysqli_query($mysqli, "SELECT * FROM rack_units WHERE unit_rack_id = $rack_id AND unit_start_number <= $unit_end AND unit_end_number >= $unit_start");
+    $check_sql = mysqli_query($mysqli, "SELECT 1 FROM rack_units WHERE unit_rack_id = $rack_id AND unit_start_number <= $unit_end AND unit_end_number >= $unit_start");
 
     if (mysqli_num_rows($check_sql) > 0) {
         // If there is an overlap, return an error message;
diff --git a/agent/post/recurring_invoice.php b/agent/post/recurring_invoice.php
index fda4d6b9e..62b2c9462 100644
--- a/agent/post/recurring_invoice.php
+++ b/agent/post/recurring_invoice.php
@@ -15,7 +15,8 @@ if (isset($_POST['add_invoice_recurring'])) {
     $invoice_id = intval($_POST['invoice_id']);
     $recurring_invoice_frequency = validateRecurringFrequency($_POST['frequency']);
 
-    $sql = mysqli_query($mysqli,"SELECT * FROM invoices WHERE invoice_id = $invoice_id");
+    $sql = mysqli_query($mysqli,"SELECT invoice_amount, invoice_category_id, invoice_client_id, invoice_currency_code,
+        invoice_date, invoice_note, invoice_number, invoice_prefix, invoice_scope FROM invoices WHERE invoice_id = $invoice_id");
     $row = mysqli_fetch_assoc($sql);
     $invoice_prefix = escapeSql($row['invoice_prefix']);
     $invoice_number = intval($row['invoice_number']);
@@ -46,7 +47,8 @@ if (isset($_POST['add_invoice_recurring'])) {
 
     mysqli_query($mysqli,"INSERT INTO history SET history_status = 'Draft', history_description = 'Recurring Invoice Created from INVOICE!', history_recurring_invoice_id = $recurring_invoice_id");
 
-    $sql_items = mysqli_query($mysqli,"SELECT * FROM invoice_items WHERE item_invoice_id = $invoice_id");
+    $sql_items = mysqli_query($mysqli,"SELECT item_description, item_id, item_name, item_order, item_price, item_quantity, item_subtotal,
+        item_tax, item_tax_id, item_total FROM invoice_items WHERE item_invoice_id = $invoice_id");
     while($row = mysqli_fetch_assoc($sql_items)) {
         $item_id = intval($row['item_id']);
         $item_name = escapeSql($row['item_name']);
@@ -133,7 +135,7 @@ if (isset($_POST['edit_recurring_invoice'])) {
     enforceClientAccess();
 
     //Calculate new total
-    $sql = mysqli_query($mysqli,"SELECT * FROM recurring_invoice_items WHERE item_recurring_invoice_id = $recurring_invoice_id");
+    $sql = mysqli_query($mysqli,"SELECT item_total FROM recurring_invoice_items WHERE item_recurring_invoice_id = $recurring_invoice_id");
     $recurring_invoice_amount = 0;
     while($row = mysqli_fetch_assoc($sql)) {
         $item_total = floatval($row['item_total']);
@@ -174,14 +176,14 @@ if (isset($_GET['delete_recurring_invoice'])) {
     mysqli_query($mysqli,"DELETE FROM recurring_invoices WHERE recurring_invoice_id = $recurring_invoice_id");
 
     //Delete Items Associated with the Recurring
-    $sql = mysqli_query($mysqli,"SELECT * FROM recurring_invoice_items WHERE item_recurring_invoice_id = $recurring_invoice_id");
+    $sql = mysqli_query($mysqli,"SELECT item_id FROM recurring_invoice_items WHERE item_recurring_invoice_id = $recurring_invoice_id");
     while($row = mysqli_fetch_assoc($sql)) {
         $item_id = intval($row['item_id']);
         mysqli_query($mysqli,"DELETE FROM recurring_invoice_items WHERE item_id = $item_id");
     }
 
     //Delete History Associated with the Invoice
-    $sql = mysqli_query($mysqli,"SELECT * FROM history WHERE history_recurring_invoice_id = $recurring_invoice_id");
+    $sql = mysqli_query($mysqli,"SELECT history_id FROM history WHERE history_recurring_invoice_id = $recurring_invoice_id");
     while($row = mysqli_fetch_assoc($sql)) {
         $history_id = intval($row['history_id']);
         mysqli_query($mysqli,"DELETE FROM history WHERE history_id = $history_id");
@@ -216,7 +218,7 @@ if (isset($_POST['add_recurring_invoice_item'])) {
     $subtotal = $price * $qty;
 
     if ($tax_id > 0) {
-        $sql = mysqli_query($mysqli,"SELECT * FROM taxes WHERE tax_id = $tax_id");
+        $sql = mysqli_query($mysqli,"SELECT tax_percent FROM taxes WHERE tax_id = $tax_id");
         $row = mysqli_fetch_assoc($sql);
         $tax_percent = floatval($row['tax_percent']);
         $tax_amount = $subtotal * $tax_percent / 100;
@@ -229,7 +231,8 @@ if (isset($_POST['add_recurring_invoice_item'])) {
     mysqli_query($mysqli,"INSERT INTO recurring_invoice_items SET item_name = '$name', item_description = '$description', item_quantity = $qty, item_price = $price, item_subtotal = $subtotal, item_tax = $tax_amount, item_total = $total, item_tax_id = $tax_id, item_order = $item_order, item_recurring_invoice_id = $recurring_invoice_id");
 
 
-    $sql = mysqli_query($mysqli,"SELECT * FROM recurring_invoices WHERE recurring_invoice_id = $recurring_invoice_id");
+    $sql = mysqli_query($mysqli,"SELECT recurring_invoice_client_id, recurring_invoice_discount_amount, recurring_invoice_number,
+        recurring_invoice_prefix FROM recurring_invoices WHERE recurring_invoice_id = $recurring_invoice_id");
     $row = mysqli_fetch_assoc($sql);
     $recurring_invoice_discount = floatval($row['recurring_invoice_discount_amount']);
     $recurring_invoice_prefix = escapeSql($row['recurring_invoice_prefix']);
@@ -237,7 +240,7 @@ if (isset($_POST['add_recurring_invoice_item'])) {
     $client_id = intval($row['recurring_invoice_client_id']);
 
     //add up all the items
-    $sql = mysqli_query($mysqli,"SELECT * FROM recurring_invoice_items WHERE item_recurring_invoice_id = $recurring_invoice_id");
+    $sql = mysqli_query($mysqli,"SELECT item_total FROM recurring_invoice_items WHERE item_recurring_invoice_id = $recurring_invoice_id");
     $recurring_invoice_amount = 0;
     while($row = mysqli_fetch_assoc($sql)) {
         $item_total = floatval($row['item_total']);
@@ -272,7 +275,7 @@ if (isset($_POST['edit_recurring_invoice_item'])) {
     $subtotal = $price * $qty;
 
     if ($tax_id > 0) {
-        $sql = mysqli_query($mysqli,"SELECT * FROM taxes WHERE tax_id = $tax_id");
+        $sql = mysqli_query($mysqli,"SELECT tax_percent FROM taxes WHERE tax_id = $tax_id");
         $row = mysqli_fetch_assoc($sql);
         $tax_percent = floatval($row['tax_percent']);
         $tax_amount = $subtotal * $tax_percent / 100;
@@ -288,7 +291,8 @@ if (isset($_POST['edit_recurring_invoice_item'])) {
     $recurring_invoice_id = intval($row['item_recurring_invoice_id']);
 
     //Get Discount Amount
-    $sql = mysqli_query($mysqli,"SELECT * FROM recurring_invoices WHERE recurring_invoice_id = $recurring_invoice_id");
+    $sql = mysqli_query($mysqli,"SELECT recurring_invoice_client_id, recurring_invoice_discount_amount, recurring_invoice_number,
+        recurring_invoice_prefix FROM recurring_invoices WHERE recurring_invoice_id = $recurring_invoice_id");
     $row = mysqli_fetch_assoc($sql);
     $recurring_invoice_prefix = escapeSql($row['recurring_invoice_prefix']);
     $recurring_invoice_number = intval($row['recurring_invoice_number']);
@@ -351,7 +355,7 @@ if (isset($_GET['delete_recurring_invoice_item'])) {
 
     $item_id = intval($_GET['delete_recurring_invoice_item']);
 
-    $sql = mysqli_query($mysqli,"SELECT * FROM recurring_invoice_items WHERE item_id = $item_id");
+    $sql = mysqli_query($mysqli,"SELECT item_name, item_recurring_invoice_id, item_subtotal, item_tax, item_total FROM recurring_invoice_items WHERE item_id = $item_id");
     $row = mysqli_fetch_assoc($sql);
     $recurring_invoice_id = intval($row['item_recurring_invoice_id']);
     $item_name = escapeSql($row['item_name']);
@@ -359,7 +363,8 @@ if (isset($_GET['delete_recurring_invoice_item'])) {
     $item_tax = floatval($row['item_tax']);
     $item_total = floatval($row['item_total']);
 
-    $sql = mysqli_query($mysqli,"SELECT * FROM recurring_invoices WHERE recurring_invoice_id = $recurring_invoice_id");
+    $sql = mysqli_query($mysqli,"SELECT recurring_invoice_amount, recurring_invoice_client_id, recurring_invoice_number,
+        recurring_invoice_prefix FROM recurring_invoices WHERE recurring_invoice_id = $recurring_invoice_id");
     $row = mysqli_fetch_assoc($sql);
     $recurring_invoice_prefix = escapeSql($row['recurring_invoice_prefix']);
     $recurring_invoice_number = intval($row['recurring_invoice_number']);
@@ -389,7 +394,11 @@ if (isset($_GET['force_recurring'])) {
 
     $recurring_invoice_id = intval($_GET['force_recurring']);
 
-    $sql_recurring_invoices = mysqli_query($mysqli,"SELECT * FROM recurring_invoices, clients WHERE client_id = recurring_invoice_client_id AND recurring_invoice_id = $recurring_invoice_id");
+    $sql_recurring_invoices = mysqli_query($mysqli,"SELECT client_net_terms, recurring_invoice_amount, recurring_invoice_category_id,
+        recurring_invoice_client_id, recurring_invoice_currency_code,
+        recurring_invoice_discount_amount, recurring_invoice_frequency, recurring_invoice_id,
+        recurring_invoice_last_sent, recurring_invoice_next_date, recurring_invoice_note,
+        recurring_invoice_scope, recurring_invoice_status FROM recurring_invoices, clients WHERE client_id = recurring_invoice_client_id AND recurring_invoice_id = $recurring_invoice_id");
 
     $row = mysqli_fetch_assoc($sql_recurring_invoices);
     $recurring_invoice_id = intval($row['recurring_invoice_id']);
@@ -427,7 +436,8 @@ if (isset($_GET['force_recurring'])) {
     $new_invoice_id = mysqli_insert_id($mysqli);
 
     //Copy Items from original invoice to new invoice
-    $sql_invoice_items = mysqli_query($mysqli,"SELECT * FROM recurring_invoice_items WHERE item_recurring_invoice_id = $recurring_invoice_id ORDER BY item_id ASC");
+    $sql_invoice_items = mysqli_query($mysqli,"SELECT item_description, item_id, item_name, item_order, item_price, item_quantity, item_subtotal,
+        item_tax_id FROM recurring_invoice_items WHERE item_recurring_invoice_id = $recurring_invoice_id ORDER BY item_id ASC");
 
     while($row = mysqli_fetch_assoc($sql_invoice_items)) {
         $item_id = intval($row['item_id']);
@@ -441,7 +451,7 @@ if (isset($_GET['force_recurring'])) {
 
         //Recalculate Item Tax since Tax percents can change.
         if ($tax_id > 0) {
-            $sql = mysqli_query($mysqli,"SELECT * FROM taxes WHERE tax_id = $tax_id");
+            $sql = mysqli_query($mysqli,"SELECT tax_percent FROM taxes WHERE tax_id = $tax_id");
             $row = mysqli_fetch_assoc($sql);
             $tax_percent = floatval($row['tax_percent']);
             $item_tax_amount = $item_subtotal * $tax_percent / 100;
@@ -492,7 +502,7 @@ if (isset($_GET['force_recurring'])) {
         $contact_extension = intval($row['contact_extension']);
         $contact_mobile = escapeSql(formatPhoneNumber($row['contact_mobile'], $row['contact_mobile_country_code']));
 
-        $sql = mysqli_query($mysqli,"SELECT * FROM companies WHERE company_id = 1");
+        $sql = mysqli_query($mysqli,"SELECT company_email, company_name, company_phone, company_phone_country_code, company_website FROM companies WHERE company_id = 1");
         $row = mysqli_fetch_assoc($sql);
         $company_name = escapeSql($row['company_name']);
         $company_phone = escapeSql(formatPhoneNumber($row['company_phone'], $row['company_phone_country_code']));
@@ -558,7 +568,8 @@ if (isset($_POST['set_recurring_payment'])) {
     $saved_payment_id = intval($_POST['saved_payment_id']);
 
     // Get Recurring Invoice Info for logging and alerting
-    $sql = mysqli_query($mysqli, "SELECT * FROM recurring_invoices WHERE recurring_invoice_id = $recurring_invoice_id");
+    $sql = mysqli_query($mysqli, "SELECT recurring_invoice_amount, recurring_invoice_client_id, recurring_invoice_currency_code,
+        recurring_invoice_number, recurring_invoice_prefix FROM recurring_invoices WHERE recurring_invoice_id = $recurring_invoice_id");
     $row = mysqli_fetch_assoc($sql);
     $client_id = intval($row['recurring_invoice_client_id']);
     $recurring_invoice_prefix = escapeSql($row['recurring_invoice_prefix']);
@@ -572,7 +583,8 @@ if (isset($_POST['set_recurring_payment'])) {
 
         // Get Payment provider and method
         $sql = mysqli_query($mysqli, "
-            SELECT * FROM payment_providers
+            SELECT payment_provider_account, payment_provider_id, payment_provider_name,
+                saved_payment_description FROM payment_providers
             LEFT JOIN client_saved_payment_methods ON saved_payment_provider_id = payment_provider_id
             WHERE saved_payment_id = $saved_payment_id
         ");
@@ -605,7 +617,7 @@ if (isset($_POST['set_recurring_payment'])) {
 
 }
 
-if (isset($_POST['export_recurring_invoices'])) {
+if (isExportRequest('export_recurring_invoices')) {
 
     validateCSRFToken();
 
@@ -659,14 +671,14 @@ if (isset($_POST['export_recurring_invoices'])) {
 
     $sql = mysqli_query(
         $mysqli,
-        "SELECT * FROM recurring_invoices
+        "SELECT recurring_invoice_frequency, recurring_invoice_number, recurring_invoice_prefix FROM recurring_invoices
         LEFT JOIN clients ON recurring_invoice_client_id = client_id
         LEFT JOIN categories ON recurring_invoice_category_id = category_id
         WHERE (CONCAT(recurring_invoice_prefix,recurring_invoice_number) LIKE '%$q%' OR recurring_invoice_frequency LIKE '%$q%' OR recurring_invoice_scope LIKE '%$q%' OR client_name LIKE '%$q%' OR category_name LIKE '%$q%')
         AND DATE(recurring_invoice_created_at) BETWEEN '$dtf' AND '$dtt'
         $status_query
         $client_query
-        $access_permission_query
+        " . clientScopeSql('recurring_invoice_client_id') . "
         ORDER BY recurring_invoice_number ASC"
     );
 
@@ -702,7 +714,7 @@ if (isset($_GET['recurring_invoice_email_notify'])) {
     $recurring_invoice_email_notify = intval($_GET['recurring_invoice_email_notify']);
     $recurring_invoice_id = intval($_GET['recurring_invoice_id']);
 
-    $sql = mysqli_query($mysqli,"SELECT * FROM recurring_invoices WHERE recurring_invoice_id = $recurring_invoice_id");
+    $sql = mysqli_query($mysqli,"SELECT recurring_invoice_client_id, recurring_invoice_number, recurring_invoice_prefix FROM recurring_invoices WHERE recurring_invoice_id = $recurring_invoice_id");
     $row = mysqli_fetch_assoc($sql);
     $recurring_invoice_prefix = escapeSql($row['recurring_invoice_prefix']);
     $recurring_invoice_number = intval($row['recurring_invoice_number']);
diff --git a/agent/post/recurring_ticket.php b/agent/post/recurring_ticket.php
index b65081ea1..78589b190 100644
--- a/agent/post/recurring_ticket.php
+++ b/agent/post/recurring_ticket.php
@@ -100,7 +100,10 @@ if (isset($_POST['bulk_force_recurring_tickets'])) {
         foreach ($_POST['recurring_ticket_ids'] as $recurring_ticket_id) {
 
             $recurring_ticket_id = intval($recurring_ticket_id);
-            $sql = mysqli_query($mysqli, "SELECT * FROM recurring_tickets WHERE recurring_ticket_id = $recurring_ticket_id");
+            $sql = mysqli_query($mysqli, "SELECT recurring_ticket_asset_id, recurring_ticket_assigned_to, recurring_ticket_billable,
+                recurring_ticket_category, recurring_ticket_client_id, recurring_ticket_contact_id,
+                recurring_ticket_created_by, recurring_ticket_details, recurring_ticket_frequency,
+                recurring_ticket_next_run, recurring_ticket_priority, recurring_ticket_subject FROM recurring_tickets WHERE recurring_ticket_id = $recurring_ticket_id");
 
             if (mysqli_num_rows($sql) > 0) {
                 $row = mysqli_fetch_assoc($sql);
@@ -244,7 +247,10 @@ if (isset($_GET['force_recurring_ticket'])) {
 
     $recurring_ticket_id = intval($_GET['force_recurring_ticket']);
 
-    $sql = mysqli_query($mysqli, "SELECT * FROM recurring_tickets WHERE recurring_ticket_id = $recurring_ticket_id");
+    $sql = mysqli_query($mysqli, "SELECT recurring_ticket_asset_id, recurring_ticket_assigned_to, recurring_ticket_billable,
+        recurring_ticket_category, recurring_ticket_client_id, recurring_ticket_contact_id,
+        recurring_ticket_created_by, recurring_ticket_details, recurring_ticket_frequency,
+        recurring_ticket_next_run, recurring_ticket_priority, recurring_ticket_subject FROM recurring_tickets WHERE recurring_ticket_id = $recurring_ticket_id");
 
     if (mysqli_num_rows($sql) > 0) {
         $row = mysqli_fetch_assoc($sql);
@@ -389,7 +395,7 @@ if (isset($_GET['delete_recurring_ticket'])) {
     $recurring_ticket_id = intval($_GET['delete_recurring_ticket']);
 
     // Get Scheduled Ticket Subject Ticket Prefix, Number and Client ID for logging and alert message
-    $sql = mysqli_query($mysqli, "SELECT * FROM recurring_tickets WHERE recurring_ticket_id = $recurring_ticket_id");
+    $sql = mysqli_query($mysqli, "SELECT recurring_ticket_client_id, recurring_ticket_frequency, recurring_ticket_subject FROM recurring_tickets WHERE recurring_ticket_id = $recurring_ticket_id");
     $row = mysqli_fetch_assoc($sql);
     $subject = escapeSql($row['recurring_ticket_subject']);
     $frequency = escapeSql($row['recurring_ticket_frequency']);
@@ -424,7 +430,7 @@ if (isset($_POST['bulk_delete_recurring_tickets'])) {
             $recurring_ticket_id = intval($recurring_ticket_id);
 
             // Get Scheduled Ticket Subject Ticket Prefix, Number and Client ID for logging and alert message
-            $sql = mysqli_query($mysqli, "SELECT * FROM recurring_tickets WHERE recurring_ticket_id = $recurring_ticket_id");
+            $sql = mysqli_query($mysqli, "SELECT recurring_ticket_client_id, recurring_ticket_frequency, recurring_ticket_subject FROM recurring_tickets WHERE recurring_ticket_id = $recurring_ticket_id");
             $row = mysqli_fetch_assoc($sql);
             $subject = escapeSql($row['recurring_ticket_subject']);
             $frequency = escapeSql($row['recurring_ticket_frequency']);
@@ -467,7 +473,6 @@ if (isset($_POST['bulk_assign_recurring_ticket'])) {
             $sql = mysqli_query($mysqli, "SELECT * FROM recurring_tickets WHERE recurring_ticket_id = $recurring_ticket_id");
             $row = mysqli_fetch_assoc($sql);
 
-            $recurring_ticket_name = escapeSql($row['recurring_ticket_name']);
             $recurring_ticket_subject = escapeSql($row['recurring_ticket_subject']);
             $client_id = intval($row['recurring_ticket_client_id']);
 
@@ -561,7 +566,7 @@ if (isset($_POST['bulk_edit_recurring_ticket_priority'])) {
 
             $recurring_ticket_subject = escapeSql($row['recurring_ticket_subject']);
             $original_recurring_ticket_priority = escapeSql($row['recurring_ticket_priority']);
-            $client_id = intval($row['ticket_client_id']);
+            $client_id = intval($row['recurring_ticket_client_id']);
 
             enforceClientAccess();
 
diff --git a/agent/post/software.php b/agent/post/software.php
index 11b4eeb88..ec07d5892 100644
--- a/agent/post/software.php
+++ b/agent/post/software.php
@@ -19,7 +19,8 @@ if (isset($_POST['add_software_from_template'])) {
     enforceClientAccess();
 
     // GET Software Template Info
-    $sql_software_templates = mysqli_query($mysqli,"SELECT * FROM software_templates WHERE software_template_id = $software_template_id");
+    $sql_software_templates = mysqli_query($mysqli,"SELECT software_template_description, software_template_license_type, software_template_name,
+        software_template_notes, software_template_type, software_template_version FROM software_templates WHERE software_template_id = $software_template_id");
     $row = mysqli_fetch_assoc($sql_software_templates);
     $name = escapeSql($row['software_template_name']);
     $version = escapeSql($row['software_template_version']);
@@ -225,7 +226,7 @@ if (isset($_GET['delete_software'])) {
 
 }
 
-if (isset($_POST['export_software'])) {
+if (isExportRequest('export_software')) {
 
     validateCSRFToken();
 
@@ -291,12 +292,12 @@ if (isset($_POST['export_software'])) {
 
     $sql = mysqli_query(
         $mysqli,
-        "SELECT * FROM software
+        "SELECT software_id FROM software
         LEFT JOIN clients ON client_id = software_client_id
         LEFT JOIN vendors ON vendor_id = software_vendor_id
         WHERE (software_name LIKE '%$q%' OR software_type LIKE '%$q%' OR software_key LIKE '%$q%' OR client_name LIKE '%$q%')
         AND $archive_query
-        $access_permission_query
+        " . clientScopeSql('software_client_id') . "
         $client_query
         $expire_query
         ORDER BY software_name ASC"
diff --git a/agent/post/task.php b/agent/post/task.php
index 914839afa..ab7d1f45e 100644
--- a/agent/post/task.php
+++ b/agent/post/task.php
@@ -43,7 +43,7 @@ if (isset($_POST['edit_ticket_task'])) {
     $task_completion_estimate = intval($_POST['completion_estimate']);
 
     // Get Client ID
-    $sql = mysqli_query($mysqli, "SELECT * FROM tasks LEFT JOIN tickets ON ticket_id = task_ticket_id WHERE task_id = $task_id");
+    $sql = mysqli_query($mysqli, "SELECT ticket_client_id FROM tasks LEFT JOIN tickets ON ticket_id = task_ticket_id WHERE task_id = $task_id");
     $row = mysqli_fetch_assoc($sql);
     $client_id = intval($row['ticket_client_id']);
     enforceClientAccess();
@@ -88,7 +88,7 @@ if (isset($_GET['delete_task'])) {
     $task_id = intval($_GET['delete_task']);
 
     // Get Client ID, task name from tasks and tickets using the task_id
-    $sql = mysqli_query($mysqli, "SELECT * FROM tasks LEFT JOIN tickets ON ticket_id = task_ticket_id WHERE task_id = $task_id");
+    $sql = mysqli_query($mysqli, "SELECT task_name, ticket_client_id FROM tasks LEFT JOIN tickets ON ticket_id = task_ticket_id WHERE task_id = $task_id");
     $row = mysqli_fetch_assoc($sql);
     $client_id = intval($row['ticket_client_id']);
     enforceClientAccess();
@@ -113,23 +113,18 @@ if (isset($_GET['complete_task'])) {
     $task_id = intval($_GET['complete_task']);
 
     // Get Client ID
-    $sql = mysqli_query($mysqli, "SELECT * FROM tasks LEFT JOIN tickets ON ticket_id = task_ticket_id WHERE task_id = $task_id");
+    $sql = mysqli_query($mysqli, "SELECT task_name, ticket_client_id, ticket_id FROM tasks LEFT JOIN tickets ON ticket_id = task_ticket_id WHERE task_id = $task_id");
     $row = mysqli_fetch_assoc($sql);
     $client_id = intval($row['ticket_client_id']);
     enforceClientAccess();
     $task_name = escapeSql($row['task_name']);
-    $task_completion_estimate = intval($row['task_completion_estimate']);
     $ticket_id = intval($row['ticket_id']);
 
     mysqli_query($mysqli, "UPDATE tasks SET task_completed_at = NOW(), task_completed_by = $session_user_id WHERE task_id = $task_id");
 
-    // Convert task completion estimate from minutes to TIME format
-    $time_worked = gmdate("H:i:s", $task_completion_estimate * 60); // Convert minutes to HH:MM:SS
-
-    // Add reply
-    mysqli_query($mysqli, "INSERT INTO ticket_replies SET ticket_reply = 'Completed Task - $task_name', ticket_reply_time_worked = '$time_worked', ticket_reply_type = 'Internal', ticket_reply_by = $session_user_id, ticket_reply_ticket_id = $ticket_id");
-
-    $ticket_reply_id = mysqli_insert_id($mysqli);
+    // Audit trail only - task_completion_estimate is planning information, not labour.
+    // Booking it as time worked double-counted against whatever the tech actually logged.
+    mysqli_query($mysqli, "INSERT INTO ticket_replies SET ticket_reply = 'Completed Task - $task_name', ticket_reply_time_worked = '00:00:00', ticket_reply_type = 'Internal', ticket_reply_by = $session_user_id, ticket_reply_ticket_id = $ticket_id");
 
     logAudit("Task", "Edit", "$session_name completed task $task_name", $client_id, $task_id);
 
@@ -148,7 +143,7 @@ if (isset($_GET['undo_complete_task'])) {
     $task_id = intval($_GET['undo_complete_task']);
 
     // Get Client ID
-    $sql = mysqli_query($mysqli, "SELECT * FROM tasks LEFT JOIN tickets ON ticket_id = task_ticket_id WHERE task_id = $task_id");
+    $sql = mysqli_query($mysqli, "SELECT task_name, ticket_client_id, ticket_id FROM tasks LEFT JOIN tickets ON ticket_id = task_ticket_id WHERE task_id = $task_id");
     $row = mysqli_fetch_assoc($sql);
     $client_id = intval($row['ticket_client_id']);
     enforceClientAccess();
@@ -157,10 +152,8 @@ if (isset($_GET['undo_complete_task'])) {
 
     mysqli_query($mysqli, "UPDATE tasks SET task_completed_at = NULL, task_completed_by = NULL WHERE task_id = $task_id");
 
-    // Add reply
-    mysqli_query($mysqli, "INSERT INTO ticket_replies SET ticket_reply = 'Undo Completed Task - $task_name', ticket_reply_time_worked = '00:01:00', ticket_reply_type = 'Internal', ticket_reply_by = $session_user_id, ticket_reply_ticket_id = $ticket_id");
-
-    $ticket_reply_id = mysqli_insert_id($mysqli);
+    // Audit trail only - see complete_task
+    mysqli_query($mysqli, "INSERT INTO ticket_replies SET ticket_reply = 'Undo Completed Task - $task_name', ticket_reply_time_worked = '00:00:00', ticket_reply_type = 'Internal', ticket_reply_by = $session_user_id, ticket_reply_ticket_id = $ticket_id");
 
     logAudit("Task", "Edit", "$session_name marked task $task_name as incomplete", $client_id, $task_id);
 
@@ -192,7 +185,8 @@ if (isset($_POST['add_ticket_task_approver'])) {
 
     // Task/Ticket Info
     $tt_row = mysqli_fetch_assoc(mysqli_query($mysqli, "
-        SELECT * FROM tasks
+        SELECT task_name, task_ticket_id, ticket_client_id, ticket_contact_id, ticket_number,
+            ticket_prefix, ticket_status_name, ticket_subject, ticket_url_key FROM tasks
         LEFT JOIN tickets ON ticket_id = task_ticket_id
         LEFT JOIN ticket_statuses ON ticket_status = ticket_status_id
         WHERE task_id = $task_id LIMIT 1
@@ -354,7 +348,8 @@ if (isset($_GET['approve_ticket_task'])) {
     $task_id = intval($_GET['approve_ticket_task']);
     $approval_id = intval($_GET['approval_id']);
 
-    $approval_row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT * FROM task_approvals LEFT JOIN tasks on task_id = approval_task_id WHERE approval_id = $approval_id AND approval_task_id = $task_id AND approval_scope = 'internal'"));
+    $approval_row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT approval_created_by, approval_required_user_id, approval_scope, approval_type, task_name,
+        task_ticket_id FROM task_approvals LEFT JOIN tasks on task_id = approval_task_id WHERE approval_id = $approval_id AND approval_task_id = $task_id AND approval_scope = 'internal'"));
 
     $task_name = escapeHtml($approval_row['task_name']);
     $scope = escapeHtml($approval_row['approval_scope']);
@@ -429,9 +424,7 @@ if (isset($_GET['complete_all_tasks'])) {
     mysqli_query($mysqli, "UPDATE tasks SET task_completed_at = NOW(), task_completed_by = $session_user_id WHERE task_ticket_id = $ticket_id AND task_completed_at IS NULL");
 
     // Add reply
-    mysqli_query($mysqli, "INSERT INTO ticket_replies SET ticket_reply = 'Marked all tasks complete', ticket_reply_type = 'Internal', ticket_reply_by = $session_user_id, ticket_reply_ticket_id = $ticket_id");
-
-    $ticket_reply_id = mysqli_insert_id($mysqli);
+    mysqli_query($mysqli, "INSERT INTO ticket_replies SET ticket_reply = 'Marked all tasks complete', ticket_reply_time_worked = '00:00:00', ticket_reply_type = 'Internal', ticket_reply_by = $session_user_id, ticket_reply_ticket_id = $ticket_id");
 
     logAudit("Ticket", "Edit", "$session_name marked all tasks complete for ticket", $client_id, $ticket_id);
 
@@ -456,9 +449,7 @@ if (isset($_GET['undo_complete_all_tasks'])) {
     mysqli_query($mysqli, "UPDATE tasks SET task_completed_at = NULL, task_completed_by = NULL WHERE task_ticket_id = $ticket_id AND task_completed_at IS NOT NULL");
 
     // Add reply
-    mysqli_query($mysqli, "INSERT INTO ticket_replies SET ticket_reply = 'Marked all tasks incomplete', ticket_reply_type = 'Internal', ticket_reply_by = $session_user_id, ticket_reply_ticket_id = $ticket_id");
-
-    $ticket_reply_id = mysqli_insert_id($mysqli);
+    mysqli_query($mysqli, "INSERT INTO ticket_replies SET ticket_reply = 'Marked all tasks incomplete', ticket_reply_time_worked = '00:00:00', ticket_reply_type = 'Internal', ticket_reply_by = $session_user_id, ticket_reply_ticket_id = $ticket_id");
 
     logAudit("Ticket", "Edit", "$session_name marked all tasks as incomplete for ticket", $client_id, $ticket_id);
 
diff --git a/agent/post/ticket.php b/agent/post/ticket.php
index b59372ea3..85513ed6f 100644
--- a/agent/post/ticket.php
+++ b/agent/post/ticket.php
@@ -113,7 +113,6 @@ if (isset($_POST['add_ticket'])) {
 
         // Get contact/ticket details
         $sql = mysqli_query($mysqli, "SELECT contact_name, contact_email, ticket_prefix, ticket_number, ticket_category, ticket_subject, ticket_details, ticket_priority, ticket_status, ticket_created_by, ticket_assigned_to, ticket_client_id FROM tickets
-              LEFT JOIN clients ON ticket_client_id = client_id
               LEFT JOIN contacts ON ticket_contact_id = contact_id
               WHERE ticket_id = $ticket_id");
         $row = mysqli_fetch_assoc($sql);
@@ -285,7 +284,6 @@ if (isset($_POST['edit_ticket'])) {
 
     // Get contact/ticket details after update for logging / email purposes
     $sql = mysqli_query($mysqli, "SELECT contact_name, contact_email, ticket_prefix, ticket_number, ticket_category, ticket_details, ticket_status_name, ticket_created_by, ticket_assigned_to, ticket_url_key, ticket_client_id FROM tickets
-        LEFT JOIN clients ON ticket_client_id = client_id
         LEFT JOIN contacts ON ticket_contact_id = contact_id
         LEFT JOIN ticket_statuses ON ticket_status = ticket_status_id
         WHERE ticket_id = $ticket_id
@@ -582,7 +580,6 @@ if (isset($_POST['add_ticket_watcher'])) {
 
     // Get contact/ticket details
     $sql = mysqli_query($mysqli, "SELECT ticket_prefix, ticket_number, ticket_category, ticket_subject, ticket_details, ticket_priority, ticket_status_name, ticket_url_key, ticket_created_by, ticket_assigned_to, ticket_client_id FROM tickets
-    LEFT JOIN clients ON ticket_client_id = client_id
     LEFT JOIN contacts ON ticket_contact_id = contact_id
     LEFT JOIN ticket_statuses ON ticket_status = ticket_status_id
     WHERE ticket_id = $ticket_id
@@ -895,7 +892,7 @@ if (isset($_POST['assign_ticket'])) {
     mysqli_query($mysqli, "UPDATE tickets SET ticket_assigned_to = $assigned_to, ticket_status = '$ticket_status' WHERE ticket_id = $ticket_id");
     syncTicketSlaClock($ticket_id);
 
-    mysqli_query($mysqli, "INSERT INTO ticket_replies SET ticket_reply = '$ticket_reply', ticket_reply_type = 'Internal', ticket_reply_time_worked = '00:01:00', ticket_reply_by = $session_user_id, ticket_reply_ticket_id = $ticket_id");
+    mysqli_query($mysqli, "INSERT INTO ticket_replies SET ticket_reply = '$ticket_reply', ticket_reply_type = 'Internal', ticket_reply_time_worked = '00:00:00', ticket_reply_by = $session_user_id, ticket_reply_ticket_id = $ticket_id");
 
     logTicketHistory($ticket_id, "$session_name assigned the ticket to $agent_name");
 
@@ -1069,7 +1066,6 @@ if (isset($_POST['bulk_assign_ticket'])) {
             $ticket_prefix = escapeSql($row['ticket_prefix']);
             $ticket_number = intval($row['ticket_number']);
             $ticket_status = intval($row['ticket_status']);
-            $ticket_name = escapeSql($row['ticket_name']);
             $ticket_subject = escapeSql($row['ticket_subject']);
             $client_id = intval($row['ticket_client_id']);
 
@@ -1105,7 +1101,7 @@ if (isset($_POST['bulk_assign_ticket'])) {
             mysqli_query($mysqli, "UPDATE tickets SET ticket_assigned_to = $assign_to, ticket_status = $ticket_status WHERE ticket_id = $ticket_id");
             syncTicketSlaClock($ticket_id);
 
-            mysqli_query($mysqli, "INSERT INTO ticket_replies SET ticket_reply = '$ticket_reply', ticket_reply_type = 'Internal', ticket_reply_time_worked = '00:01:00', ticket_reply_by = $session_user_id, ticket_reply_ticket_id = $ticket_id");
+            mysqli_query($mysqli, "INSERT INTO ticket_replies SET ticket_reply = '$ticket_reply', ticket_reply_type = 'Internal', ticket_reply_time_worked = '00:00:00', ticket_reply_by = $session_user_id, ticket_reply_ticket_id = $ticket_id");
 
             logTicketHistory($ticket_id, "$session_name assigned the ticket to $agent_name");
 
@@ -1174,7 +1170,7 @@ if (isset($_POST['bulk_edit_ticket_priority'])) {
         foreach ($_POST['ticket_ids'] as $ticket_id) {
             $ticket_id = intval($ticket_id);
 
-            $sql = mysqli_query($mysqli, "SELECT * FROM tickets WHERE ticket_id = $ticket_id");
+            $sql = mysqli_query($mysqli, "SELECT ticket_client_id, ticket_number, ticket_prefix, ticket_priority, ticket_subject FROM tickets WHERE ticket_id = $ticket_id");
             $row = mysqli_fetch_assoc($sql);
 
             $ticket_prefix = escapeSql($row['ticket_prefix']);
@@ -1192,7 +1188,7 @@ if (isset($_POST['bulk_edit_ticket_priority'])) {
             mysqli_query($mysqli, "UPDATE tickets SET ticket_priority = '$priority' WHERE ticket_id = $ticket_id");
             applyTicketSla($ticket_id);
 
-            mysqli_query($mysqli, "INSERT INTO ticket_replies SET ticket_reply = '$session_name updated the priority from $current_ticket_priority to $priority', ticket_reply_type = 'Internal', ticket_reply_time_worked = '00:01:00', ticket_reply_by = $session_user_id, ticket_reply_ticket_id = $ticket_id");
+            mysqli_query($mysqli, "INSERT INTO ticket_replies SET ticket_reply = '$session_name updated the priority from $current_ticket_priority to $priority', ticket_reply_type = 'Internal', ticket_reply_time_worked = '00:00:00', ticket_reply_by = $session_user_id, ticket_reply_ticket_id = $ticket_id");
 
             logAudit("Ticket", "Edit", "$session_name updated the priority on ticket $ticket_prefix$ticket_number - $ticket_subject from $original_ticket_priority to $priority", $client_id, $ticket_id);
 
@@ -1290,7 +1286,8 @@ if (isset($_POST['bulk_merge_tickets'])) {
 
             if ($ticket_id !== $merge_into_ticket_id) {
 
-                $sql = mysqli_query($mysqli, "SELECT * FROM tickets WHERE ticket_id = $ticket_id");
+                $sql = mysqli_query($mysqli, "SELECT ticket_client_id, ticket_details, ticket_first_response_at, ticket_number, ticket_prefix,
+                    ticket_priority, ticket_subject FROM tickets WHERE ticket_id = $ticket_id");
                 $row = mysqli_fetch_assoc($sql);
 
                 $ticket_prefix = escapeSql($row['ticket_prefix']);
@@ -1310,13 +1307,13 @@ if (isset($_POST['bulk_merge_tickets'])) {
                 if (empty($ticket_first_response_at)) {
                     setTicketFirstResponse($ticket_id);
                 }
-                mysqli_query($mysqli, "INSERT INTO ticket_replies SET ticket_reply = 'Ticket $ticket_prefix$ticket_number bulk merged into <a href=\"ticket.php?ticket_id=$merge_into_ticket_id\">$ticket_prefix$merge_into_ticket_number</a>. Comment: $merge_comment', ticket_reply_time_worked = '00:01:00', ticket_reply_type = '$ticket_reply_type', ticket_reply_by = $session_user_id, ticket_reply_ticket_id = $ticket_id");
+                mysqli_query($mysqli, "INSERT INTO ticket_replies SET ticket_reply = 'Ticket $ticket_prefix$ticket_number bulk merged into <a href=\"ticket.php?ticket_id=$merge_into_ticket_id\">$ticket_prefix$merge_into_ticket_number</a>. Comment: $merge_comment', ticket_reply_time_worked = '00:00:00', ticket_reply_type = '$ticket_reply_type', ticket_reply_by = $session_user_id, ticket_reply_ticket_id = $ticket_id");
                 mysqli_query($mysqli, "UPDATE tickets SET ticket_status = '5', ticket_resolved_at = NOW(), ticket_closed_at = NOW(), ticket_closed_by = $session_user_id WHERE ticket_id = $ticket_id") or die(mysqli_error($mysqli));
                 syncTicketSlaClock($ticket_id);
                 setTicketResolutionSlaMet($ticket_id);
 
                 // Update new parent ticket
-                mysqli_query($mysqli, "INSERT INTO ticket_replies SET ticket_reply = 'Ticket $ticket_prefix$ticket_number was bulk merged into this ticket with comment: $merge_comment.<br><br><b>$ticket_subject</b><br>$ticket_details', ticket_reply_time_worked = '00:01:00', ticket_reply_type = 'Internal', ticket_reply_by = $session_user_id, ticket_reply_ticket_id = $merge_into_ticket_id");
+                mysqli_query($mysqli, "INSERT INTO ticket_replies SET ticket_reply = 'Ticket $ticket_prefix$ticket_number was bulk merged into this ticket with comment: $merge_comment.<br><br><b>$ticket_subject</b><br>$ticket_details', ticket_reply_time_worked = '00:00:00', ticket_reply_type = 'Internal', ticket_reply_by = $session_user_id, ticket_reply_ticket_id = $merge_into_ticket_id");
 
                 logTicketHistory($ticket_id, "$session_name merged this ticket into $ticket_prefix$merge_into_ticket_number and closed it");
 
@@ -1372,7 +1369,8 @@ if (isset($_POST['bulk_resolve_tickets'])) {
                 // Count the Ticket Loop
                 $ticket_count++;
 
-                $sql = mysqli_query($mysqli, "SELECT * FROM tickets WHERE ticket_id = $ticket_id");
+                $sql = mysqli_query($mysqli, "SELECT ticket_client_id, ticket_first_response_at, ticket_number, ticket_prefix, ticket_priority,
+                    ticket_subject, ticket_url_key FROM tickets WHERE ticket_id = $ticket_id");
                 $row = mysqli_fetch_assoc($sql);
 
                 $ticket_prefix = escapeSql($row['ticket_prefix']);
@@ -1512,7 +1510,8 @@ if (isset($_POST['bulk_ticket_reply'])) {
         foreach ($_POST['ticket_ids'] as $ticket_id) {
             $ticket_id = intval($ticket_id);
 
-            $sql = mysqli_query($mysqli, "SELECT * FROM tickets WHERE ticket_id = $ticket_id");
+            $sql = mysqli_query($mysqli, "SELECT ticket_client_id, ticket_status, ticket_first_response_at, ticket_number, ticket_prefix, ticket_priority,
+                ticket_subject, ticket_url_key FROM tickets WHERE ticket_id = $ticket_id");
             $row = mysqli_fetch_assoc($sql);
 
             $ticket_prefix = escapeSql($row['ticket_prefix']);
@@ -1522,6 +1521,7 @@ if (isset($_POST['bulk_ticket_reply'])) {
             $url_key = escapeSql($row['ticket_url_key']);
             $ticket_first_response_at = escapeSql($row['ticket_first_response_at']);
             $client_id = intval($row['ticket_client_id']);
+            $original_ticket_status = intval($row['ticket_status']);
 
             // Don't Enforce Client Access if Ticket doesn't have an assigned client
             if ($client_id) {
@@ -1548,8 +1548,12 @@ if (isset($_POST['bulk_ticket_reply'])) {
             mysqli_query($mysqli, "UPDATE tickets SET ticket_status = '$ticket_status' WHERE ticket_id = $ticket_id");
             syncTicketSlaClock($ticket_id);
 
-            $new_status_name = escapeSql(getTicketStatusName($ticket_status));
-            logTicketHistory($ticket_id, "$session_name set the status to $new_status_name");
+            // Only record a status change when the status actually changed - Resolved
+            // is left out because the resolve block below logs it
+            if ($ticket_status !== $original_ticket_status && $ticket_status != 4) {
+                $new_status_name = escapeSql(getTicketStatusName($ticket_status));
+                logTicketHistory($ticket_id, "$session_name set the status to $new_status_name");
+            }
 
             logAudit("Ticket", "Reply", "$session_name replied to ticket $ticket_prefix$ticket_number - $ticket_subject and was a $ticket_reply_type reply", $client_id, $ticket_id);
 
@@ -1560,8 +1564,9 @@ if (isset($_POST['bulk_ticket_reply'])) {
                 triggerCustomAction('reply_reply_agent_public', $ticket_id);
             }
 
-            // Resolve the ticket, if set
-            if ($ticket_status == 4) {
+            // Resolve the ticket, if it is actually moving into Resolved - a bulk reply
+            // on an already-resolved ticket must not restamp resolved_at
+            if ($ticket_status == 4 && $original_ticket_status != 4) {
                 mysqli_query($mysqli, "UPDATE tickets SET ticket_resolved_at = NOW() WHERE ticket_id = $ticket_id");
                 setTicketResolutionSlaMet($ticket_id);
 
@@ -1687,7 +1692,7 @@ if (isset($_POST['bulk_add_ticket_project'])) {
         foreach ($_POST['ticket_ids'] as $ticket_id) {
             $ticket_id = intval($ticket_id);
 
-            $sql = mysqli_query($mysqli, "SELECT * FROM tickets WHERE ticket_id = $ticket_id");
+            $sql = mysqli_query($mysqli, "SELECT ticket_client_id, ticket_number, ticket_prefix, ticket_priority, ticket_subject FROM tickets WHERE ticket_id = $ticket_id");
             $row = mysqli_fetch_assoc($sql);
 
             $ticket_prefix = escapeSql($row['ticket_prefix']);
@@ -1740,7 +1745,7 @@ if (isset($_POST['bulk_add_asset_ticket'])) {
 
     // Check to see if adding a ticket by template
     if($ticket_template_id) {
-        $sql = mysqli_query($mysqli, "SELECT * FROM ticket_templates WHERE ticket_template_id = $ticket_template_id");
+        $sql = mysqli_query($mysqli, "SELECT ticket_template_details, ticket_template_subject FROM ticket_templates WHERE ticket_template_id = $ticket_template_id");
         $row = mysqli_fetch_assoc($sql);
 
         // Override Template Subject
@@ -1759,7 +1764,7 @@ if (isset($_POST['bulk_add_asset_ticket'])) {
         foreach ($_POST['asset_ids'] as $asset_id) {
             $asset_id = intval($asset_id);
 
-            $sql = mysqli_query($mysqli, "SELECT * FROM assets WHERE asset_id = $asset_id");
+            $sql = mysqli_query($mysqli, "SELECT asset_client_id, asset_name FROM assets WHERE asset_id = $asset_id");
             $row = mysqli_fetch_assoc($sql);
 
             $asset_name = escapeSql($row['asset_name']);
@@ -1835,7 +1840,10 @@ if (isset($_POST['add_ticket_reply'])) {
     $ticket_reply = $_POST['ticket_reply']; // Reply is SQL escaped below
     $ticket_status = intval($_POST['status']);
     
-    $client_id = intval(getFieldById('tickets', $ticket_id, 'ticket_client_id'));
+    // Read the ticket as it stands before the reply changes anything
+    $original_row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT ticket_client_id, ticket_status FROM tickets WHERE ticket_id = $ticket_id"));
+    $client_id = intval($original_row['ticket_client_id'] ?? 0);
+    $original_ticket_status = intval($original_row['ticket_status'] ?? 0);
 
     // Don't Enforce Client Access if Ticket doesn't have an assigned client
     if ($client_id) {
@@ -1870,8 +1878,9 @@ if (isset($_POST['add_ticket_reply'])) {
     mysqli_query($mysqli, "UPDATE tickets SET ticket_status = $ticket_status, ticket_updated_at = NOW() WHERE ticket_id = $ticket_id");
     syncTicketSlaClock($ticket_id);
 
-    // Resolve the ticket, if set
-    if ($ticket_status == 4) {
+    // Resolve the ticket, if it is actually moving into Resolved - replying on an
+    // already-resolved ticket must not restamp resolved_at or re-log the resolve
+    if ($ticket_status == 4 && $original_ticket_status != 4) {
         mysqli_query($mysqli, "UPDATE tickets SET ticket_resolved_at = NOW() WHERE ticket_id = $ticket_id");
         setTicketResolutionSlaMet($ticket_id);
 
@@ -1896,7 +1905,6 @@ if (isset($_POST['add_ticket_reply'])) {
         // Get Ticket Details
         $ticket_sql = mysqli_query($mysqli, "SELECT contact_name, contact_email, ticket_prefix, ticket_number, ticket_subject, ticket_status, ticket_status_name, ticket_url_key, ticket_first_response_at, ticket_created_by, ticket_assigned_to, ticket_client_id
         FROM tickets
-        LEFT JOIN clients ON ticket_client_id = client_id
         LEFT JOIN contacts ON ticket_contact_id = contact_id
         LEFT JOIN ticket_statuses ON ticket_status = ticket_status_id
         WHERE ticket_id = $ticket_id
@@ -2032,8 +2040,15 @@ if (isset($_POST['add_ticket_reply'])) {
         flashAlert("Stored on the ticket but too large to email: <strong>" . implode(', ', $skipped_names) . "</strong>", 'error');
     }
 
-    $new_status_name = escapeSql(getTicketStatusName($ticket_status));
-    logTicketHistory($ticket_id, "$session_name set the status to $new_status_name");
+    /*
+     * The reply form preselects the ticket's current status, so most replies post
+     * it straight back - only record a status change when it actually changed.
+     * Resolved is left out because the resolve block above already logged it
+     */
+    if ($ticket_status !== $original_ticket_status && $ticket_status != 4) {
+        $new_status_name = escapeSql(getTicketStatusName($ticket_status));
+        logTicketHistory($ticket_id, "$session_name set the status to $new_status_name");
+    }
 
     logAudit("Ticket", "Reply", "$session_name replied to ticket $ticket_prefix$ticket_number - $ticket_subject and was a $ticket_reply_type reply", $client_id, $ticket_id);
 
@@ -2242,14 +2257,14 @@ if (isset($_POST['merge_ticket'])) {
         setTicketFirstResponse($ticket_id);
     }
 
-    mysqli_query($mysqli, "INSERT INTO ticket_replies SET ticket_reply = 'Ticket $ticket_prefix$ticket_number merged into <a href=\"ticket.php?ticket_id=$merge_into_ticket_id\">$ticket_prefix$merge_into_ticket_number</a>. Comment: $merge_comment', ticket_reply_time_worked = '00:01:00', ticket_reply_type = '$ticket_reply_type', ticket_reply_by = $session_user_id, ticket_reply_ticket_id = $ticket_id");
+    mysqli_query($mysqli, "INSERT INTO ticket_replies SET ticket_reply = 'Ticket $ticket_prefix$ticket_number merged into <a href=\"ticket.php?ticket_id=$merge_into_ticket_id\">$ticket_prefix$merge_into_ticket_number</a>. Comment: $merge_comment', ticket_reply_time_worked = '00:00:00', ticket_reply_type = '$ticket_reply_type', ticket_reply_by = $session_user_id, ticket_reply_ticket_id = $ticket_id");
 
     mysqli_query($mysqli, "UPDATE tickets SET ticket_status = '5', ticket_resolved_at = NOW(), ticket_closed_at = NOW(), ticket_closed_by = $session_user_id WHERE ticket_id = $ticket_id") or die(mysqli_error($mysqli));
     syncTicketSlaClock($ticket_id);
     setTicketResolutionSlaMet($ticket_id);
 
     //Update new parent ticket
-    mysqli_query($mysqli, "INSERT INTO ticket_replies SET ticket_reply = 'Ticket $ticket_prefix$ticket_number was merged into this ticket with comment: $merge_comment.<br><br><b>$ticket_subject</b><br>$ticket_details', ticket_reply_time_worked = '00:01:00', ticket_reply_type = '$ticket_reply_type', ticket_reply_by = $session_user_id, ticket_reply_ticket_id = $merge_into_ticket_id");
+    mysqli_query($mysqli, "INSERT INTO ticket_replies SET ticket_reply = 'Ticket $ticket_prefix$ticket_number was merged into this ticket with comment: $merge_comment.<br><br><b>$ticket_subject</b><br>$ticket_details', ticket_reply_time_worked = '00:00:00', ticket_reply_type = '$ticket_reply_type', ticket_reply_by = $session_user_id, ticket_reply_ticket_id = $merge_into_ticket_id");
 
     mysqli_query($mysqli, "UPDATE tickets SET ticket_updated_at = NOW() WHERE ticket_id = $merge_into_ticket_id");
 
@@ -2305,7 +2320,7 @@ if (isset($_GET['resolve_ticket'])) {
 
     $ticket_id = intval($_GET['resolve_ticket']);
 
-    $sql = mysqli_query($mysqli, "SELECT * FROM tickets WHERE ticket_id = $ticket_id");
+    $sql = mysqli_query($mysqli, "SELECT ticket_client_id, ticket_first_response_at, ticket_number, ticket_prefix FROM tickets WHERE ticket_id = $ticket_id");
     $row = mysqli_fetch_assoc($sql);
     $ticket_prefix = escapeSql($row['ticket_prefix']);
     $ticket_number = intval($row['ticket_number']);
@@ -2338,7 +2353,6 @@ if (isset($_GET['resolve_ticket'])) {
 
         // Get details
         $ticket_sql = mysqli_query($mysqli, "SELECT contact_name, contact_email, ticket_prefix, ticket_number, ticket_subject, ticket_status_name, ticket_assigned_to, ticket_url_key FROM tickets
-            LEFT JOIN clients ON ticket_client_id = client_id
             LEFT JOIN contacts ON ticket_contact_id = contact_id
             LEFT JOIN ticket_statuses ON ticket_status = ticket_status_id
             WHERE ticket_id = $ticket_id
@@ -2431,7 +2445,7 @@ if (isset($_GET['close_ticket'])) {
     syncTicketSlaClock($ticket_id);
     setTicketResolutionSlaMet($ticket_id);
 
-    mysqli_query($mysqli, "INSERT INTO ticket_replies SET ticket_reply = 'Ticket closed.', ticket_reply_type = 'Internal', ticket_reply_time_worked = '00:01:00', ticket_reply_by = $session_user_id, ticket_reply_ticket_id = $ticket_id");
+    mysqli_query($mysqli, "INSERT INTO ticket_replies SET ticket_reply = 'Ticket closed.', ticket_reply_type = 'Internal', ticket_reply_time_worked = '00:00:00', ticket_reply_by = $session_user_id, ticket_reply_ticket_id = $ticket_id");
 
     logTicketHistory($ticket_id, "$session_name closed the ticket");
 
@@ -2444,7 +2458,6 @@ if (isset($_GET['close_ticket'])) {
 
         // Get details
         $ticket_sql = mysqli_query($mysqli, "SELECT contact_name, contact_email, ticket_prefix, ticket_number, ticket_subject, ticket_url_key FROM tickets
-            LEFT JOIN clients ON ticket_client_id = client_id
             LEFT JOIN contacts ON ticket_contact_id = contact_id
             WHERE ticket_id = $ticket_id
         ");
@@ -2562,7 +2575,9 @@ if (isset($_POST['add_invoice_from_ticket'])) {
 
     $sql = mysqli_query(
         $mysqli,
-        "SELECT * FROM tickets
+        "SELECT asset_id, client_id, client_net_terms, contact_email, contact_id, contact_name,
+            location_name, ticket_category, ticket_closed_at, ticket_created_at, ticket_number,
+            ticket_prefix, ticket_subject, ticket_updated_at FROM tickets
         LEFT JOIN clients ON ticket_client_id = client_id
         LEFT JOIN contacts ON ticket_contact_id = contact_id
         LEFT JOIN assets ON ticket_asset_id = asset_id
@@ -2632,7 +2647,7 @@ if (isset($_POST['add_invoice_from_ticket'])) {
     $subtotal = $price * $qty;
 
     if ($tax_id > 0) {
-        $sql = mysqli_query($mysqli, "SELECT * FROM taxes WHERE tax_id = $tax_id");
+        $sql = mysqli_query($mysqli, "SELECT tax_percent FROM taxes WHERE tax_id = $tax_id");
         $row = mysqli_fetch_assoc($sql);
         $tax_percent = floatval($row['tax_percent']);
         $tax_amount = $subtotal * $tax_percent / 100;
@@ -2646,7 +2661,7 @@ if (isset($_POST['add_invoice_from_ticket'])) {
 
     //Update Invoice Balances
 
-    $sql = mysqli_query($mysqli, "SELECT * FROM invoices WHERE invoice_id = $invoice_id");
+    $sql = mysqli_query($mysqli, "SELECT invoice_amount FROM invoices WHERE invoice_id = $invoice_id");
     $row = mysqli_fetch_assoc($sql);
 
     $new_invoice_amount = floatval($row['invoice_amount']) + $total;
@@ -2656,7 +2671,7 @@ if (isset($_POST['add_invoice_from_ticket'])) {
     mysqli_query($mysqli, "INSERT INTO history SET history_status = 'Draft', history_description = 'Invoice created from Ticket $ticket_prefix$ticket_number', history_invoice_id = $invoice_id");
 
     // Add internal note to ticket, and link to invoice in database
-    mysqli_query($mysqli, "INSERT INTO ticket_replies SET ticket_reply = 'Created invoice <a href=\"invoice.php?invoice_id=$invoice_id\">$config_invoice_prefix$invoice_number</a> for this ticket.', ticket_reply_type = 'Internal', ticket_reply_time_worked = '00:01:00', ticket_reply_by = $session_user_id, ticket_reply_ticket_id = $ticket_id");
+    mysqli_query($mysqli, "INSERT INTO ticket_replies SET ticket_reply = 'Created invoice <a href=\"invoice.php?invoice_id=$invoice_id\">$config_invoice_prefix$invoice_number</a> for this ticket.', ticket_reply_type = 'Internal', ticket_reply_time_worked = '00:00:00', ticket_reply_by = $session_user_id, ticket_reply_ticket_id = $ticket_id");
 
     mysqli_query($mysqli, "UPDATE tickets SET ticket_invoice_id = $invoice_id WHERE ticket_id = $ticket_id");
 
@@ -2688,7 +2703,7 @@ if (isset($_POST['add_quote_from_ticket'])) {
     $subtotal = $price * $qty;
     $tax_amount = 0;
     if ($tax_id > 0) {
-        $sql = mysqli_query($mysqli, "SELECT * FROM taxes WHERE tax_id = $tax_id");
+        $sql = mysqli_query($mysqli, "SELECT tax_percent FROM taxes WHERE tax_id = $tax_id");
         $row = mysqli_fetch_assoc($sql);
         $tax_percent = floatval($row['tax_percent']);
         $tax_amount = $subtotal * $tax_percent / 100;
@@ -2729,7 +2744,7 @@ if (isset($_POST['add_quote_from_ticket'])) {
     mysqli_query($mysqli, "INSERT INTO quote_items SET item_name = '$item_name', item_description = '$item_description', item_quantity = $qty, item_price = $price, item_subtotal = $subtotal, item_tax = $tax_amount, item_total = $total, item_order = 1, item_tax_id = $tax_id, item_quote_id = $quote_id");
 
     // Add internal note to ticket, and link to invoice in database
-    mysqli_query($mysqli, "INSERT INTO ticket_replies SET ticket_reply = 'Created quote <a href=\"quote.php?quote_id=$quote_id\">$config_quote_prefix$quote_number</a> for this ticket.', ticket_reply_type = 'Internal', ticket_reply_time_worked = '00:01:00', ticket_reply_by = $session_user_id, ticket_reply_ticket_id = $ticket_id");
+    mysqli_query($mysqli, "INSERT INTO ticket_replies SET ticket_reply = 'Created quote <a href=\"quote.php?quote_id=$quote_id\">$config_quote_prefix$quote_number</a> for this ticket.', ticket_reply_type = 'Internal', ticket_reply_time_worked = '00:00:00', ticket_reply_by = $session_user_id, ticket_reply_ticket_id = $ticket_id");
     mysqli_query($mysqli, "UPDATE tickets SET ticket_quote_id = $quote_id WHERE ticket_id = $ticket_id LIMIT 1");
 
     // Logging + redirects
@@ -2743,7 +2758,7 @@ if (isset($_POST['add_quote_from_ticket'])) {
 
 }
 
-if (isset($_POST['export_tickets'])) {
+if (isExportRequest('export_tickets')) {
 
     validateCSRFToken();
 
@@ -2871,12 +2886,8 @@ if (isset($_POST['export_tickets'])) {
         $ticket_project_snippet = '';
     }
 
-    // Client access override - the only way tickets without a client reach agents
-    // with restricted client access
-    $access_permission_query_overide = '';
-    if ($client_access_string) {
-        $access_permission_query_overide = "AND ticket_client_id IN (0,$client_access_string)";
-    }
+    // Tickets with no client stay visible to restricted agents - clientScopeSql() includes 0
+    $access_permission_query_overide = clientScopeSql('ticket_client_id');
 
     // Date Filter
     $dtf = escapeSql(!empty($_POST['dtf']) ? $_POST['dtf'] : '1970-01-01');
@@ -2895,7 +2906,7 @@ if (isset($_POST['export_tickets'])) {
     // Get records from database - same shape as the tickets page list query
     $sql = mysqli_query(
         $mysqli,
-        "SELECT * FROM tickets
+        "SELECT category_name, ticket_billable, ticket_number, ticket_prefix, user_name FROM tickets
         LEFT JOIN clients ON ticket_client_id = client_id
         LEFT JOIN contacts ON ticket_contact_id = contact_id
         LEFT JOIN users ON ticket_assigned_to = user_id
@@ -3006,7 +3017,7 @@ if (isset($_POST['edit_ticket_schedule'])) {
     //TODO make this configurable
     $start = date('Y-m-d H:i:s', strtotime($schedule) - 7200);
     $end = date('Y-m-d H:i:s', strtotime($schedule) + 7200);
-    $sql = mysqli_query($mysqli, "SELECT * FROM tickets WHERE ticket_schedule BETWEEN '$start' AND '$end' AND ticket_id != $ticket_id");
+    $sql = mysqli_query($mysqli, "SELECT ticket_id, ticket_schedule, ticket_subject FROM tickets WHERE ticket_schedule BETWEEN '$start' AND '$end' AND ticket_id != $ticket_id");
     if (mysqli_num_rows($sql) > 0) {
         $conflicting_tickets = [];
         while ($row = mysqli_fetch_assoc($sql)) {
@@ -3051,7 +3062,7 @@ if (isset($_POST['edit_ticket_schedule'])) {
 
 
     /// Create iCal event
-    $cal_str = createiCalStr($schedule, $cal_subject, $cal_description, $cal_location);
+    $cal_str = createiCalStr($schedule, $cal_subject, $cal_description, $cal_location, getTicketCalendarUid($ticket_id));
 
     // Notify the agent of the scheduled work
     $data[] = [
@@ -3139,7 +3150,7 @@ if (isset($_POST['edit_ticket_schedule'])) {
 
     // Update ticket reply
     $ticket_reply_note = "Ticket scheduled for $email_datetime " . (boolval($onsite) ? '(onsite).' : '(remote).');
-    mysqli_query($mysqli, "INSERT INTO ticket_replies SET ticket_reply = '$ticket_reply_note', ticket_reply_type = 'Internal', ticket_reply_time_worked = '00:01:00', ticket_reply_by = $session_user_id, ticket_reply_ticket_id = $ticket_id");
+    mysqli_query($mysqli, "INSERT INTO ticket_replies SET ticket_reply = '$ticket_reply_note', ticket_reply_type = 'Internal', ticket_reply_time_worked = '00:00:00', ticket_reply_by = $session_user_id, ticket_reply_ticket_id = $ticket_id");
 
     logAudit("Ticket", "Edit", "$session_name edited ticket schedule", $client_id, $ticket_id);
 
@@ -3172,7 +3183,6 @@ if (isset($_GET['cancel_ticket_schedule'])) {
     $ticket_number = intval($row['ticket_number']);
     $ticket_subject = escapeSql($row['ticket_subject']);
     $ticket_schedule = escapeSql($row['ticket_schedule']);
-    $ticket_cal_str = escapeSql($row['ticket_cal_str']);
 
     // Don't Enforce Client Access if Ticket doesn't have an assigned client
     if ($client_id) {
@@ -3192,12 +3202,10 @@ if (isset($_GET['cancel_ticket_schedule'])) {
     $config_ticket_from_name = escapeSql($config_ticket_from_name);
     $session_company_name = escapeSql($session_company_name);
 
-    //Create iCal event
-    $cal_str = createiCalStrCancel($ticket_cal_str);
-
     //Send emails
 
-    $sql = mysqli_query($mysqli, "SELECT * FROM tickets
+    $sql = mysqli_query($mysqli, "SELECT client_name, contact_email, contact_name, ticket_client_id, ticket_details, ticket_number,
+        ticket_prefix, ticket_subject, user_email, user_name FROM tickets
         LEFT JOIN clients ON ticket_client_id = client_id
         LEFT JOIN contacts ON ticket_contact_id = contact_id
         LEFT JOIN locations on contact_location_id = location_id
@@ -3217,6 +3225,10 @@ if (isset($_GET['cancel_ticket_schedule'])) {
     $user_name = escapeSql($row['user_name']);
     $user_email = escapeSql($row['user_email']);
 
+    //Create the iCal cancellation - same UID and subject as the original invite
+    $cal_subject = $ticket_number . ": " . $client_name . " - " . $ticket_subject;
+    $cal_str = createiCalStrCancel($ticket_schedule, $cal_subject, getTicketCalendarUid($ticket_id));
+
     // Notify the agent of the cancellation
     $data[] = [
             // User Email
@@ -3303,7 +3315,7 @@ if (isset($_GET['cancel_ticket_schedule'])) {
 
     // Update ticket reply
     $ticket_reply_note = "Ticket schedule cancelled.";
-    mysqli_query($mysqli, "INSERT INTO ticket_replies SET ticket_reply = '$ticket_reply_note', ticket_reply_type = 'Internal', ticket_reply_time_worked = '00:01:00', ticket_reply_by = $session_user_id, ticket_reply_ticket_id = $ticket_id");
+    mysqli_query($mysqli, "INSERT INTO ticket_replies SET ticket_reply = '$ticket_reply_note', ticket_reply_type = 'Internal', ticket_reply_time_worked = '00:00:00', ticket_reply_by = $session_user_id, ticket_reply_ticket_id = $ticket_id");
 
     logAudit("Ticket", "Edit", "$session_name cancelled ticket schedule", $client_id, $ticket_id);
 
diff --git a/agent/post/transaction.php b/agent/post/transaction.php
index 672094d5b..15b86683c 100644
--- a/agent/post/transaction.php
+++ b/agent/post/transaction.php
@@ -9,7 +9,7 @@ if (!defined('FROM_POST_HANDLER')) {
     exit;
 }
 
-if (isset($_POST['export_transactions'])) {
+if (isExportRequest('export_transactions')) {
 
     validateCSRFToken();
 
@@ -103,7 +103,7 @@ if (isset($_POST['export_transactions'])) {
     if ($account) {
 
         // Account details for the running balance and file name
-        $row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT * FROM accounts WHERE account_id = $account LIMIT 1"));
+        $row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT account_name, opening_balance FROM accounts WHERE account_id = $account LIMIT 1"));
         $account_name = $row['account_name'];
         $account_opening_balance = floatval($row['opening_balance']);
 
diff --git a/agent/post/transfer.php b/agent/post/transfer.php
index a67c6eb64..2b427bc60 100644
--- a/agent/post/transfer.php
+++ b/agent/post/transfer.php
@@ -78,7 +78,7 @@ if (isset($_GET['delete_transfer'])) {
     $transfer_id = intval($_GET['delete_transfer']);
 
     // Query the transfer ID to get the Payment and Expense IDs, so we can delete those as well
-    $row = mysqli_fetch_assoc(mysqli_query($mysqli,"SELECT * FROM transfers WHERE transfer_id = $transfer_id"));
+    $row = mysqli_fetch_assoc(mysqli_query($mysqli,"SELECT transfer_expense_id, transfer_revenue_id FROM transfers WHERE transfer_id = $transfer_id"));
     $expense_id = intval($row['transfer_expense_id']);
     $revenue_id = intval($row['transfer_revenue_id']);
 
diff --git a/agent/post/trip.php b/agent/post/trip.php
index a061e4709..9e0cbc87b 100644
--- a/agent/post/trip.php
+++ b/agent/post/trip.php
@@ -65,7 +65,7 @@ if (isset($_GET['delete_trip'])) {
     $trip_id = intval($_GET['delete_trip']);
 
     // Get Trip Info and Client ID for logging
-    $row = mysqli_fetch_assoc(mysqli_query($mysqli,"SELECT * FROM trips WHERE trip_id = $trip_id"));
+    $row = mysqli_fetch_assoc(mysqli_query($mysqli,"SELECT trip_client_id, trip_destination, trip_source FROM trips WHERE trip_id = $trip_id"));
     $client_id = intval($row['trip_client_id']);
     $trip_source = escapeSql($row['trip_source']);
     $trip_destination = escapeSql($row['trip_destination']);
@@ -84,7 +84,7 @@ if (isset($_GET['delete_trip'])) {
 
 }
 
-if (isset($_POST['export_trips'])) {
+if (isExportRequest('export_trips')) {
 
     validateCSRFToken();
 
@@ -133,7 +133,7 @@ if (isset($_POST['export_trips'])) {
         AND DATE(trip_date) BETWEEN '$dtf' AND '$dtt'
         AND trip_archived_at IS NULL
         $client_query
-        $access_permission_query
+        " . clientScopeSql('trip_client_id') . "
         ORDER BY trip_date ASC"
     );
 
diff --git a/agent/post/vendor.php b/agent/post/vendor.php
index 711f6659d..ca0bca4f2 100644
--- a/agent/post/vendor.php
+++ b/agent/post/vendor.php
@@ -26,7 +26,10 @@ if (isset($_POST['add_vendor_from_template'])) {
     $vendor_template_id = intval($_POST['vendor_template_id']);
 
     //GET Vendor Info
-    $sql_vendor_templates = mysqli_query($mysqli,"SELECT * FROM vendor_templates WHERE vendor_template_id = $vendor_template_id");
+    $sql_vendor_templates = mysqli_query($mysqli,"SELECT vendor_template_account_number, vendor_template_code, vendor_template_contact_name,
+        vendor_template_description, vendor_template_email, vendor_template_extension,
+        vendor_template_hours, vendor_template_name, vendor_template_notes, vendor_template_phone,
+        vendor_template_phone_country_code, vendor_template_sla, vendor_template_website FROM vendor_templates WHERE vendor_template_id = $vendor_template_id");
 
     $row = mysqli_fetch_assoc($sql_vendor_templates);
 
@@ -124,7 +127,7 @@ if (isset($_GET['archive_vendor'])) {
     $vendor_id = intval($_GET['archive_vendor']);
 
     //Get Vendor Name
-    $sql = mysqli_query($mysqli,"SELECT * FROM vendors WHERE vendor_id = $vendor_id");
+    $sql = mysqli_query($mysqli,"SELECT vendor_client_id, vendor_name FROM vendors WHERE vendor_id = $vendor_id");
     $row = mysqli_fetch_assoc($sql);
     $vendor_name = escapeSql($row['vendor_name']);
     $client_id = intval($row['vendor_client_id']);
@@ -184,7 +187,7 @@ if (isset($_GET['delete_vendor'])) {
     $vendor_id = intval($_GET['delete_vendor']);
 
     //Get Vendor Name
-    $sql = mysqli_query($mysqli,"SELECT * FROM vendors WHERE vendor_id = $vendor_id");
+    $sql = mysqli_query($mysqli,"SELECT vendor_client_id, vendor_name, vendor_template_id FROM vendors WHERE vendor_id = $vendor_id");
     $row = mysqli_fetch_assoc($sql);
     $vendor_name = escapeSql($row['vendor_name']);
     $client_id = intval($row['vendor_client_id']);
@@ -350,7 +353,7 @@ if (isset($_POST['bulk_delete_vendors'])) {
 
 }
 
-if (isset($_POST['export_vendors'])) {
+if (isExportRequest('export_vendors')) {
 
     validateCSRFToken();
 
@@ -398,7 +401,7 @@ if (isset($_POST['export_vendors'])) {
         WHERE $archive_query
         AND (vendor_name LIKE '%$q%' OR vendor_description LIKE '%$q%' OR vendor_account_number LIKE '%$q%' OR vendor_website LIKE '%$q%' OR vendor_contact_name LIKE '%$q%' OR vendor_email LIKE '%$q%' OR vendor_phone LIKE '%$q%')
         $client_query
-        $access_permission_query
+        " . clientScopeSql('vendor_client_id') . "
         ORDER BY vendor_name ASC"
     );
 
diff --git a/agent/project.php b/agent/project.php
index 10c90edd7..4655b1d26 100644
--- a/agent/project.php
+++ b/agent/project.php
@@ -19,21 +19,16 @@ if (isset($_GET['client_id'])) {
 
 // Perms & Project client access snippet
 enforceUserPermission('module_support');
-$project_permission_snippet = '';
-
-if ($client_access_string) {
-    $project_permission_snippet .= " AND (project_client_id IN ($client_access_string) OR project_client_id = 0)";
-}
-if ($client_deny_string) {
-    $project_permission_snippet .= " AND project_client_id NOT IN ($client_deny_string)";
-}
+$project_permission_snippet = clientScopeSql('project_client_id');
 
 if (isset($_GET['project_id'])) {
     $project_id = intval($_GET['project_id']);
 
     $sql_project = mysqli_query(
         $mysqli,
-        "SELECT * FROM projects
+        "SELECT client_id, client_name, project_archived_at, project_completed_at, project_created_at,
+            project_description, project_due, project_id, project_name, project_number, project_prefix,
+            project_updated_at, user_id, user_name FROM projects
         LEFT JOIN clients ON project_client_id = client_id
         LEFT JOIN users ON project_manager = user_id
         WHERE project_id = $project_id
@@ -89,7 +84,10 @@ if (isset($_GET['project_id'])) {
     $page_title = $row['project_name'];
 
     // Get Tickets
-    $sql_tickets = mysqli_query($mysqli, "SELECT * FROM tickets
+    $sql_tickets = mysqli_query($mysqli, "SELECT client_id, client_name, ticket_assigned_to, ticket_billable, ticket_closed_at,
+        ticket_created_at, ticket_id, ticket_number, ticket_prefix, ticket_priority,
+        ticket_project_id, ticket_status, ticket_status_color, ticket_status_name, ticket_subject,
+        ticket_updated_at, user_name FROM tickets
         LEFT JOIN ticket_statuses ON ticket_status = ticket_status_id
         LEFT JOIN clients ON ticket_client_id = client_id
         LEFT JOIN users ON ticket_assigned_to = user_id
@@ -99,11 +97,11 @@ if (isset($_GET['project_id'])) {
     $ticket_count = mysqli_num_rows($sql_tickets);
 
     // Get Closed Ticket Count
-    $sql_closed_tickets = mysqli_query($mysqli, "SELECT * FROM tickets WHERE ticket_project_id = $project_id AND ticket_closed_at IS NOT NULL");
+    $sql_closed_tickets = mysqli_query($mysqli, "SELECT 1 FROM tickets WHERE ticket_project_id = $project_id AND ticket_closed_at IS NOT NULL");
     $closed_ticket_count = mysqli_num_rows($sql_closed_tickets);
 
     // Get Resolved Ticket Count
-    $sql_resolved_tickets = mysqli_query($mysqli, "SELECT * FROM tickets WHERE ticket_project_id = $project_id AND ticket_resolved_at IS NOT NULL");
+    $sql_resolved_tickets = mysqli_query($mysqli, "SELECT 1 FROM tickets WHERE ticket_project_id = $project_id AND ticket_resolved_at IS NOT NULL");
 
     $resolved_ticket_count = mysqli_num_rows($sql_resolved_tickets);
 
@@ -119,7 +117,7 @@ if (isset($_GET['project_id'])) {
 
     // Get All Tasks
     $sql_tasks = mysqli_query($mysqli,
-        "SELECT * FROM tickets, tasks
+        "SELECT task_completed_at, task_id, task_name FROM tickets, tasks
         WHERE ticket_id = task_ticket_id
         AND ticket_project_id = $project_id
         ORDER BY task_created_at ASC"
@@ -128,7 +126,7 @@ if (isset($_GET['project_id'])) {
 
     // Get Completed Task Count
     $sql_tasks_completed = mysqli_query($mysqli,
-        "SELECT * FROM tickets, tasks
+        "SELECT 1 FROM tickets, tasks
         WHERE ticket_id = task_ticket_id
         AND ticket_project_id = $project_id
         AND task_completed_at IS NOT NULL"
diff --git a/agent/projects.php b/agent/projects.php
index 7cb73e005..257e5ea9b 100644
--- a/agent/projects.php
+++ b/agent/projects.php
@@ -18,14 +18,7 @@ if (isset($_GET['client_id'])) {
 // Perms & Project client access snippet
 enforceUserPermission('module_support');
 
-$project_permission_snippet = '';
-
-if ($client_access_string) {
-    $project_permission_snippet .= " AND (project_client_id IN ($client_access_string) OR project_client_id = 0)";
-}
-if ($client_deny_string) {
-    $project_permission_snippet .= " AND project_client_id NOT IN ($client_deny_string)";
-}
+$project_permission_snippet = clientScopeSql('project_client_id');
 
 // Project Completed Status Query
 if (isset($_GET['status']) && $_GET['status'] == 1) {
@@ -38,7 +31,9 @@ if (isset($_GET['status']) && $_GET['status'] == 1) {
 
 $sql_projects = mysqli_query(
     $mysqli,
-    "SELECT SQL_CALC_FOUND_ROWS * FROM projects
+    "SELECT SQL_CALC_FOUND_ROWS client_id, client_name, project_archived_at, project_completed_at, project_created_at,
+        project_description, project_due, project_id, project_name, project_number, project_prefix,
+        project_updated_at, user_id, user_name FROM projects
     LEFT JOIN clients ON client_id = project_client_id
     LEFT JOIN users ON user_id = project_manager
     WHERE DATE(project_created_at) BETWEEN '$dtf' AND '$dtt'
diff --git a/agent/quote.php b/agent/quote.php
index 197775eac..b9b8837de 100644
--- a/agent/quote.php
+++ b/agent/quote.php
@@ -16,12 +16,17 @@ if (isset($_GET['quote_id'])) {
 
     $sql = mysqli_query(
         $mysqli,
-        "SELECT * FROM quotes
+        "SELECT client_currency_code, client_id, client_name, client_net_terms, client_website,
+            contact_email, contact_extension, contact_mobile, contact_mobile_country_code,
+            contact_phone, contact_phone_country_code, location_address, location_city,
+            location_country, location_state, location_zip, quote_amount, quote_category_id,
+            quote_created_at, quote_currency_code, quote_date, quote_discount_amount, quote_expire,
+            quote_id, quote_note, quote_number, quote_prefix, quote_scope, quote_status, quote_url_key FROM quotes
         LEFT JOIN clients ON quote_client_id = client_id
         LEFT JOIN contacts ON clients.client_id = contacts.contact_client_id AND contact_primary = 1
         LEFT JOIN locations ON clients.client_id = locations.location_client_id AND location_primary = 1
         WHERE quote_id = $quote_id
-        $access_permission_query
+        " . clientScopeSql('quote_client_id') . "
         LIMIT 1"
     );
 
@@ -76,7 +81,9 @@ if (isset($_GET['quote_id'])) {
     $tab_title = $row['client_name'];
     $page_title = "{$row['quote_prefix']}{$row['quote_number']}";
 
-    $sql = mysqli_query($mysqli, "SELECT * FROM companies, settings WHERE companies.company_id = settings.company_id AND companies.company_id = 1");
+    $sql = mysqli_query($mysqli, "SELECT company_address, company_city, company_country, company_email, settings.company_id,
+        company_logo, company_name, company_phone, company_phone_country_code, company_state,
+        company_website, company_zip FROM companies, settings WHERE companies.company_id = settings.company_id AND companies.company_id = 1");
     $row = mysqli_fetch_assoc($sql);
 
     $company_id = intval($row['company_id']);
@@ -92,7 +99,7 @@ if (isset($_GET['quote_id'])) {
     $company_website = escapeHtml($row['company_website']);
     $company_logo = escapeHtml($row['company_logo']);
 
-    $sql_history = mysqli_query($mysqli, "SELECT * FROM history WHERE history_quote_id = $quote_id ORDER BY history_id DESC");
+    $sql_history = mysqli_query($mysqli, "SELECT history_created_at, history_description, history_status FROM history WHERE history_quote_id = $quote_id ORDER BY history_id DESC");
 
     //Set Badge color based off of quote status
     if ($quote_status == "Sent") {
@@ -283,7 +290,8 @@ if (isset($_GET['quote_id'])) {
                 </div>
             </div>
 
-            <?php $sql_items = mysqli_query($mysqli, "SELECT * FROM quote_items WHERE item_quote_id = $quote_id ORDER BY item_order ASC"); ?>
+            <?php $sql_items = mysqli_query($mysqli, "SELECT item_created_at, item_description, item_id, item_name, item_price, item_quantity, item_tax,
+                item_tax_id, item_total FROM quote_items WHERE item_quote_id = $quote_id ORDER BY item_order ASC"); ?>
 
             <div class="row mb-3">
                 <div class="col-md-12">
diff --git a/agent/quotes.php b/agent/quotes.php
index 1db2e7578..b14379fa6 100644
--- a/agent/quotes.php
+++ b/agent/quotes.php
@@ -20,12 +20,14 @@ enforceUserPermission('module_sales');
 
 $sql = mysqli_query(
     $mysqli,
-    "SELECT SQL_CALC_FOUND_ROWS * FROM quotes
+    "SELECT SQL_CALC_FOUND_ROWS category_id, category_name, client_currency_code, client_id, client_name, client_net_terms,
+        quote_amount, quote_created_at, quote_currency_code, quote_date, quote_discount_amount,
+        quote_expire, quote_id, quote_number, quote_prefix, quote_scope, quote_status FROM quotes
     LEFT JOIN clients ON quote_client_id = client_id
     LEFT JOIN categories ON quote_category_id = category_id
     WHERE (CONCAT(quote_prefix,quote_number) LIKE '%$q%' OR quote_scope LIKE '%$q%' OR category_name LIKE '%$q%' OR quote_status LIKE '%$q%' OR quote_amount LIKE '%$q%' OR client_name LIKE '%$q%')
     AND DATE(quote_date) BETWEEN '$dtf' AND '$dtt'
-    $access_permission_query
+    " . clientScopeSql('quote_client_id') . "
     $client_query
     ORDER BY $sort $order LIMIT $record_from, $record_to"
 );
diff --git a/agent/racks.php b/agent/racks.php
index 2e5cbff8a..a68f31e69 100644
--- a/agent/racks.php
+++ b/agent/racks.php
@@ -11,7 +11,9 @@ enforceUserPermission('module_support');
 
 $sql = mysqli_query(
     $mysqli,
-    "SELECT SQL_CALC_FOUND_ROWS * FROM racks
+    "SELECT SQL_CALC_FOUND_ROWS location_name, rack_created_at, rack_depth, rack_description, rack_id, rack_location_id,
+        rack_model, rack_name, rack_notes, rack_photo, rack_physical_location, rack_type,
+        rack_units FROM racks
     LEFT JOIN locations ON location_id = rack_location_id
     WHERE rack_client_id = $client_id
     AND rack_$archive_query
diff --git a/agent/recurring_expenses.php b/agent/recurring_expenses.php
index 7208fbc50..86129b368 100644
--- a/agent/recurring_expenses.php
+++ b/agent/recurring_expenses.php
@@ -11,14 +11,20 @@ enforceUserPermission('module_financial');
 
 $sql = mysqli_query(
     $mysqli,
-    "SELECT SQL_CALC_FOUND_ROWS * FROM recurring_expenses
+    "SELECT SQL_CALC_FOUND_ROWS account_name, category_name, client_name, recurring_expense_account_id,
+        recurring_expense_amount, recurring_expense_category_id, recurring_expense_client_id,
+        recurring_expense_created_at, recurring_expense_currency_code, recurring_expense_day,
+        recurring_expense_description, recurring_expense_frequency, recurring_expense_id,
+        recurring_expense_last_sent, recurring_expense_month, recurring_expense_next_date,
+        recurring_expense_payment_method, recurring_expense_reference, recurring_expense_status,
+        recurring_expense_vendor_id, vendor_name FROM recurring_expenses
     LEFT JOIN categories ON recurring_expense_category_id = category_id
     LEFT JOIN vendors ON recurring_expense_vendor_id = vendor_id
     LEFT JOIN accounts ON recurring_expense_account_id = account_id
     LEFT JOIN clients ON recurring_expense_client_id = client_id
     WHERE DATE(recurring_expense_created_at) BETWEEN '$dtf' AND '$dtt'
     AND (vendor_name LIKE '%$q%' OR client_name LIKE '%$q%' OR category_name LIKE '%$q%' OR account_name LIKE '%$q%' OR recurring_expense_description LIKE '%$q%' OR recurring_expense_amount LIKE '%$q%')
-    $access_permission_query
+    " . clientScopeSql('recurring_expense_client_id') . "
     ORDER BY $sort $order LIMIT $record_from, $record_to"
 );
 
diff --git a/agent/recurring_invoice.php b/agent/recurring_invoice.php
index 0ba7ea836..a1fef0f17 100644
--- a/agent/recurring_invoice.php
+++ b/agent/recurring_invoice.php
@@ -15,7 +15,17 @@ if (isset($_GET['recurring_invoice_id'])) {
 
     $sql = mysqli_query(
         $mysqli,
-        "SELECT * FROM recurring_invoices
+        "SELECT client_currency_code, client_id, client_name, client_net_terms, client_website,
+            contact_email, contact_extension, contact_mobile, contact_mobile_country_code,
+            contact_phone, contact_phone_country_code, location_address, location_city,
+            location_country, location_state, location_zip, recurring_invoice_amount,
+            recurring_invoice_category_id, recurring_invoice_created_at,
+            recurring_invoice_currency_code, recurring_invoice_discount_amount,
+            recurring_invoice_email_notify, recurring_invoice_frequency, recurring_invoice_last_sent,
+            recurring_invoice_next_date, recurring_invoice_note, recurring_invoice_number,
+            recurring_invoice_prefix, recurring_invoice_scope, recurring_invoice_status,
+            recurring_payment_id, recurring_payment_method, recurring_payment_recurring_invoice_id,
+            recurring_payment_saved_payment_id FROM recurring_invoices
         LEFT JOIN clients ON recurring_invoice_client_id = client_id
         LEFT JOIN contacts ON clients.client_id = contacts.contact_client_id AND contact_primary = 1
         LEFT JOIN locations ON clients.client_id = locations.location_client_id AND location_primary = 1
@@ -86,7 +96,9 @@ if (isset($_GET['recurring_invoice_id'])) {
     $tab_title = $row['client_name'];
     $page_title = "{$row['recurring_invoice_prefix']}{$row['recurring_invoice_number']}";
 
-    $sql = mysqli_query($mysqli, "SELECT * FROM companies WHERE company_id = 1");
+    $sql = mysqli_query($mysqli, "SELECT company_address, company_city, company_country, company_email, company_id, company_logo,
+        company_name, company_phone, company_phone_country_code, company_state, company_website,
+        company_zip FROM companies WHERE company_id = 1");
     $row = mysqli_fetch_assoc($sql);
 
     $company_id = intval($row['company_id']);
@@ -102,7 +114,7 @@ if (isset($_GET['recurring_invoice_id'])) {
     $company_website = escapeHtml($row['company_website']);
     $company_logo = escapeHtml($row['company_logo']);
 
-    $sql_history = mysqli_query($mysqli, "SELECT * FROM history WHERE history_recurring_invoice_id = $recurring_invoice_id ORDER BY history_id DESC");
+    $sql_history = mysqli_query($mysqli, "SELECT history_created_at, history_description, history_status FROM history WHERE history_recurring_invoice_id = $recurring_invoice_id ORDER BY history_id DESC");
 
     //Product autocomplete
     $products_sql = mysqli_query($mysqli, "SELECT product_name AS label, product_description AS description, product_price AS price, product_tax_id AS tax FROM products WHERE product_archived_at IS NULL");
@@ -150,7 +162,7 @@ if (isset($_GET['recurring_invoice_id'])) {
                     <?php } ?>
                 </div>
                 <div class="col-3">
-                    <?php $sql_saved_payments = mysqli_query($mysqli, "SELECT * FROM client_saved_payment_methods WHERE saved_payment_client_id = $client_id");
+                    <?php $sql_saved_payments = mysqli_query($mysqli, "SELECT saved_payment_description, saved_payment_id FROM client_saved_payment_methods WHERE saved_payment_client_id = $client_id");
                     if (mysqli_num_rows($sql_saved_payments) > 0) { ?>
                         <form class="form" action="post.php" method="post">
                             <input type="hidden" name="csrf_token" value="<?= $_SESSION['csrf_token'] ?>">
@@ -252,7 +264,8 @@ if (isset($_GET['recurring_invoice_id'])) {
                 </div>
             </div>
 
-            <?php $sql_items = mysqli_query($mysqli, "SELECT * FROM recurring_invoice_items WHERE item_recurring_invoice_id = $recurring_invoice_id ORDER BY item_order ASC"); ?>
+            <?php $sql_items = mysqli_query($mysqli, "SELECT item_created_at, item_description, item_id, item_name, item_price, item_quantity, item_tax,
+                item_tax_id, item_total FROM recurring_invoice_items WHERE item_recurring_invoice_id = $recurring_invoice_id ORDER BY item_order ASC"); ?>
 
             <div class="row mb-3">
                 <div class="col-md-12">
diff --git a/agent/recurring_invoices.php b/agent/recurring_invoices.php
index b92760468..7d455bee6 100644
--- a/agent/recurring_invoices.php
+++ b/agent/recurring_invoices.php
@@ -29,7 +29,13 @@ if (isset($_GET['status']) && $_GET['status'] == "inactive") {
 
 $sql = mysqli_query(
     $mysqli,
-    "SELECT SQL_CALC_FOUND_ROWS * FROM recurring_invoices
+    "SELECT SQL_CALC_FOUND_ROWS category_id, category_name, client_currency_code, client_id, client_name,
+        recurring_invoice_amount, recurring_invoice_created_at, recurring_invoice_currency_code,
+        recurring_invoice_discount_amount, recurring_invoice_frequency, recurring_invoice_id,
+        recurring_invoice_last_sent, recurring_invoice_next_date, recurring_invoice_number,
+        recurring_invoice_prefix, recurring_invoice_scope, recurring_invoice_status,
+        recurring_payment_id, recurring_payment_recurring_invoice_id,
+        recurring_payment_saved_payment_id FROM recurring_invoices
     LEFT JOIN clients ON recurring_invoice_client_id = client_id
     LEFT JOIN categories ON recurring_invoice_category_id = category_id
     LEFT JOIN recurring_payments ON recurring_payment_recurring_invoice_id = recurring_invoice_id
@@ -37,7 +43,7 @@ $sql = mysqli_query(
     AND DATE(recurring_invoice_created_at) BETWEEN '$dtf' AND '$dtt'
     $status_query
     $client_query
-    $access_permission_query
+    " . clientScopeSql('recurring_invoice_client_id') . "
 
     ORDER BY $sort $order LIMIT $record_from, $record_to");
 
@@ -218,7 +224,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                         <td><?= $recurring_invoice_last_sent ?></td>
                         <td><?= $category_name ?></td>
                         <td>
-                            <?php $sql_saved_payments = mysqli_query($mysqli, "SELECT * FROM client_saved_payment_methods WHERE saved_payment_client_id = $client_id");
+                            <?php $sql_saved_payments = mysqli_query($mysqli, "SELECT saved_payment_description, saved_payment_id FROM client_saved_payment_methods WHERE saved_payment_client_id = $client_id");
                             if (mysqli_num_rows($sql_saved_payments) > 0) { ?>
                                 <form class="form" action="post.php" method="post">
                                     <input type="hidden" name="csrf_token" value="<?= $_SESSION['csrf_token'] ?>">
diff --git a/agent/recurring_tickets.php b/agent/recurring_tickets.php
index 156f1cb6a..b655527b9 100644
--- a/agent/recurring_tickets.php
+++ b/agent/recurring_tickets.php
@@ -62,7 +62,7 @@ $sql = mysqli_query(
     LEFT JOIN users ON user_id = recurring_ticket_assigned_to
     LEFT JOIN ticket_templates ON ticket_template_id = recurring_ticket_ticket_template_id
     WHERE (recurring_tickets.recurring_ticket_subject LIKE '%$q%' OR category_name LIKE '%$q%')
-    $access_permission_query
+    " . clientScopeSql('recurring_ticket_client_id') . "
     $category_query
     $assigned_agent_query
     $billable_query
diff --git a/agent/reports/credential_rotation.php b/agent/reports/credential_rotation.php
index 2579f0421..253c8afa1 100644
--- a/agent/reports/credential_rotation.php
+++ b/agent/reports/credential_rotation.php
@@ -16,6 +16,7 @@ $passwords_not_rotated_sql = mysqli_query($mysqli,
         FROM credentials
         LEFT JOIN clients ON credential_client_id = client_id
         WHERE DATE(credential_password_changed_at) < DATE_SUB(CURDATE(), INTERVAL $days DAY)
+        " . clientScopeSql('credential_client_id') . "
         ORDER BY client_name"
 );
 
diff --git a/agent/reports/expense_summary.php b/agent/reports/expense_summary.php
index 698231712..0f4df0927 100644
--- a/agent/reports/expense_summary.php
+++ b/agent/reports/expense_summary.php
@@ -12,7 +12,7 @@ if (isset($_GET['year'])) {
 
 $sql_expense_years = mysqli_query($mysqli, "SELECT DISTINCT YEAR(expense_date) AS expense_year FROM expenses WHERE expense_category_id > 0 ORDER BY expense_year DESC");
 
-$sql_categories = mysqli_query($mysqli, "SELECT * FROM categories WHERE category_type = 'Expense' ORDER BY category_name ASC");
+$sql_categories = mysqli_query($mysqli, "SELECT category_id, category_name FROM categories WHERE category_type = 'Expense' ORDER BY category_name ASC");
 
 // For chart Y-axis max
 $largest_expense_month = 0;
diff --git a/agent/reports/includes/reports_side_nav.php b/agent/reports/includes/reports_side_nav.php
index 364701163..2fe243bea 100644
--- a/agent/reports/includes/reports_side_nav.php
+++ b/agent/reports/includes/reports_side_nav.php
@@ -139,7 +139,7 @@
                 <?php } ?>
 
                 <?php
-                $sql_custom_links = mysqli_query($mysqli, "SELECT * FROM custom_links
+                $sql_custom_links = mysqli_query($mysqli, "SELECT custom_link_icon, custom_link_name, custom_link_new_tab, custom_link_uri FROM custom_links
                     WHERE custom_link_location = 5 AND custom_link_archived_at IS NULL
                     ORDER BY custom_link_order ASC, custom_link_name ASC"
                 );
diff --git a/agent/reports/income_summary.php b/agent/reports/income_summary.php
index 0678c563e..642799f63 100644
--- a/agent/reports/income_summary.php
+++ b/agent/reports/income_summary.php
@@ -14,7 +14,7 @@ $sql_payment_years = mysqli_query($mysqli, "SELECT DISTINCT YEAR(payment_date) A
     UNION SELECT DISTINCT YEAR(revenue_date) AS payment_year FROM revenues
     ORDER BY payment_year DESC");
 
-$sql_categories = mysqli_query($mysqli, "SELECT * FROM categories WHERE category_type = 'Income' ORDER BY category_name ASC");
+$sql_categories = mysqli_query($mysqli, "SELECT category_id, category_name FROM categories WHERE category_type = 'Income' ORDER BY category_name ASC");
 
 // Used for chart y-axis max calculation
 $largest_income_month = 0;
diff --git a/agent/reports/profit_loss.php b/agent/reports/profit_loss.php
index 4936add03..39a7a4541 100644
--- a/agent/reports/profit_loss.php
+++ b/agent/reports/profit_loss.php
@@ -17,9 +17,9 @@ $sql_all_years = mysqli_query($mysqli, "SELECT YEAR(expense_date) AS all_years F
     ORDER BY all_years DESC"
 );
 
-$sql_categories_income = mysqli_query($mysqli, "SELECT * FROM categories WHERE category_type = 'Income' ORDER BY category_name ASC");
+$sql_categories_income = mysqli_query($mysqli, "SELECT category_id, category_name FROM categories WHERE category_type = 'Income' ORDER BY category_name ASC");
 
-$sql_categories_expense = mysqli_query($mysqli, "SELECT * FROM categories WHERE category_type = 'Expense' ORDER BY category_name ASC");
+$sql_categories_expense = mysqli_query($mysqli, "SELECT category_id, category_name FROM categories WHERE category_type = 'Expense' ORDER BY category_name ASC");
 
 
 ?>
diff --git a/agent/services.php b/agent/services.php
index d482af913..6061a6e0e 100644
--- a/agent/services.php
+++ b/agent/services.php
@@ -33,11 +33,13 @@ if (!$client_url) {
 // Overview SQL query
 $sql = mysqli_query(
     $mysqli,
-    "SELECT SQL_CALC_FOUND_ROWS * FROM services
+    "SELECT SQL_CALC_FOUND_ROWS client_id, client_name, service_backup, service_category, service_created_at,
+        service_description, service_id, service_importance, service_name, service_notes,
+        service_review_due, service_updated_at FROM services
     LEFT JOIN clients ON client_id = service_client_id
     WHERE (service_name LIKE '%$q%' OR service_description LIKE '%$q%' OR service_category LIKE '%$q%' OR client_name LIKE '%$q%')
     AND client_archived_at IS NULL
-    $access_permission_query
+    " . clientScopeSql('service_client_id') . "
     $client_query
     ORDER BY $sort $order LIMIT $record_from, $record_to"
 );
@@ -85,7 +87,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                                     FROM clients
                                     JOIN services ON service_client_id = client_id
                                     WHERE client_archived_at IS NULL
-                                    $access_permission_query
+                                    " . clientScopeSql('clients.client_id') . "
                                     ORDER BY client_name ASC
                                 ");
                                 while ($row = mysqli_fetch_assoc($sql_clients_filter)) {
diff --git a/agent/software.php b/agent/software.php
index 35c23096e..38394640d 100644
--- a/agent/software.php
+++ b/agent/software.php
@@ -63,12 +63,14 @@ if (!$client_url) {
 
 $sql = mysqli_query(
     $mysqli,
-    "SELECT SQL_CALC_FOUND_ROWS * FROM software
+    "SELECT SQL_CALC_FOUND_ROWS client_id, client_name, software_created_at, software_description, software_expire,
+        software_id, software_license_type, software_name, software_seats, software_type,
+        software_version, vendor_id, vendor_name FROM software
     LEFT JOIN clients ON client_id = software_client_id
     LEFT JOIN vendors ON vendor_id = software_vendor_id
     WHERE (software_name LIKE '%$q%' OR software_type LIKE '%$q%' OR software_key LIKE '%$q%' OR client_name LIKE '%$q%')
     AND $archive_query
-    $access_permission_query
+    " . clientScopeSql('software_client_id') . "
     $client_query
     $expire_query
     ORDER BY $sort $order LIMIT $record_from, $record_to");
@@ -131,7 +133,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                                     FROM clients
                                     JOIN software ON software_client_id = client_id
                                     WHERE $archive_query
-                                    $access_permission_query
+                                    " . clientScopeSql('clients.client_id') . "
                                     ORDER BY client_name ASC
                                 ");
                                 while ($row = mysqli_fetch_assoc($sql_clients_filter)) {
diff --git a/agent/ticket.php b/agent/ticket.php
index e683e1b6c..710b66e76 100644
--- a/agent/ticket.php
+++ b/agent/ticket.php
@@ -9,11 +9,8 @@ if (isset($_GET['client_id'])) {
     $client_url = '';
 }
 
-// Ticket client access overide - This is the only way to show tickets without a client to agents with restricted client access
-$access_permission_query_overide = '';
-if ($client_access_string) {
-    $access_permission_query_overide = "AND ticket_client_id IN (0,$client_access_string)";
-}
+// Tickets with no client stay visible to restricted agents - clientScopeSql() includes 0
+$access_permission_query_overide = clientScopeSql('ticket_client_id');
 
 // Perms
 enforceUserPermission('module_support');
@@ -267,7 +264,9 @@ if (isset($_GET['ticket_id'])) {
         ))['user_names']);
 
         // Get ticket replies
-        $sql_ticket_replies = mysqli_query($mysqli, "SELECT * FROM ticket_replies
+        $sql_ticket_replies = mysqli_query($mysqli, "SELECT contact_name, contact_photo, ticket_reply, ticket_reply_created_at, ticket_reply_id,
+            ticket_reply_time_worked, ticket_reply_type, ticket_reply_updated_at, user_avatar, user_id,
+            user_name FROM ticket_replies
             LEFT JOIN users ON ticket_reply_by = user_id
             LEFT JOIN contacts ON ticket_reply_by = contact_id
             WHERE ticket_reply_ticket_id = $ticket_id
@@ -296,18 +295,18 @@ if (isset($_GET['ticket_id'])) {
         }
 
         // Get Watchers
-        $sql_ticket_watchers = mysqli_query($mysqli, "SELECT * FROM ticket_watchers WHERE watcher_ticket_id = $ticket_id ORDER BY watcher_email DESC");
+        $sql_ticket_watchers = mysqli_query($mysqli, "SELECT watcher_email, watcher_id FROM ticket_watchers WHERE watcher_ticket_id = $ticket_id ORDER BY watcher_email DESC");
         $watcher_count = mysqli_num_rows($sql_ticket_watchers);
 
         // Get Additional Assets
-        $sql_additional_assets = mysqli_query($mysqli, "SELECT * FROM assets, ticket_assets
+        $sql_additional_assets = mysqli_query($mysqli, "SELECT assets.asset_id, asset_name, asset_type FROM assets, ticket_assets
             WHERE assets.asset_id = ticket_assets.asset_id
             AND ticket_id = $ticket_id
             AND assets.asset_id != $asset_id"
         );
 
         // Get Tasks
-        $sql_tasks = mysqli_query($mysqli, "SELECT * FROM tasks WHERE task_ticket_id = $ticket_id ORDER BY task_order ASC, task_id ASC");
+        $sql_tasks = mysqli_query($mysqli, "SELECT task_completed_at, task_completion_estimate, task_id, task_name FROM tasks WHERE task_ticket_id = $ticket_id ORDER BY task_order ASC, task_id ASC");
         $task_count = mysqli_num_rows($sql_tasks);
 
         $completed_task_count = intval(mysqli_fetch_row(mysqli_query(
diff --git a/agent/tickets.php b/agent/tickets.php
index a298627c4..9ef5438f8 100644
--- a/agent/tickets.php
+++ b/agent/tickets.php
@@ -247,11 +247,8 @@ if ($q !== '') {
     $active_filters[] = array('label' => 'Search', 'value' => stripslashes(escapeHtml($q)), 'drop' => 'q');
 }
 
-// Ticket client access overide - This is the only way to show tickets without a client to agents with restricted client access
-$access_permission_query_overide = '';
-if ($client_access_string) {
-    $access_permission_query_overide = "AND ticket_client_id IN (0,$client_access_string)";
-}
+// Tickets with no client stay visible to restricted agents - clientScopeSql() includes 0
+$access_permission_query_overide = clientScopeSql('ticket_client_id');
 
 /*
  * Columns the two views need. Explicit rather than SELECT * - the tickets
diff --git a/agent/transactions.php b/agent/transactions.php
index 8218257fe..f2f12f4bc 100644
--- a/agent/transactions.php
+++ b/agent/transactions.php
@@ -86,7 +86,7 @@ if ($sort == 'transaction_date') {
 if ($account_filter) {
 
     // Account details - opening balance feeds the running balance, currency feeds the summary
-    $row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT * FROM accounts WHERE account_id = $account_filter LIMIT 1"));
+    $row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT account_currency_code, opening_balance FROM accounts WHERE account_id = $account_filter LIMIT 1"));
     $account_currency_code = escapeHtml($row['account_currency_code']);
     $account_opening_balance = floatval($row['opening_balance']);
 
diff --git a/agent/transfers.php b/agent/transfers.php
index 6df181a35..409c1c88e 100644
--- a/agent/transfers.php
+++ b/agent/transfers.php
@@ -182,7 +182,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                         $expense_id = intval($row['transfer_expense_id']);
                         $revenue_id = intval($row['transfer_revenue_id']);
 
-                        $sql_from = mysqli_query($mysqli, "SELECT * FROM accounts WHERE account_id = $transfer_account_from");
+                        $sql_from = mysqli_query($mysqli, "SELECT account_archived_at, account_name FROM accounts WHERE account_id = $transfer_account_from");
                         $row = mysqli_fetch_assoc($sql_from);
                         $account_name_from = escapeHtml($row['account_name']);
                         $account_from_archived_at = escapeHtml($row['account_archived_at']);
@@ -192,7 +192,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                             $account_from_archived_display = "Archived - ";
                         }
 
-                        $sql_to = mysqli_query($mysqli, "SELECT * FROM accounts WHERE account_id = $transfer_account_to");
+                        $sql_to = mysqli_query($mysqli, "SELECT account_archived_at, account_name FROM accounts WHERE account_id = $transfer_account_to");
                         $row = mysqli_fetch_assoc($sql_to);
                         $account_name_to = escapeHtml($row['account_name']);
                         $account_to_archived_at = escapeHtml($row['account_archived_at']);
diff --git a/agent/trips.php b/agent/trips.php
index cd0458a3e..0cf4576f6 100644
--- a/agent/trips.php
+++ b/agent/trips.php
@@ -17,14 +17,15 @@ if (isset($_GET['client_id'])) {
 
 $sql = mysqli_query(
     $mysqli,
-    "SELECT SQL_CALC_FOUND_ROWS * FROM trips
+    "SELECT SQL_CALC_FOUND_ROWS client_id, client_name, round_trip, trip_archived_at, trip_created_at, trip_date,
+        trip_destination, trip_id, trip_miles, trip_purpose, trip_source, trip_user_id, user_name FROM trips
     LEFT JOIN clients ON trip_client_id = client_id
     LEFT JOIN users ON trip_user_id = user_id
     WHERE (trip_purpose LIKE '%$q%' OR trip_source LIKE '%$q%' OR trip_destination LIKE '%$q%' OR trip_miles LIKE '%$q%' OR client_name LIKE '%$q%' OR user_name LIKE '%$q%')
     AND DATE(trip_date) BETWEEN '$dtf' AND '$dtt'
     AND trip_archived_at IS NULL
     $client_query
-    $access_permission_query
+    " . clientScopeSql('trip_client_id') . "
     ORDER BY $sort $order LIMIT $record_from, $record_to"
 );
 
diff --git a/agent/user/user_activity.php b/agent/user/user_activity.php
index 642646ab4..0a842e54e 100644
--- a/agent/user/user_activity.php
+++ b/agent/user/user_activity.php
@@ -2,12 +2,12 @@
 require_once "includes/inc_all_user.php";
 
 
-$sql_recent_logins = mysqli_query($mysqli, "SELECT * FROM logs
+$sql_recent_logins = mysqli_query($mysqli, "SELECT log_created_at, log_id, log_ip, log_user_agent FROM logs
     WHERE log_type = 'Login' OR log_type = 'Login 2FA' AND log_action = 'Success' AND log_user_id = $session_user_id
     ORDER BY log_id DESC LIMIT 3"
 );
 
-$sql_recent_logs = mysqli_query($mysqli, "SELECT * FROM logs
+$sql_recent_logs = mysqli_query($mysqli, "SELECT log_action, log_created_at, log_description, log_id, log_type FROM logs
     WHERE log_user_id = $session_user_id AND log_type NOT LIKE 'Login'
     ORDER BY log_id DESC LIMIT 5"
 );
diff --git a/agent/user/user_security.php b/agent/user/user_security.php
index 96193a74f..b2e89bcac 100644
--- a/agent/user/user_security.php
+++ b/agent/user/user_security.php
@@ -2,7 +2,7 @@
 require_once "includes/inc_all_user.php";
 
 // User remember me tokens
-$sql_remember_tokens = mysqli_query($mysqli, "SELECT * FROM remember_tokens WHERE remember_token_user_id = $session_user_id");
+$sql_remember_tokens = mysqli_query($mysqli, "SELECT remember_token_created_at, remember_token_id FROM remember_tokens WHERE remember_token_user_id = $session_user_id");
 $remember_token_count = mysqli_num_rows($sql_remember_tokens);
 
 ?>
diff --git a/agent/vendors.php b/agent/vendors.php
index b8f2bd32b..71bb3ff6b 100644
--- a/agent/vendors.php
+++ b/agent/vendors.php
@@ -17,13 +17,16 @@ if (isset($_GET['client_id'])) {
 
 $sql = mysqli_query(
     $mysqli,
-    "SELECT SQL_CALC_FOUND_ROWS * FROM vendors
+    "SELECT SQL_CALC_FOUND_ROWS vendor_account_number, vendor_archived_at, vendor_code, vendor_contact_name,
+        vendor_created_at, vendor_description, vendor_email, vendor_extension, vendor_hours,
+        vendor_id, vendor_name, vendor_notes, vendor_phone, vendor_phone_country_code, vendor_sla,
+        vendor_templates.vendor_template_id, vendor_template_name, vendor_website FROM vendors
     LEFT JOIN clients ON client_id = vendor_client_id
     LEFT JOIN vendor_templates ON vendors.vendor_template_id = vendor_templates.vendor_template_id
     WHERE vendor_$archive_query
     AND (vendor_name LIKE '%$q%' OR vendor_description LIKE '%$q%' OR vendor_account_number LIKE '%$q%' OR vendor_website LIKE '%$q%' OR vendor_contact_name LIKE '%$q%' OR vendor_email LIKE '%$q%' OR vendor_phone LIKE '%$phone_query%')
     $client_query
-    $access_permission_query
+    " . clientScopeSql('vendor_client_id') . "
     ORDER BY $sort $order LIMIT $record_from, $record_to"
 );
 
diff --git a/api/v1/assets/delete.php b/api/v1/assets/delete.php
index 871e53c5f..e87e9caf0 100644
--- a/api/v1/assets/delete.php
+++ b/api/v1/assets/delete.php
@@ -12,7 +12,7 @@ $asset_id = intval($_POST['asset_id']);
 $delete_count = false;
 
 if (!empty($asset_id)) {
-    $row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT * FROM assets WHERE asset_id = $asset_id AND asset_client_id = $client_id LIMIT 1"));
+    $row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT asset_name FROM assets WHERE asset_id = $asset_id AND asset_client_id = $client_id LIMIT 1"));
     $asset_name = $row['asset_name'];
 
     $delete_sql = mysqli_query($mysqli, "DELETE FROM assets WHERE asset_id = $asset_id AND asset_client_id = $client_id LIMIT 1");
diff --git a/api/v1/assets/update.php b/api/v1/assets/update.php
index db90b3e52..58e15684b 100644
--- a/api/v1/assets/update.php
+++ b/api/v1/assets/update.php
@@ -21,7 +21,7 @@ if (!empty($asset_id)) {
     $update_sql = mysqli_query($mysqli, "UPDATE assets SET asset_name = '$name', asset_description = '$description', asset_type = '$type', asset_make = '$make', asset_model = '$model', asset_serial = '$serial', asset_os = '$os', asset_uri = '$uri', asset_uri_2 = '$uri_2', asset_status = '$status', asset_location_id = $location, asset_vendor_id = $vendor, asset_contact_id = $contact, asset_purchase_date = $purchase_date, asset_warranty_expire = $warranty_expire, asset_install_date = $install_date, asset_notes = '$notes' WHERE asset_id = $asset_id AND asset_client_id = $client_id LIMIT 1");
 
     // Check insert & get insert ID
-    if ($update_sql) {
+    if ($update_sql && $asset_row) {
         $update_count = mysqli_affected_rows($mysqli);
 
         // Update Primary Interface
diff --git a/api/v1/clients/archive.php b/api/v1/clients/archive.php
index 64a248a8c..818043c92 100644
--- a/api/v1/clients/archive.php
+++ b/api/v1/clients/archive.php
@@ -21,7 +21,7 @@ if (!empty($client_id)) {
         $client_name = escapeSql($row['client_name']);
 
         // Stop recurring invoices
-        $sql_recurring_invoices = mysqli_query($mysqli, "SELECT * FROM recurring_invoices WHERE recurring_invoice_client_id = $client_id AND recurring_invoice_status = 1");
+        $sql_recurring_invoices = mysqli_query($mysqli, "SELECT recurring_invoice_id FROM recurring_invoices WHERE recurring_invoice_client_id = $client_id AND recurring_invoice_status = 1");
         while ($row = mysqli_fetch_assoc($sql_recurring_invoices)) {
             $recurring_invoice_id = intval($row['recurring_invoice_id']);
             mysqli_query($mysqli,"UPDATE recurring_invoices SET recurring_invoice_status = 0 WHERE recurring_invoice_id = $recurring_invoice_id AND recurring_invoice_client_id = $client_id");
diff --git a/api/v1/contacts/create.php b/api/v1/contacts/create.php
index 3079b7cc0..34b0a6b92 100644
--- a/api/v1/contacts/create.php
+++ b/api/v1/contacts/create.php
@@ -15,7 +15,7 @@ $insert_id = false;
 if (!empty($name) && !empty($email) && !empty($client_id)) {
 
     // Check contact with $email doesn't already exist
-    $email_duplication_sql = mysqli_query($mysqli, "SELECT * FROM contacts WHERE contact_email = '$email' AND contact_client_id = '$client_id'");
+    $email_duplication_sql = mysqli_query($mysqli, "SELECT 1 FROM contacts WHERE contact_email = '$email' AND contact_client_id = '$client_id'");
 
     if (mysqli_num_rows($email_duplication_sql) == 0) {
 
diff --git a/api/v1/contacts/delete.php b/api/v1/contacts/delete.php
index 8066fdd33..3332e2234 100644
--- a/api/v1/contacts/delete.php
+++ b/api/v1/contacts/delete.php
@@ -12,7 +12,7 @@ $contact_id = intval($_POST['contact_id']);
 $delete_count = false;
 
 if (!empty($contact_id)) {
-    $row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT * FROM contacts WHERE contact_id = $contact_id AND contact_client_id = $client_id LIMIT 1"));
+    $row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT contact_name FROM contacts WHERE contact_id = $contact_id AND contact_client_id = $client_id LIMIT 1"));
     $contact_name = $row['contact_name'];
 
     $delete_sql = mysqli_query($mysqli, "DELETE FROM contacts WHERE contact_id = $contact_id AND contact_client_id = $client_id LIMIT 1");
diff --git a/api/v1/contacts/update.php b/api/v1/contacts/update.php
index c21ba9c5e..3dd27a693 100644
--- a/api/v1/contacts/update.php
+++ b/api/v1/contacts/update.php
@@ -23,7 +23,7 @@ if (!empty($contact_id)) {
         mysqli_query($mysqli,"UPDATE contacts SET contact_primary = 0 WHERE contact_client_id = $client_id");
     }
 
-    $update_sql = mysqli_query($mysqli, "UPDATE contacts SET contact_name = '$name', contact_title = '$title', contact_department = '$department', contact_email = '$email', contact_phone = '$phone', contact_extension = '$extension', contact_mobile = '$mobile',  contact_notes = '$notes', contact_primary = '$primary', contact_important = '$important', contact_billing = '$billing', contact_technical = '$technical', contact_location_id = $location_id, contact_client_id = $client_id WHERE contact_id = $contact_id LIMIT 1");
+    $update_sql = mysqli_query($mysqli, "UPDATE contacts SET contact_name = '$name', contact_title = '$title', contact_department = '$department', contact_email = '$email', contact_phone = '$phone', contact_extension = '$extension', contact_mobile = '$mobile',  contact_notes = '$notes', contact_primary = '$primary', contact_important = '$important', contact_billing = '$billing', contact_technical = '$technical', contact_location_id = $location_id, contact_client_id = $client_id WHERE contact_id = $contact_id AND contact_client_id = $client_id LIMIT 1");
 
     // Check insert & get insert ID
     if ($update_sql) {
diff --git a/api/v1/credentials/read.php b/api/v1/credentials/read.php
index 584f6d8e9..01ee1ce2e 100644
--- a/api/v1/credentials/read.php
+++ b/api/v1/credentials/read.php
@@ -25,7 +25,7 @@ if (isset($_GET['credential_id']) && !empty($api_key_decrypt_password)) {
 } elseif (!empty($api_key_decrypt_password)) {
     // All credentials ("credentials")
 
-    $sql = mysqli_query($mysqli, "SELECT * FROM credentials WHERE 1=1 " . apiClientScopeSql('credential_client_id') . " ORDER BY credential_id LIMIT $limit OFFSET $offset");
+    $sql = mysqli_query($mysqli, "SELECT credential_password, credential_username FROM credentials WHERE 1=1 " . apiClientScopeSql('credential_client_id') . " ORDER BY credential_id LIMIT $limit OFFSET $offset");
 
 }
 
diff --git a/api/v1/credentials/update.php b/api/v1/credentials/update.php
index 049a02f07..a800253cb 100644
--- a/api/v1/credentials/update.php
+++ b/api/v1/credentials/update.php
@@ -20,7 +20,7 @@ if (!empty($_POST['api_key_decrypt_password']) && !empty($credential_id)) {
     $update_sql = mysqli_query($mysqli,"UPDATE credentials SET credential_name = '$name', credential_description = '$description', credential_uri = '$uri', credential_uri_2 = '$uri_2', credential_username = '$username', credential_password = '$password', credential_otp_secret = '$otp_secret', credential_note = '$note', credential_favorite = $favorite, credential_contact_id = $contact_id, credential_asset_id = $asset_id, credential_client_id = $client_id WHERE credential_id = '$credential_id' AND credential_client_id = $client_id LIMIT 1");
 
     // Check insert & get insert ID
-    if ($update_sql) {
+    if ($update_sql && $credential_row) {
         $update_count = mysqli_affected_rows($mysqli);
 
         if ($password_changed) {
diff --git a/api/v1/documents/update.php b/api/v1/documents/update.php
index 166a02128..8c845e8a4 100644
--- a/api/v1/documents/update.php
+++ b/api/v1/documents/update.php
@@ -14,7 +14,8 @@ if (!empty($document_id)) {
     // 1) Load the current document (scoped to this client)
     $sql_original_document = mysqli_query(
         $mysqli,
-        "SELECT * FROM documents
+        "SELECT document_content, document_created_at, document_created_by, document_description,
+            document_name, document_updated_at, document_updated_by FROM documents
          WHERE document_client_id = $client_id
            AND document_id = $document_id
          LIMIT 1"
diff --git a/api/v1/enforce_api_rbac.php b/api/v1/enforce_api_rbac.php
index c36ac9e3c..ef2b5b01f 100644
--- a/api/v1/enforce_api_rbac.php
+++ b/api/v1/enforce_api_rbac.php
@@ -45,24 +45,10 @@ function apiUserCanAccessClient($client_id) {
 }
 
 // Client-scope SQL fragment for a read query, from the user's allow / deny lists.
-// Admin and unrestricted users get no restriction. Column-aware, so it works on any
-// resource. Returns " AND ..." or "" (used after a "WHERE 1=1" anchor).
+// Thin wrapper over clientScopeSql() in functions/auth.php so the API and the UI share one
+// implementation. Kept under the api* name because every endpoint already calls it.
 function apiClientScopeSql($column) {
-    global $session_is_admin, $client_access_array, $client_deny_array;
-    if ($session_is_admin) {
-        return '';
-    }
-    if (empty($client_access_array) && empty($client_deny_array)) {
-        return ''; // unrestricted user - all clients
-    }
-    $sql = '';
-    if (!empty($client_access_array)) {
-        $sql .= " AND $column IN (" . implode(',', array_map('intval', $client_access_array)) . ")";
-    }
-    if (!empty($client_deny_array)) {
-        $sql .= " AND $column NOT IN (" . implode(',', array_map('intval', $client_deny_array)) . ")";
-    }
-    return $sql;
+    return clientScopeSql($column);
 }
 
 // --- Every key must be tied to a user (legacy keys were removed in the 2.4.7 migration) ---
diff --git a/api/v1/expenses/read.php b/api/v1/expenses/read.php
index ddcd47c77..3bbb05779 100644
--- a/api/v1/expenses/read.php
+++ b/api/v1/expenses/read.php
@@ -5,18 +5,16 @@ require_once '../validate_api_key.php';
 require_once '../require_get_method.php';
 
 
-// Expenses aren't client-scoped; access is gated by module_financial in enforce_api_rbac.php
-
 if (isset($_GET['expense_id'])) {
     // Expense via ID (single)
 
     $id = intval($_GET['expense_id']);
-    $sql = mysqli_query($mysqli, "SELECT * FROM expenses WHERE expense_id = '$id'");
+    $sql = mysqli_query($mysqli, "SELECT * FROM expenses WHERE expense_id = '$id' AND 1=1 " . apiClientScopeSql('expense_client_id') . "");
 
 } else {
     // All expenses
 
-    $sql = mysqli_query($mysqli, "SELECT * FROM expenses ORDER BY expense_id LIMIT $limit OFFSET $offset");
+    $sql = mysqli_query($mysqli, "SELECT * FROM expenses WHERE 1=1 " . apiClientScopeSql('expense_client_id') . " ORDER BY expense_id LIMIT $limit OFFSET $offset");
 }
 
 // Output
diff --git a/api/v1/ticket_replies/create.php b/api/v1/ticket_replies/create.php
index 009443acf..27a9b5e96 100644
--- a/api/v1/ticket_replies/create.php
+++ b/api/v1/ticket_replies/create.php
@@ -70,6 +70,7 @@ if (!empty($ticket_id) && !empty($reply)) {
         $ticket_url_key = escapeSql($ticket_row['ticket_url_key']);
         $ticket_first_response_at = escapeSql($ticket_row['ticket_first_response_at']);
         $client_id = intval($ticket_row['ticket_client_id']);
+        $original_ticket_status = intval($ticket_row['ticket_status']);
 
         // Mark first response time if required - internal notes don't count as a response
         if (empty($ticket_first_response_at) && $reply_type == 'Public') {
@@ -87,11 +88,15 @@ if (!empty($ticket_id) && !empty($reply)) {
             if (!empty($reply_ticket_status)) {
                 mysqli_query($mysqli, "UPDATE tickets SET ticket_status = $reply_ticket_status WHERE ticket_id = $ticket_id LIMIT 1");
 
-                $new_status_name = escapeSql(getTicketStatusName($reply_ticket_status));
-                logTicketHistory($ticket_id, "Status set to $new_status_name via the API ($api_key_name)");
+                // Only record a status change when the status actually changed -
+                // Resolved is left out because the resolve block below logs it
+                if ($reply_ticket_status !== $original_ticket_status && $reply_ticket_status != 4) {
+                    $new_status_name = escapeSql(getTicketStatusName($reply_ticket_status));
+                    logTicketHistory($ticket_id, "Status set to $new_status_name via the API ($api_key_name)");
+                }
 
-                // Resolve the ticket, if set
-                if ($reply_ticket_status == 4) {
+                // Resolve the ticket, if it is actually moving into Resolved
+                if ($reply_ticket_status == 4 && $original_ticket_status != 4) {
                     mysqli_query($mysqli, "UPDATE tickets SET ticket_resolved_at = NOW() WHERE ticket_id = $ticket_id AND ticket_resolved_at IS NULL LIMIT 1");
                     setTicketResolutionSlaMet($ticket_id);
 
diff --git a/api/v1/tickets/resolve.php b/api/v1/tickets/resolve.php
index 3790f0ec8..31be07310 100644
--- a/api/v1/tickets/resolve.php
+++ b/api/v1/tickets/resolve.php
@@ -15,7 +15,7 @@ $update_count = false;
 
 if (!empty($ticket_id)) {
 
-    $ticket_row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT * FROM tickets WHERE ticket_id = '$ticket_id' AND ticket_resolved_at IS NULL AND ticket_client_id = $client_id LIMIT 1"));
+    $ticket_row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT ticket_first_response_at, ticket_id, ticket_number, ticket_prefix FROM tickets WHERE ticket_id = '$ticket_id' AND ticket_resolved_at IS NULL AND ticket_client_id = $client_id LIMIT 1"));
 
     // Grab what we need, not using the model
     $ticket_id = intval($ticket_row['ticket_id']); // Override so things fail if this is bad
diff --git a/api/v1/validate_api_key.php b/api/v1/validate_api_key.php
index 2404bc8c5..98084ae88 100644
--- a/api/v1/validate_api_key.php
+++ b/api/v1/validate_api_key.php
@@ -70,7 +70,7 @@ if (isset($_POST['api_key'])) {
 if (isset($api_key)) {
     $api_key = escapeSql($api_key);
 
-    $sql = mysqli_query($mysqli, "SELECT * FROM api_keys WHERE api_key_secret = '$api_key' AND api_key_expire > NOW() LIMIT 1");
+    $sql = mysqli_query($mysqli, "SELECT api_key_decrypt_hash, api_key_name, api_key_user_id FROM api_keys WHERE api_key_secret = '$api_key' AND api_key_expire > NOW() LIMIT 1");
 
     // Failed
     if (mysqli_num_rows($sql) !== 1) {
diff --git a/client/assets.php b/client/assets.php
index 4caa26b69..061d20171 100644
--- a/client/assets.php
+++ b/client/assets.php
@@ -10,7 +10,9 @@ require_once "includes/inc_all.php";
 
 enforceContactCan('itdoc');
 
-$assets_sql = mysqli_query($mysqli, "SELECT * FROM assets LEFT JOIN contacts ON asset_contact_id = contact_id WHERE asset_client_id = $session_client_id AND asset_archived_at IS NULL ORDER BY asset_type ASC, asset_name ASC");
+$assets_sql = mysqli_query($mysqli, "SELECT asset_description, asset_id, asset_make, asset_model, asset_name, asset_purchase_date,
+    asset_serial, asset_status, asset_type, asset_uri_client, asset_warranty_expire,
+    contact_name FROM assets LEFT JOIN contacts ON asset_contact_id = contact_id WHERE asset_client_id = $session_client_id AND asset_archived_at IS NULL ORDER BY asset_type ASC, asset_name ASC");
 ?>
 
     <div class="row">
diff --git a/client/includes/check_login.php b/client/includes/check_login.php
index 25fb5af86..223ab841c 100644
--- a/client/includes/check_login.php
+++ b/client/includes/check_login.php
@@ -25,7 +25,7 @@ $session_contact_id = intval($_SESSION['contact_id']);
 $session_user_id = intval($_SESSION['user_id']);
 
 // Load user session vars
-$sql = mysqli_query($mysqli, "SELECT * FROM users WHERE users.user_id = $session_user_id");
+$sql = mysqli_query($mysqli, "SELECT user_archived_at, user_avatar, user_status, user_type FROM users WHERE users.user_id = $session_user_id");
 
 $row = mysqli_fetch_assoc($sql);
 
@@ -56,7 +56,7 @@ if ($session_user_archived_at !== null) {
 }
 
 // Load company session vars
-$sql = mysqli_query($mysqli, "SELECT * FROM companies WHERE company_id = 1");
+$sql = mysqli_query($mysqli, "SELECT company_country, company_currency, company_locale, company_logo, company_name FROM companies WHERE company_id = 1");
 $row = mysqli_fetch_assoc($sql);
 
 $session_company_name = $row['company_name'];
@@ -67,7 +67,8 @@ $currency_format = numfmt_create($session_company_locale, NumberFormatter::CURRE
 $session_company_logo = $row['company_logo'];
 
 // Load contact session vars
-$contact_sql = mysqli_query($mysqli, "SELECT * FROM contacts WHERE contact_id = $session_contact_id AND contact_client_id = $session_client_id");
+$contact_sql = mysqli_query($mysqli, "SELECT contact_billing, contact_email, contact_name, contact_photo, contact_pin, contact_primary,
+    contact_technical, contact_title FROM contacts WHERE contact_id = $session_contact_id AND contact_client_id = $session_client_id");
 $contact = mysqli_fetch_assoc($contact_sql);
 
 $session_contact_name = escapeSql($contact['contact_name']);
@@ -88,7 +89,7 @@ if ($contact['contact_billing'] == 1) {
 }
 
 // Load client session vars
-$client_sql = mysqli_query($mysqli, "SELECT * FROM clients WHERE client_id = $session_client_id");
+$client_sql = mysqli_query($mysqli, "SELECT client_name FROM clients WHERE client_id = $session_client_id");
 $client = mysqli_fetch_assoc($client_sql);
 
 $session_client_name = $client['client_name'];
diff --git a/client/includes/header.php b/client/includes/header.php
index 93d6851be..408faa996 100644
--- a/client/includes/header.php
+++ b/client/includes/header.php
@@ -80,7 +80,7 @@ header("X-Frame-Options: DENY"); // Legacy
                 <?php } ?>
 
                 <?php
-                $sql_custom_links = mysqli_query($mysqli, "SELECT * FROM custom_links WHERE custom_link_location = 3 AND custom_link_archived_at IS NULL
+                $sql_custom_links = mysqli_query($mysqli, "SELECT custom_link_name, custom_link_new_tab, custom_link_uri FROM custom_links WHERE custom_link_location = 3 AND custom_link_archived_at IS NULL
                     ORDER BY custom_link_order ASC, custom_link_name ASC"
                 );
 
diff --git a/client/index.php b/client/index.php
index a310ad7cb..1ad42701f 100644
--- a/client/index.php
+++ b/client/index.php
@@ -42,7 +42,7 @@ $recurring_monthly = $recurring_monthly_total + $recurring_yearly_total;
 // Get Domains Expiring
 $sql_domains_expiring = mysqli_query(
     $mysqli,
-    "SELECT * FROM domains
+    "SELECT domain_expire, domain_id, domain_name FROM domains
     WHERE domain_client_id = $session_client_id
         AND domain_expire IS NOT NULL
         AND domain_archived_at IS NULL
@@ -161,7 +161,7 @@ $sql_asset_retired = mysqli_query(
 // Assigned Assets
 $sql_assigned_assets = mysqli_query(
     $mysqli,
-    "SELECT * FROM assets
+    "SELECT asset_name, asset_type, asset_uri_client FROM assets
     WHERE asset_contact_id = $session_contact_id
         AND asset_archived_at IS NULL
     ORDER BY asset_name ASC"
diff --git a/client/invoices.php b/client/invoices.php
index 0bd75b14a..bb63b43df 100644
--- a/client/invoices.php
+++ b/client/invoices.php
@@ -11,7 +11,8 @@ require_once "includes/inc_all.php";
 
 enforceContactCan('accounting');
 
-$invoices_sql = mysqli_query($mysqli, "SELECT * FROM invoices WHERE invoice_client_id = $session_client_id AND invoice_status != 'Draft' ORDER BY invoice_date DESC");
+$invoices_sql = mysqli_query($mysqli, "SELECT invoice_amount, invoice_date, invoice_due, invoice_id, invoice_number, invoice_prefix,
+    invoice_scope, invoice_status, invoice_url_key FROM invoices WHERE invoice_client_id = $session_client_id AND invoice_status != 'Draft' ORDER BY invoice_date DESC");
 ?>
 
 <h3>Invoices</h3>
diff --git a/client/login_microsoft.php b/client/login_microsoft.php
index 2c603b608..5a4179b86 100644
--- a/client/login_microsoft.php
+++ b/client/login_microsoft.php
@@ -126,7 +126,7 @@ if (isset($_GET['code']) || isset($_GET['error'])) {
 
             $upn = mysqli_real_escape_string($mysqli, $msgraph_response["userPrincipalName"]);
 
-            $sql = mysqli_query($mysqli, "SELECT * FROM users
+            $sql = mysqli_query($mysqli, "SELECT contact_client_id, contact_id, user_auth_method, user_email, user_id FROM users
                 LEFT JOIN contacts ON user_id = contact_user_id
                 LEFT JOIN clients ON contact_client_id = client_id
                 WHERE user_email = '$upn'
diff --git a/client/login_reset.php b/client/login_reset.php
index 584fd105a..18bdbac9a 100644
--- a/client/login_reset.php
+++ b/client/login_reset.php
@@ -109,7 +109,7 @@ if ($_SERVER['REQUEST_METHOD'] == "POST") {
         $client = intval($_POST['client']);
 
         // Query user
-        $sql = mysqli_query($mysqli, "SELECT * FROM users LEFT JOIN contacts ON user_id = contact_user_id WHERE user_email = '$email' AND user_password_reset_token = '$token' AND contact_client_id = $client AND user_auth_method = 'local' AND user_type = 2 AND user_status = 1 AND user_archived_at IS NULL LIMIT 1");
+        $sql = mysqli_query($mysqli, "SELECT contact_id, contact_name, user_id, user_password_reset_token FROM users LEFT JOIN contacts ON user_id = contact_user_id WHERE user_email = '$email' AND user_password_reset_token = '$token' AND contact_client_id = $client AND user_auth_method = 'local' AND user_type = 2 AND user_status = 1 AND user_archived_at IS NULL LIMIT 1");
         $user_row = mysqli_fetch_assoc($sql);
         $contact_id = intval($user_row['contact_id']);
         $user_id = intval($user_row['user_id']);
@@ -207,7 +207,7 @@ if ($_SERVER['REQUEST_METHOD'] == "POST") {
                     $email = escapeSql($_GET['email']);
                     $client = intval($_GET['client']);
 
-                    $sql = mysqli_query($mysqli, "SELECT * FROM users LEFT JOIN contacts ON user_id = contact_user_id WHERE user_email = '$email' AND user_password_reset_token = '$token' AND contact_client_id = $client LIMIT 1");
+                    $sql = mysqli_query($mysqli, "SELECT user_password_reset_token FROM users LEFT JOIN contacts ON user_id = contact_user_id WHERE user_email = '$email' AND user_password_reset_token = '$token' AND contact_client_id = $client LIMIT 1");
                     $user_row = mysqli_fetch_assoc($sql);
 
                     // Sanity check
diff --git a/client/post.php b/client/post.php
index 3b333d7bd..d824709d6 100644
--- a/client/post.php
+++ b/client/post.php
@@ -105,13 +105,20 @@ if (isset($_POST['add_ticket_comment'])) {
         $ticket_reply_id = mysqli_insert_id($mysqli);
 
         // Update Ticket Last Response Field & set ticket to open as client has replied
+        $original_row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT ticket_status FROM tickets WHERE ticket_id = $ticket_id LIMIT 1"));
+        $original_ticket_status = intval($original_row['ticket_status'] ?? 0);
+
         mysqli_query($mysqli, "UPDATE tickets SET ticket_status = 2 WHERE ticket_id = $ticket_id AND ticket_client_id = $session_client_id LIMIT 1");
         syncTicketSlaClock($ticket_id);
-        logTicketHistory($ticket_id, "$session_contact_name replied from the client portal, reopening the ticket");
+
+        // Only record the reopen when the ticket was not already open
+        if ($original_ticket_status !== 2) {
+            logTicketHistory($ticket_id, "$session_contact_name replied from the client portal, reopening the ticket");
+        }
 
 
         // Get ticket details &  Notify the assigned tech (if any)
-        $ticket_details = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT * FROM tickets LEFT JOIN clients ON ticket_client_id = client_id WHERE ticket_id = $ticket_id LIMIT 1"));
+        $ticket_details = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT client_name, ticket_assigned_to, ticket_number, ticket_subject FROM tickets LEFT JOIN clients ON ticket_client_id = client_id WHERE ticket_id = $ticket_id LIMIT 1"));
 
         $ticket_number = intval($ticket_details['ticket_number']);
         $ticket_assigned_to = intval($ticket_details['ticket_assigned_to']);
@@ -166,7 +173,8 @@ if (isset($_GET['approve_ticket_task'])) {
     $approval_id = intval($_GET['approval_id']);
     $url_key = escapeSql($_GET['approval_url_key']);
 
-    $approval_row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT * FROM task_approvals LEFT JOIN tasks on task_id = approval_task_id WHERE approval_id = $approval_id AND approval_task_id = $task_id AND approval_url_key = '$url_key' AND approval_status = 'pending' AND approval_scope = 'client'"));
+    $approval_row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT approval_created_by, approval_required_user_id, approval_scope, approval_type, task_name,
+        task_ticket_id FROM task_approvals LEFT JOIN tasks on task_id = approval_task_id WHERE approval_id = $approval_id AND approval_task_id = $task_id AND approval_url_key = '$url_key' AND approval_status = 'pending' AND approval_scope = 'client'"));
 
     $task_name = escapeHtml($approval_row['task_name']);
     $scope = escapeHtml($approval_row['approval_scope']);
@@ -236,7 +244,7 @@ if (isset($_GET['resolve_ticket'])) {
     $ticket_id = intval($_GET['resolve_ticket']);
 
     // Get ticket details for logging
-    $row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT * FROM tickets WHERE ticket_id = $ticket_id LIMIT 1"));
+    $row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT ticket_number, ticket_prefix FROM tickets WHERE ticket_id = $ticket_id LIMIT 1"));
 
     $ticket_prefix = escapeSql($row['ticket_prefix']);
     $ticket_number = intval($row['ticket_number']);
@@ -274,7 +282,7 @@ if (isset($_GET['reopen_ticket'])) {
     $ticket_id = intval($_GET['reopen_ticket']);
 
     // Get ticket details for logging
-    $row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT * FROM tickets WHERE ticket_id = $ticket_id LIMIT 1"));
+    $row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT ticket_number, ticket_prefix FROM tickets WHERE ticket_id = $ticket_id LIMIT 1"));
 
     $ticket_prefix = escapeSql($row['ticket_prefix']);
     $ticket_number = intval($row['ticket_number']);
@@ -312,7 +320,7 @@ if (isset($_GET['close_ticket'])) {
     $ticket_id = intval($_GET['close_ticket']);
 
     // Get ticket details for logging
-    $row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT * FROM tickets WHERE ticket_id = $ticket_id LIMIT 1"));
+    $row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT ticket_number, ticket_prefix FROM tickets WHERE ticket_id = $ticket_id LIMIT 1"));
 
     $ticket_prefix = escapeSql($row['ticket_prefix']);
     $ticket_number = intval($row['ticket_number']);
@@ -481,7 +489,10 @@ if (isset($_GET['add_payment_by_provider'])) {
     $saved_payment_id = intval($_GET['add_payment_by_provider']);
 
     // Get invoice details
-    $sql = mysqli_query($mysqli,"SELECT * FROM invoices
+    $sql = mysqli_query($mysqli,"SELECT client_id, client_name, contact_email, contact_extension, contact_mobile,
+        contact_mobile_country_code, contact_name, contact_phone, contact_phone_country_code,
+        invoice_amount, invoice_currency_code, invoice_number, invoice_prefix, invoice_status,
+        invoice_url_key FROM invoices
             LEFT JOIN clients ON invoice_client_id = client_id
             LEFT JOIN contacts ON client_id = contact_client_id AND contact_primary = 1
             WHERE invoice_id = $invoice_id AND client_id = $session_client_id"
@@ -503,7 +514,8 @@ if (isset($_GET['add_payment_by_provider'])) {
     $contact_mobile = escapeSql(formatPhoneNumber($row['contact_mobile'], $row['contact_mobile_country_code']));
 
     // Get ITFlow company details
-    $sql = mysqli_query($mysqli,"SELECT * FROM companies WHERE company_id = 1");
+    $sql = mysqli_query($mysqli,"SELECT company_address, company_city, company_country, company_email, company_name, company_phone,
+        company_phone_country_code, company_state, company_website, company_zip FROM companies WHERE company_id = 1");
     $row = mysqli_fetch_assoc($sql);
     $company_name = escapeSql($row['company_name']);
     $company_country = escapeSql($row['company_country']);
@@ -520,7 +532,9 @@ if (isset($_GET['add_payment_by_provider'])) {
     $config_invoice_from_email = escapeSql($config_invoice_from_email);
 
     // Get Client Payment Details
-    $sql = mysqli_query($mysqli, "SELECT * FROM client_saved_payment_methods LEFT JOIN payment_providers ON saved_payment_provider_id = payment_provider_id LEFT JOIN client_payment_provider ON saved_payment_client_id = client_id WHERE saved_payment_id = $saved_payment_id AND saved_payment_client_id = $session_client_id LIMIT 1");
+    $sql = mysqli_query($mysqli, "SELECT payment_provider_account, payment_provider_client, payment_provider_private_key,
+        payment_provider_public_key, saved_payment_client_id, saved_payment_description,
+        saved_payment_provider_method FROM client_saved_payment_methods LEFT JOIN payment_providers ON saved_payment_provider_id = payment_provider_id LEFT JOIN client_payment_provider ON saved_payment_client_id = client_id WHERE saved_payment_id = $saved_payment_id AND saved_payment_client_id = $session_client_id LIMIT 1");
     $row = mysqli_fetch_assoc($sql);
 
     $public_key = escapeSql($row['payment_provider_public_key']);
@@ -671,7 +685,7 @@ if (isset($_POST['create_stripe_customer'])) {
 
     // Get Stripe provider
     $stripe_provider_result = mysqli_query($mysqli, "
-        SELECT * FROM payment_providers
+        SELECT payment_provider_id, payment_provider_private_key FROM payment_providers
         WHERE payment_provider_name = 'Stripe'
         AND payment_provider_active = 1
         LIMIT 1
@@ -759,7 +773,7 @@ if (isset($_GET['create_stripe_checkout'])) {
 
     // Fetch Stripe provider info
     $stripe_provider_result = mysqli_query($mysqli, "
-        SELECT * FROM payment_providers
+        SELECT payment_provider_id, payment_provider_private_key FROM payment_providers
         WHERE payment_provider_name = 'Stripe'
         AND payment_provider_active = 1
         LIMIT 1
@@ -842,7 +856,7 @@ if (isset($_GET['stripe_save_card'])) {
 
     // Get Stripe provider
     $stripe_provider_result = mysqli_query($mysqli, "
-        SELECT * FROM payment_providers
+        SELECT payment_provider_id, payment_provider_private_key FROM payment_providers
         WHERE payment_provider_name = 'Stripe'
         AND payment_provider_active = 1
         LIMIT 1
@@ -925,7 +939,8 @@ if (isset($_GET['stripe_save_card'])) {
 
     // Email Confirmation
     $sql_settings = mysqli_query($mysqli, "
-        SELECT * FROM companies, settings
+        SELECT company_name, company_phone, company_phone_country_code, config_invoice_from_email,
+            config_invoice_from_name, config_smtp_host FROM companies, settings
         WHERE companies.company_id = settings.company_id
         AND companies.company_id = 1
     ");
@@ -973,7 +988,7 @@ if (isset($_GET['delete_saved_payment'])) {
 
     // Get Stripe provider info
     $stripe_provider_result = mysqli_query($mysqli, "
-        SELECT * FROM payment_providers
+        SELECT payment_provider_id, payment_provider_private_key FROM payment_providers
         WHERE payment_provider_name = 'Stripe'
         AND payment_provider_active = 1
         LIMIT 1
@@ -1073,7 +1088,8 @@ if (isset($_POST['set_recurring_payment'])) {
     $saved_payment_id = intval($_POST['saved_payment_id']);
 
     // Get Recurring Invoice Info for logging and alerting
-    $sql = mysqli_query($mysqli, "SELECT * FROM recurring_invoices WHERE recurring_invoice_id = $recurring_invoice_id AND recurring_invoice_client_id = $session_client_id");
+    $sql = mysqli_query($mysqli, "SELECT recurring_invoice_amount, recurring_invoice_currency_code, recurring_invoice_number,
+        recurring_invoice_prefix FROM recurring_invoices WHERE recurring_invoice_id = $recurring_invoice_id AND recurring_invoice_client_id = $session_client_id");
     $row = mysqli_fetch_assoc($sql);
     $recurring_invoice_prefix = escapeSql($row['recurring_invoice_prefix']);
     $recurring_invoice_number = intval($row['recurring_invoice_number']);
@@ -1084,7 +1100,8 @@ if (isset($_POST['set_recurring_payment'])) {
 
         // Get Payment provider and method
         $sql = mysqli_query($mysqli, "
-            SELECT * FROM payment_providers
+            SELECT payment_provider_account, payment_provider_id, payment_provider_name,
+                saved_payment_description FROM payment_providers
             LEFT JOIN client_saved_payment_methods ON saved_payment_provider_id = payment_provider_id
             WHERE saved_payment_id = $saved_payment_id
             AND saved_payment_client_id = $session_client_id
diff --git a/client/quotes.php b/client/quotes.php
index 081da951f..b49a4efda 100644
--- a/client/quotes.php
+++ b/client/quotes.php
@@ -10,7 +10,8 @@ require_once "includes/inc_all.php";
 
 enforceContactCan('accounting');
 
-$quotes_sql = mysqli_query($mysqli, "SELECT * FROM quotes WHERE quote_client_id = $session_client_id AND quote_status != 'Draft' ORDER BY quote_date DESC");
+$quotes_sql = mysqli_query($mysqli, "SELECT quote_amount, quote_date, quote_id, quote_number, quote_prefix, quote_scope, quote_status,
+    quote_url_key FROM quotes WHERE quote_client_id = $session_client_id AND quote_status != 'Draft' ORDER BY quote_date DESC");
 ?>
 
 <h3>Quotes</h3>
diff --git a/client/recurring_invoices.php b/client/recurring_invoices.php
index bdec469ea..ffdfe38e9 100644
--- a/client/recurring_invoices.php
+++ b/client/recurring_invoices.php
@@ -11,7 +11,10 @@ require_once "includes/inc_all.php";
 
 enforceContactCan('accounting');
 
-$recurring_invoices_sql = mysqli_query($mysqli, "SELECT * FROM recurring_invoices
+$recurring_invoices_sql = mysqli_query($mysqli, "SELECT recurring_invoice_amount, recurring_invoice_frequency, recurring_invoice_id,
+    recurring_invoice_next_date, recurring_invoice_number, recurring_invoice_prefix,
+    recurring_invoice_scope, recurring_invoice_status, recurring_payment_id,
+    recurring_payment_recurring_invoice_id, recurring_payment_saved_payment_id FROM recurring_invoices
     LEFT JOIN recurring_payments ON recurring_payment_recurring_invoice_id = recurring_invoice_id
     WHERE recurring_invoice_client_id = $session_client_id
     AND recurring_invoice_status = 1
@@ -19,7 +22,7 @@ $recurring_invoices_sql = mysqli_query($mysqli, "SELECT * FROM recurring_invoice
 );
 
 // Get Payment Provide Details
-$payment_provider_sql = mysqli_query($mysqli, "SELECT * FROM payment_providers WHERE payment_provider_active = 1 LIMIT 1");
+$payment_provider_sql = mysqli_query($mysqli, "SELECT payment_provider_id, payment_provider_name, payment_provider_threshold FROM payment_providers WHERE payment_provider_active = 1 LIMIT 1");
 $row = mysqli_fetch_assoc($payment_provider_sql);
 $payment_provider_id = intval($row['payment_provider_id']);
 $payment_provider_name = escapeHtml($row['payment_provider_name']);
@@ -74,7 +77,7 @@ $payment_provider_threshold = floatval($row['payment_provider_threshold']);
                     <td><?= ucwords($recurring_invoice_frequency) ?>ly</td>
                     <?php if ($payment_provider_id) { ?>
                     <td>
-                        <?php $sql = mysqli_query($mysqli, "SELECT * FROM client_saved_payment_methods WHERE saved_payment_client_id = $session_client_id");
+                        <?php $sql = mysqli_query($mysqli, "SELECT saved_payment_description, saved_payment_id FROM client_saved_payment_methods WHERE saved_payment_client_id = $session_client_id");
                         if (mysqli_num_rows($sql) > 0) { ?>
                             <form class="form" action="post.php" method="post">
                                 <input type="hidden" name="csrf_token" value="<?= $_SESSION['csrf_token'] ?>">
diff --git a/client/saved_payment_methods.php b/client/saved_payment_methods.php
index 0f82c70e6..89b02c800 100644
--- a/client/saved_payment_methods.php
+++ b/client/saved_payment_methods.php
@@ -12,7 +12,7 @@ require_once '../includes/stripe_init.php';
 
 // Get Stripe provider info
 $stripe_provider_query = mysqli_query($mysqli, "
-    SELECT * FROM payment_providers WHERE payment_provider_name = 'Stripe' LIMIT 1
+    SELECT payment_provider_id, payment_provider_private_key, payment_provider_public_key FROM payment_providers WHERE payment_provider_name = 'Stripe' LIMIT 1
 ");
 $stripe_provider = mysqli_fetch_assoc($stripe_provider_query);
 
@@ -28,7 +28,7 @@ $stripe_secret_key = escapeHtml($stripe_provider['payment_provider_private_key']
 
 // Get client's Stripe customer ID
 $stripe_customer_query = mysqli_query($mysqli, "
-    SELECT * FROM client_payment_provider
+    SELECT payment_provider_client FROM client_payment_provider
     WHERE client_id = $session_client_id AND payment_provider_id = $stripe_provider_id
     LIMIT 1
 ");
diff --git a/client/ticket.php b/client/ticket.php
index 75bf15c17..ad8fcda55 100644
--- a/client/ticket.php
+++ b/client/ticket.php
@@ -53,18 +53,18 @@ if (isset($_GET['id']) && intval($_GET['id'])) {
         // Get Ticket Attachments (not associated with a specific reply)
         $sql_ticket_attachments = mysqli_query(
             $mysqli,
-            "SELECT * FROM ticket_attachments
+            "SELECT ticket_attachment_id, ticket_attachment_name FROM ticket_attachments
             WHERE ticket_attachment_reply_id IS NULL
             AND ticket_attachment_ticket_id = $ticket_id"
         );
 
         // Get Tasks
-        $sql_tasks = mysqli_query( $mysqli, "SELECT * FROM tasks WHERE task_ticket_id = $ticket_id ORDER BY task_order ASC, task_id ASC");
+        $sql_tasks = mysqli_query( $mysqli, "SELECT 1 FROM tasks WHERE task_ticket_id = $ticket_id ORDER BY task_order ASC, task_id ASC");
         $task_count = mysqli_num_rows($sql_tasks);
 
         // Get Completed Task Count
         $sql_tasks_completed = mysqli_query($mysqli,
-            "SELECT * FROM tasks
+            "SELECT 1 FROM tasks
             WHERE task_ticket_id = $ticket_id
             AND task_completed_at IS NOT NULL"
         );
@@ -269,7 +269,9 @@ if (isset($_GET['id']) && intval($_GET['id'])) {
         <br>
 
         <?php
-        $sql = mysqli_query($mysqli, "SELECT * FROM ticket_replies LEFT JOIN users ON ticket_reply_by = user_id LEFT JOIN contacts ON ticket_reply_by = contact_id WHERE ticket_reply_ticket_id = $ticket_id AND ticket_reply_archived_at IS NULL AND ticket_reply_type != 'Internal' ORDER BY ticket_reply_id DESC");
+        $sql = mysqli_query($mysqli, "SELECT contact_name, contact_photo, ticket_reply, ticket_reply_by, ticket_reply_created_at,
+            ticket_reply_id, ticket_reply_type, ticket_reply_updated_at, user_avatar, user_id,
+            user_name FROM ticket_replies LEFT JOIN users ON ticket_reply_by = user_id LEFT JOIN contacts ON ticket_reply_by = contact_id WHERE ticket_reply_ticket_id = $ticket_id AND ticket_reply_archived_at IS NULL AND ticket_reply_type != 'Internal' ORDER BY ticket_reply_id DESC");
 
         while ($row = mysqli_fetch_assoc($sql)) {
             $ticket_reply_id = intval($row['ticket_reply_id']);
@@ -295,7 +297,7 @@ if (isset($_GET['id']) && intval($_GET['id'])) {
             // Get attachments for this reply
             $sql_ticket_reply_attachments = mysqli_query(
                 $mysqli,
-                "SELECT * FROM ticket_attachments
+                "SELECT ticket_attachment_id, ticket_attachment_name FROM ticket_attachments
                         WHERE ticket_attachment_reply_id = $ticket_reply_id
                         AND ticket_attachment_ticket_id = $ticket_id"
             );
diff --git a/client/unpaid_invoices.php b/client/unpaid_invoices.php
index 5aed26928..b6f977e20 100644
--- a/client/unpaid_invoices.php
+++ b/client/unpaid_invoices.php
@@ -13,11 +13,12 @@ require_once "includes/inc_all.php";
 
 enforceContactCan('accounting');
 
-$invoices_sql = mysqli_query($mysqli, "SELECT * FROM invoices WHERE invoice_client_id = $session_client_id AND (invoice_status = 'Viewed' OR invoice_status = 'Sent' OR invoice_status = 'Partial') ORDER BY invoice_date DESC");
+$invoices_sql = mysqli_query($mysqli, "SELECT invoice_amount, invoice_date, invoice_due, invoice_id, invoice_number, invoice_prefix,
+    invoice_scope, invoice_status, invoice_url_key FROM invoices WHERE invoice_client_id = $session_client_id AND (invoice_status = 'Viewed' OR invoice_status = 'Sent' OR invoice_status = 'Partial') ORDER BY invoice_date DESC");
 
 
 // Payment Provider Active Query
-$sql_payment_provider = mysqli_query($mysqli, "SELECT * FROM payment_providers WHERE payment_provider_active = 1 LIMIT 1;");
+$sql_payment_provider = mysqli_query($mysqli, "SELECT payment_provider_active, payment_provider_id, payment_provider_threshold FROM payment_providers WHERE payment_provider_active = 1 LIMIT 1;");
 $row = mysqli_fetch_assoc($sql_payment_provider);
 $payment_provider_id = intval($row['payment_provider_id']);
 $payment_provider_active = intval($row['payment_provider_active']);
@@ -25,7 +26,7 @@ $payment_provider_threshold = floatval($row['payment_provider_threshold']);
 
 // Saved Payment Methods
 $sql_saved_payment_methods = mysqli_query($mysqli, "
-    SELECT * FROM client_saved_payment_methods
+    SELECT payment_provider_name, saved_payment_description, saved_payment_id FROM client_saved_payment_methods
     LEFT JOIN payment_providers
         ON client_saved_payment_methods.saved_payment_provider_id = payment_providers.payment_provider_id
     WHERE saved_payment_client_id = $session_client_id
@@ -156,7 +157,7 @@ $balance = $invoice_amounts - $amount_paid;
                             <?php
                             // Saved Payment Methods
                             $sql_saved_payment_methods = mysqli_query($mysqli, "
-                                SELECT * FROM client_saved_payment_methods
+                                SELECT payment_provider_name, saved_payment_description, saved_payment_id FROM client_saved_payment_methods
                                 LEFT JOIN payment_providers
                                     ON client_saved_payment_methods.saved_payment_provider_id = payment_providers.payment_provider_id
                                 WHERE saved_payment_client_id = $session_client_id
diff --git a/cron/backup.php b/cron/backup.php
index a81125537..45ca35958 100644
--- a/cron/backup.php
+++ b/cron/backup.php
@@ -18,7 +18,7 @@ require_once "../config.php";
 require_once "../includes/inc_set_timezone.php";
 require_once "../functions.php";
 
-$sql_settings = mysqli_query($mysqli, "SELECT * FROM settings WHERE settings.company_id = 1");
+$sql_settings = mysqli_query($mysqli, "SELECT config_backup_cron_type, config_enable_cron FROM settings WHERE settings.company_id = 1");
 $row = mysqli_fetch_assoc($sql_settings);
 
 $config_enable_cron = intval($row['config_enable_cron']);
diff --git a/cron/certificate_refresher.php b/cron/certificate_refresher.php
index 69cc5ec5e..2e77609e4 100644
--- a/cron/certificate_refresher.php
+++ b/cron/certificate_refresher.php
@@ -19,7 +19,7 @@ require_once "../includes/inc_set_timezone.php";
 require_once "../functions.php";
 
 
-$sql_settings = mysqli_query($mysqli, "SELECT * FROM settings WHERE settings.company_id = 1");
+$sql_settings = mysqli_query($mysqli, "SELECT config_enable_cron FROM settings WHERE settings.company_id = 1");
 
 $row = mysqli_fetch_assoc($sql_settings);
 
@@ -40,7 +40,7 @@ if ($config_enable_cron == 0) {
 
 $sql_certificates = mysqli_query(
     $mysqli,
-    "SELECT * FROM certificates
+    "SELECT certificate_domain, certificate_id FROM certificates
         LEFT JOIN clients ON certificates.certificate_client_id = clients.client_id
         WHERE certificate_archived_at IS NULL
         AND client_archived_at IS NULL"
diff --git a/cron/cron.php b/cron/cron.php
index 6fa7cb71c..35b45ce19 100644
--- a/cron/cron.php
+++ b/cron/cron.php
@@ -86,7 +86,7 @@ function cronJobClaim($mysqli, array $job): bool
         cron_job_interval_minutes = $default_interval,
         cron_job_daily_at = $default_daily_at");
 
-    $row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT * FROM cron_jobs WHERE cron_job_name = '$name' LIMIT 1"));
+    $row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT cron_job_daily_at, cron_job_enabled, cron_job_interval_minutes, cron_job_schedule FROM cron_jobs WHERE cron_job_name = '$name' LIMIT 1"));
 
     if (!$row) {
         return false;
diff --git a/cron/domain_refresher.php b/cron/domain_refresher.php
index 555c505c2..d1905a3fe 100644
--- a/cron/domain_refresher.php
+++ b/cron/domain_refresher.php
@@ -18,7 +18,7 @@ require_once "../config.php";
 require_once "../includes/inc_set_timezone.php";
 require_once "../functions.php";
 
-$sql_settings = mysqli_query($mysqli, "SELECT * FROM settings WHERE settings.company_id = 1");
+$sql_settings = mysqli_query($mysqli, "SELECT config_enable_cron FROM settings WHERE settings.company_id = 1");
 
 $row = mysqli_fetch_assoc($sql_settings);
 
diff --git a/cron/mail_queue.php b/cron/mail_queue.php
index 1a538c3bd..9675d5c65 100644
--- a/cron/mail_queue.php
+++ b/cron/mail_queue.php
@@ -54,7 +54,11 @@ class StaticTokenProvider implements OAuthTokenProvider {
 /** =======================================================================
  *  Load settings
  * ======================================================================= */
-$sql_settings = mysqli_query($mysqli, "SELECT * FROM settings WHERE company_id = 1");
+$sql_settings = mysqli_query($mysqli, "SELECT config_enable_cron, config_mail_oauth_access_token,
+    config_mail_oauth_access_token_expires_at, config_mail_oauth_client_id,
+    config_mail_oauth_client_secret, config_mail_oauth_refresh_token,
+    config_mail_oauth_tenant_id, config_smtp_encryption, config_smtp_host,
+    config_smtp_password, config_smtp_port, config_smtp_provider, config_smtp_username FROM settings WHERE company_id = 1");
 $row = mysqli_fetch_assoc($sql_settings);
 
 $config_enable_cron      = intval($row['config_enable_cron']);
@@ -319,7 +323,8 @@ if ($orphaned_emails > 0) {
 /** =======================================================================
  *  SEND: status = 0 (Queued)
  * ======================================================================= */
-$sql_queue = mysqli_query($mysqli, "SELECT * FROM email_queue WHERE email_status = 0 AND email_queued_at <= NOW()");
+$sql_queue = mysqli_query($mysqli, "SELECT email_attachments, email_cal_str, email_content, email_from, email_from_name, email_id,
+    email_recipient, email_recipient_name, email_subject FROM email_queue WHERE email_status = 0 AND email_queued_at <= NOW()");
 
 if (mysqli_num_rows($sql_queue) > 0) {
     while ($rowq = mysqli_fetch_assoc($sql_queue)) {
@@ -417,7 +422,8 @@ if (mysqli_num_rows($sql_queue) > 0) {
  */
 $sql_failed_queue = mysqli_query(
     $mysqli,
-    "SELECT * FROM email_queue
+    "SELECT email_attachments, email_attempts, email_cal_str, email_content, email_from,
+        email_from_name, email_id, email_recipient, email_recipient_name, email_subject FROM email_queue
      WHERE email_status = 2
        AND email_attempts < 4
        AND email_failed_at <= NOW() - INTERVAL 30 MINUTE"
diff --git a/cron/nightly_tasks.php b/cron/nightly_tasks.php
index 997da02f9..fbebc2b1d 100644
--- a/cron/nightly_tasks.php
+++ b/cron/nightly_tasks.php
@@ -26,7 +26,20 @@ require_once "../config.php";
 require_once "../includes/inc_set_timezone.php";
 require_once "../functions.php";
 
-$sql_companies = mysqli_query($mysqli, "SELECT * FROM companies, settings WHERE companies.company_id = settings.company_id AND companies.company_id = 1");
+$sql_companies = mysqli_query($mysqli, "SELECT company_city, company_country, company_currency, company_email, company_locale,
+    company_name, company_phone, company_phone_country_code, company_state, company_website,
+    config_enable_alert_domain_expire, config_enable_cron, config_invoice_from_email,
+    config_invoice_from_name, config_invoice_late_fee_enable, config_invoice_late_fee_percent,
+    config_invoice_prefix, config_log_retention, config_login_remember_me_expire,
+    config_mail_from_email, config_mail_from_name, config_module_enable_accounting,
+    config_module_enable_itdoc, config_module_enable_ticketing,
+    config_recurring_auto_send_invoice, config_send_invoice_reminders, config_smtp_encryption,
+    config_smtp_host, config_smtp_password, config_smtp_port, config_smtp_provider,
+    config_smtp_username, config_telemetry, config_theme, config_ticket_autoclose_hours,
+    config_ticket_client_general_notifications, config_ticket_email_parse,
+    config_ticket_from_email, config_ticket_from_name,
+    config_ticket_new_ticket_notification_email, config_ticket_prefix,
+    config_whitelabel_enabled, config_whitelabel_key FROM companies, settings WHERE companies.company_id = settings.company_id AND companies.company_id = 1");
 
 $row = mysqli_fetch_assoc($sql_companies);
 
@@ -218,7 +231,7 @@ if ($config_enable_alert_domain_expire == 1) {
         //Get Domains Expiring
         $sql = mysqli_query(
             $mysqli,
-            "SELECT * FROM domains
+            "SELECT client_id, client_name, domain_expire, domain_id, domain_name FROM domains
             LEFT JOIN clients ON domain_client_id = client_id
             WHERE domain_expire IS NOT NULL AND domain_expire = CURDATE() + INTERVAL $day DAY"
         );
@@ -248,7 +261,8 @@ foreach ($certificateAlertArray as $day) {
     //Get Certs Expiring
     $sql = mysqli_query(
         $mysqli,
-        "SELECT * FROM certificates
+        "SELECT certificate_domain, certificate_expire, certificate_id, certificate_name,
+            certificate_public_key, client_id, client_name FROM certificates
         LEFT JOIN clients ON certificate_client_id = client_id
         WHERE certificate_expire = CURDATE() + INTERVAL $day DAY"
     );
@@ -298,7 +312,7 @@ foreach ($warranty_alert_array as $day) {
     //Get Asset Warranty Expiring
     $sql = mysqli_query(
         $mysqli,
-        "SELECT * FROM assets
+        "SELECT asset_id, asset_name, asset_warranty_expire, client_id, client_name FROM assets
         LEFT JOIN clients ON asset_client_id = client_id
         WHERE asset_warranty_expire = CURDATE() + INTERVAL $day DAY"
     );
@@ -335,7 +349,10 @@ if ($tickets_pending_assignment > 0) {
 // Recurring tickets
 
 // Get recurring tickets for today
-$sql_recurring_tickets = mysqli_query($mysqli, "SELECT * FROM recurring_tickets WHERE recurring_ticket_next_run = CURDATE()");
+$sql_recurring_tickets = mysqli_query($mysqli, "SELECT recurring_ticket_asset_id, recurring_ticket_assigned_to, recurring_ticket_billable,
+    recurring_ticket_category, recurring_ticket_client_id, recurring_ticket_contact_id,
+    recurring_ticket_created_by, recurring_ticket_details, recurring_ticket_frequency,
+    recurring_ticket_id, recurring_ticket_priority, recurring_ticket_subject FROM recurring_tickets WHERE recurring_ticket_next_run = CURDATE()");
 
 if (mysqli_num_rows($sql_recurring_tickets) > 0) {
     while ($row = mysqli_fetch_assoc($sql_recurring_tickets)) {
@@ -492,7 +509,7 @@ if (mysqli_num_rows($sql_recurring_tickets) > 0) {
 }
 
 // Flag any active recurring "next run" dates that are in the past
-$sql_invalid_recurring_tickets = mysqli_query($mysqli, "SELECT * FROM recurring_tickets WHERE recurring_ticket_next_run < CURDATE()");
+$sql_invalid_recurring_tickets = mysqli_query($mysqli, "SELECT recurring_ticket_subject FROM recurring_tickets WHERE recurring_ticket_next_run < CURDATE()");
 while ($row = mysqli_fetch_assoc($sql_invalid_recurring_tickets)) {
     $subject = escapeSql($row['recurring_ticket_subject']);
     appNotify("Ticket", "Recurring ticket $subject next run date is in the past!", "/agent/recurring_tickets.php");
@@ -507,7 +524,8 @@ while ($row = mysqli_fetch_assoc($sql_invalid_recurring_tickets)) {
 
 $sql_resolved_tickets_to_close = mysqli_query(
     $mysqli,
-    "SELECT * FROM tickets
+    "SELECT ticket_assigned_to, ticket_client_id, ticket_id, ticket_number, ticket_prefix,
+        ticket_status, ticket_subject FROM tickets
     WHERE ticket_status = 4
     AND ticket_updated_at < NOW() - INTERVAL $config_ticket_autoclose_hours HOUR"
 );
@@ -544,7 +562,9 @@ if ($config_send_invoice_reminders == 1) {
 
         $sql = mysqli_query(
             $mysqli,
-            "SELECT * FROM invoices
+            "SELECT client_id, client_name, contact_email, contact_name, invoice_amount, invoice_currency_code,
+                invoice_date, invoice_due, invoice_id, invoice_number, invoice_prefix, invoice_status,
+                invoice_url_key FROM invoices
             LEFT JOIN clients ON invoice_client_id = client_id
             LEFT JOIN contacts ON clients.client_id = contacts.contact_client_id AND contact_primary = 1
             WHERE invoice_status != 'Draft'
@@ -654,7 +674,13 @@ if ($config_send_invoice_reminders == 1) {
 // Send Recurring Invoices that match todays date and are active
 
 //Loop through all recurring that match today's date and is active
-$sql_recurring_invoices = mysqli_query($mysqli, "SELECT * FROM recurring_invoices
+$sql_recurring_invoices = mysqli_query($mysqli, "SELECT client_name, client_net_terms, recurring_invoice_amount, recurring_invoice_category_id,
+    recurring_invoice_client_id, recurring_invoice_currency_code,
+    recurring_invoice_discount_amount, recurring_invoice_email_notify,
+    recurring_invoice_frequency, recurring_invoice_id, recurring_invoice_last_sent,
+    recurring_invoice_next_date, recurring_invoice_note, recurring_invoice_scope,
+    recurring_invoice_status, recurring_payment_account_id, recurring_payment_currency_code,
+    recurring_payment_method, recurring_payment_recurring_invoice_id FROM recurring_invoices
     LEFT JOIN recurring_payments ON recurring_invoice_id = recurring_payment_recurring_invoice_id
     LEFT JOIN clients ON client_id = recurring_invoice_client_id
     WHERE recurring_invoice_next_date = CURDATE()
@@ -702,7 +728,8 @@ while ($row = mysqli_fetch_assoc($sql_recurring_invoices)) {
     $new_invoice_id = mysqli_insert_id($mysqli);
 
     //Copy Items from original recurring invoice to new invoice
-    $sql_invoice_items = mysqli_query($mysqli, "SELECT * FROM recurring_invoice_items WHERE item_recurring_invoice_id = $recurring_invoice_id ORDER BY item_id ASC");
+    $sql_invoice_items = mysqli_query($mysqli, "SELECT item_description, item_id, item_name, item_order, item_price, item_quantity, item_subtotal,
+        item_tax, item_tax_id, item_total FROM recurring_invoice_items WHERE item_recurring_invoice_id = $recurring_invoice_id ORDER BY item_id ASC");
 
     while ($row = mysqli_fetch_assoc($sql_invoice_items)) {
         $item_id = intval($row['item_id']);
@@ -734,7 +761,8 @@ while ($row = mysqli_fetch_assoc($sql_recurring_invoices)) {
     // Get details of the newly generated invoice
     $sql = mysqli_query(
         $mysqli,
-        "SELECT * FROM invoices
+        "SELECT client_id, client_name, contact_email, contact_name, invoice_amount, invoice_date,
+            invoice_due, invoice_number, invoice_prefix, invoice_scope, invoice_url_key FROM invoices
             LEFT JOIN clients ON invoice_client_id = client_id
             LEFT JOIN contacts ON clients.client_id = contacts.contact_client_id AND contact_primary = 1
             WHERE invoice_id = $new_invoice_id"
@@ -812,7 +840,7 @@ while ($row = mysqli_fetch_assoc($sql_recurring_invoices)) {
 } //End Recurring Invoices Loop
 
 // Start Flag any active recurring "next run" dates that are in the past
-$sql_invalid_recurring_invoices = mysqli_query($mysqli, "SELECT * FROM recurring_invoices WHERE recurring_invoice_next_date < CURDATE() AND recurring_invoice_status = 1");
+$sql_invalid_recurring_invoices = mysqli_query($mysqli, "SELECT recurring_invoice_number, recurring_invoice_prefix FROM recurring_invoices WHERE recurring_invoice_next_date < CURDATE() AND recurring_invoice_status = 1");
 while ($row = mysqli_fetch_assoc($sql_invalid_recurring_invoices)) {
     $invoice_prefix = escapeSql($row['recurring_invoice_prefix']);
     $invoice_number = intval($row['recurring_invoice_number']);
@@ -823,7 +851,10 @@ while ($row = mysqli_fetch_assoc($sql_invalid_recurring_invoices)) {
 
 // Start Recurring Payments
 $sql_recurring_payments = mysqli_query($mysqli, "
-    SELECT * FROM recurring_payments
+    SELECT client_id, client_name, contact_email, contact_name, invoice_amount, invoice_currency_code,
+        invoice_date, invoice_due, invoice_id, invoice_number, invoice_prefix, invoice_scope,
+        invoice_url_key, recurring_payment_account_id, recurring_payment_currency_code,
+        recurring_payment_method, recurring_payment_saved_payment_id FROM recurring_payments
     LEFT JOIN invoices ON invoice_recurring_invoice_id = recurring_payment_recurring_invoice_id
     LEFT JOIN clients ON client_id = invoice_client_id
     LEFT JOIN contacts ON client_id = contact_client_id AND contact_primary = 1
@@ -860,7 +891,8 @@ while ($row = mysqli_fetch_assoc($sql_recurring_payments)) {
     if ($recurring_payment_saved_payment_id) {
         // Get the saved payment method and provider details
         $saved_payment = mysqli_fetch_assoc(mysqli_query($mysqli, "
-            SELECT * FROM client_saved_payment_methods
+            SELECT payment_provider_account, payment_provider_id, payment_provider_name,
+                payment_provider_private_key, saved_payment_description, saved_payment_provider_method FROM client_saved_payment_methods
             LEFT JOIN payment_providers ON saved_payment_provider_id = payment_provider_id
             WHERE saved_payment_id = $recurring_payment_saved_payment_id
               AND saved_payment_client_id = $client_id
@@ -1066,7 +1098,11 @@ if ($stripe_provider) {
 
 // Recurring Expenses
 // Loop through all recurring expenses that match today's date and is active
-$sql_recurring_expenses = mysqli_query($mysqli, "SELECT * FROM recurring_expenses WHERE recurring_expense_next_date = CURDATE() AND recurring_expense_status = 1");
+$sql_recurring_expenses = mysqli_query($mysqli, "SELECT recurring_expense_account_id, recurring_expense_amount, recurring_expense_category_id,
+    recurring_expense_client_id, recurring_expense_currency_code, recurring_expense_day,
+    recurring_expense_description, recurring_expense_frequency, recurring_expense_id,
+    recurring_expense_month, recurring_expense_payment_method, recurring_expense_reference,
+    recurring_expense_vendor_id FROM recurring_expenses WHERE recurring_expense_next_date = CURDATE() AND recurring_expense_status = 1");
 
 while ($row = mysqli_fetch_assoc($sql_recurring_expenses)) {
     $recurring_expense_id = intval($row['recurring_expense_id']);
@@ -1107,7 +1143,7 @@ while ($row = mysqli_fetch_assoc($sql_recurring_expenses)) {
 } //End Recurring expenses loop
 
 // Flag any active recurring "next run" dates that are in the past
-$sql_invalid_recurring_expenses = mysqli_query($mysqli, "SELECT * FROM recurring_expenses WHERE recurring_expense_next_date < CURDATE() AND recurring_expense_status = 1");
+$sql_invalid_recurring_expenses = mysqli_query($mysqli, "SELECT recurring_expense_description FROM recurring_expenses WHERE recurring_expense_next_date < CURDATE() AND recurring_expense_status = 1");
 while ($row = mysqli_fetch_assoc($sql_invalid_recurring_expenses)) {
     $recurring_expense_description = escapeSql($row['recurring_expense_description']);
     appNotify("Expense", "Recurring expense $recurring_expense_description next run date is in the past!", "/agent/recurring_expenses.php");
diff --git a/cron/ticket_email_parser.php b/cron/ticket_email_parser.php
index 95fc84aa4..37fc7f3a2 100644
--- a/cron/ticket_email_parser.php
+++ b/cron/ticket_email_parser.php
@@ -37,7 +37,7 @@ $config_ticket_from_name = escapeSql($config_ticket_from_name);
 $config_ticket_email_parse_unknown_senders = intval($row['config_ticket_email_parse_unknown_senders']);
 
 // Get company name & phone & timezone
-$sql = mysqli_query($mysqli, "SELECT * FROM companies, settings WHERE companies.company_id = settings.company_id AND companies.company_id = 1");
+$sql = mysqli_query($mysqli, "SELECT company_name, company_phone, company_phone_country_code FROM companies, settings WHERE companies.company_id = settings.company_id AND companies.company_id = 1");
 $row = mysqli_fetch_assoc($sql);
 $company_name = escapeSql($row['company_name']);
 $company_phone = escapeSql(formatPhoneNumber($row['company_phone'], $row['company_phone_country_code']));
@@ -356,7 +356,10 @@ function addReply($from_email, $date, $subject, $ticket_number, $message, $attac
         mysqli_query($mysqli, "UPDATE tickets SET ticket_status = 2, ticket_resolved_at = NULL WHERE ticket_id = $ticket_id AND ticket_client_id = $client_id LIMIT 1");
         resetTicketResolutionSla($ticket_id);
 
-        logTicketHistory($ticket_id, "$from_email_esc replied by email, reopening the ticket");
+        // Only record the reopen when the ticket was not already open
+        if (intval($ticket_status) !== 2) {
+            logTicketHistory($ticket_id, "$from_email_esc replied by email, reopening the ticket");
+        }
 
         logAudit("Ticket", "Edit", "Email parser: Client contact $from_email_esc updated ticket $config_ticket_prefix$ticket_number_esc ($subject)", $client_id, $ticket_id);
         triggerCustomAction('ticket_reply_client', $ticket_id);
@@ -764,7 +767,7 @@ foreach ($messages as $message) {
             } else {
                 // Else: check if sender domain is registered
                 $from_domain_esc = mysqli_real_escape_string($mysqli, $from_domain);
-                $domain_sql = mysqli_query($mysqli, "SELECT * FROM domains WHERE domain_name = '$from_domain_esc' AND domain_archived_at IS NULL LIMIT 1");
+                $domain_sql = mysqli_query($mysqli, "SELECT domain_client_id, domain_name FROM domains WHERE domain_name = '$from_domain_esc' AND domain_archived_at IS NULL LIMIT 1");
                 $domain_row = mysqli_fetch_assoc($domain_sql);
 
                 if ($domain_row && $from_domain == $domain_row['domain_name']) {
@@ -816,7 +819,7 @@ foreach ($messages as $message) {
         // 4. A known domain?
         if (!$email_processed) {
             $from_domain_esc = mysqli_real_escape_string($mysqli, $from_domain);
-            $domain_sql = mysqli_query($mysqli, "SELECT * FROM domains WHERE domain_name = '$from_domain_esc' AND domain_archived_at IS NULL LIMIT 1");
+            $domain_sql = mysqli_query($mysqli, "SELECT domain_client_id, domain_name FROM domains WHERE domain_name = '$from_domain_esc' AND domain_archived_at IS NULL LIMIT 1");
             $rowd = mysqli_fetch_assoc($domain_sql);
 
             if ($rowd && $from_domain == $rowd['domain_name']) {
diff --git a/db.sql b/db.sql
index c0bcebd73..e039a630c 100644
--- a/db.sql
+++ b/db.sql
@@ -50,6 +50,7 @@ CREATE TABLE `ai_models` (
   `ai_model_name` varchar(200) NOT NULL,
   `ai_model_prompt` text DEFAULT NULL,
   `ai_model_use_case` varchar(200) DEFAULT NULL,
+  `ai_model_temperature` decimal(3,2) DEFAULT NULL,
   `ai_model_created_at` datetime NOT NULL DEFAULT current_timestamp(),
   `ai_model_updated_at` datetime DEFAULT NULL ON UPDATE current_timestamp(),
   `ai_model_ai_provider_id` int(11) NOT NULL,
diff --git a/functions.php b/functions.php
index ff70057de..fbea6e270 100644
--- a/functions.php
+++ b/functions.php
@@ -22,6 +22,7 @@ require_once __DIR__ . '/functions/logging.php';
 require_once __DIR__ . '/functions/app.php';
 require_once __DIR__ . '/functions/payments.php';
 require_once __DIR__ . '/functions/sla.php';
+require_once __DIR__ . '/functions/ai.php';
 require_once __DIR__ . '/functions/export.php';
 require_once __DIR__ . '/functions/calendar.php';
 require_once __DIR__ . '/functions/backup.php';
diff --git a/functions/ai.php b/functions/ai.php
new file mode 100644
index 000000000..76e88e94f
--- /dev/null
+++ b/functions/ai.php
@@ -0,0 +1,132 @@
+<?php
+
+/*
+ * ITFlow - AI helpers
+ *
+ * The three AI endpoints in agent/ajax.php each carried their own copy of the model
+ * lookup and the cURL boilerplate, which is how they all ended up hardcoding
+ * use_case = 'General' and a temperature the provider may not accept. Model
+ * selection and the provider call live here instead.
+ */
+
+// A provider that never answers would otherwise hold a PHP worker open until
+// max_execution_time
+DEFINE("AI_REQUEST_TIMEOUT", 60);
+
+/*
+ * The model configured for a use case - one of the values the add/edit modals offer:
+ * General, Tickets, Documentation.
+ *
+ * A feature-specific model wins, a General model is the fallback, so an install with
+ * a single General model keeps working everywhere. Returns null when nothing usable
+ * is configured; callers report that rather than posting to an empty URL.
+ */
+function getAiModel($use_case = 'General') {
+
+    global $mysqli;
+
+    $use_case = escapeSql($use_case);
+
+    // Feature-specific first, then General - FIELD() keeps that preference in SQL so
+    // one query answers both
+    $preference = ($use_case === 'General') ? "'General'" : "'$use_case', 'General'";
+
+    $sql = mysqli_query($mysqli,
+        "SELECT ai_model_name, ai_model_prompt, ai_model_use_case, ai_model_temperature,
+                ai_provider_name, ai_provider_api_url, ai_provider_api_key
+        FROM ai_models
+        LEFT JOIN ai_providers ON ai_model_ai_provider_id = ai_provider_id
+        WHERE ai_model_use_case IN ($preference)
+        ORDER BY FIELD(ai_model_use_case, $preference), ai_model_id ASC
+        LIMIT 1"
+    );
+
+    $model = mysqli_fetch_assoc($sql);
+
+    // A model row with no provider behind it (or no endpoint) can't be called
+    if (!$model || empty($model['ai_model_name']) || empty($model['ai_provider_api_url'])) {
+        return null;
+    }
+
+    return $model;
+}
+
+/*
+ * Posts a chat-completion request. Returns:
+ *
+ *     ['ok' => true,  'content' => '...']
+ *     ['ok' => false, 'error'   => 'short message safe to show the user']
+ *
+ * Provider detail - status code, error type, code and message - goes to the app log
+ * so a misconfiguration is diagnosable. The API key and the message bodies never do.
+ */
+function callAiApi($model, $messages) {
+
+    $data = [
+        'model'    => $model['ai_model_name'],
+        'messages' => $messages,
+    ];
+
+    // Only send a temperature when the model has one configured. Newer OpenAI models
+    // accept nothing but their own default and 400 on anything else, which is what
+    // the old hardcoded 0.5 / 0.3 ran into.
+    if (isset($model['ai_model_temperature']) && $model['ai_model_temperature'] !== '') {
+        $data['temperature'] = floatval($model['ai_model_temperature']);
+    }
+
+    $ch = curl_init($model['ai_provider_api_url']);
+    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
+    curl_setopt($ch, CURLOPT_POST, true);
+    curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($data));
+    curl_setopt($ch, CURLOPT_TIMEOUT, AI_REQUEST_TIMEOUT);
+    curl_setopt($ch, CURLOPT_HTTPHEADER, [
+        'Content-Type: application/json',
+        'Authorization: Bearer ' . $model['ai_provider_api_key'],
+    ]);
+
+    $response = curl_exec($ch);
+    $status = intval(curl_getinfo($ch, CURLINFO_RESPONSE_CODE));
+    $transport_error = curl_error($ch);
+    curl_close($ch);
+
+    // Enough to tell one provider/model pairing from another in the log
+    $context = $model['ai_provider_name'] . ' / ' . $model['ai_model_name'];
+
+    if ($response === false) {
+        logApp('AI', 'error', "$context - could not reach the provider: $transport_error");
+        return ['ok' => false, 'error' => 'Could not reach the AI provider.'];
+    }
+
+    $decoded = json_decode($response, true);
+
+    if ($status < 200 || $status > 299) {
+        $provider_error = $decoded['error'] ?? [];
+        $detail = "$context - HTTP $status";
+        foreach (['type', 'code', 'param'] as $field) {
+            if (!empty($provider_error[$field])) {
+                $detail .= " $field=" . $provider_error[$field];
+            }
+        }
+        if (!empty($provider_error['message'])) {
+            $detail .= ' - ' . $provider_error['message'];
+        }
+        logApp('AI', 'error', $detail);
+        return ['ok' => false, 'error' => 'The AI provider rejected the request - see Admin > App Logs.'];
+    }
+
+    if (!isset($decoded['choices'][0]['message']['content'])) {
+        logApp('AI', 'error', "$context - HTTP $status but the response carried no choices[0].message.content");
+        return ['ok' => false, 'error' => 'The AI provider returned an unexpected response - see Admin > App Logs.'];
+    }
+
+    return ['ok' => true, 'content' => $decoded['choices'][0]['message']['content']];
+}
+
+/*
+ * What to say when nothing is configured for a use case. Logged as well as shown,
+ * because "no model" and "model rejected the request" look identical from the UI.
+ */
+function aiModelMissingError($use_case) {
+    logApp('AI', 'warning', "No AI model configured for use case '$use_case' and no General model to fall back on");
+    return "No AI model is configured for $use_case. Add one under Admin > AI Models.";
+}
diff --git a/functions/app.php b/functions/app.php
index 48d039e3c..df45126dc 100644
--- a/functions/app.php
+++ b/functions/app.php
@@ -100,7 +100,7 @@ function addTasksFromTicketTemplate($ticket_id, $ticket_template_id) {
         return 0;
     }
 
-    $sql_task_templates = mysqli_query($mysqli, "SELECT * FROM task_templates WHERE task_template_ticket_template_id = $ticket_template_id ORDER BY task_template_order ASC");
+    $sql_task_templates = mysqli_query($mysqli, "SELECT task_template_completion_estimate, task_template_name, task_template_order FROM task_templates WHERE task_template_ticket_template_id = $ticket_template_id ORDER BY task_template_order ASC");
 
     $tasks_added = 0;
 
@@ -270,7 +270,7 @@ function getFieldById($table, $id, $field) {
 function displayFolderOptions($parent_folder_id, $client_id, $indent = 0) {
     global $mysqli;
 
-    $sql_folders = mysqli_query($mysqli, "SELECT * FROM folders WHERE parent_folder = $parent_folder_id AND folder_client_id = $client_id ORDER BY folder_name ASC");
+    $sql_folders = mysqli_query($mysqli, "SELECT folder_id, folder_name FROM folders WHERE parent_folder = $parent_folder_id AND folder_client_id = $client_id ORDER BY folder_name ASC");
     while ($row = mysqli_fetch_assoc($sql_folders)) {
         $folder_id = intval($row['folder_id']);
         $folder_name = escapeHtml($row['folder_name']);
@@ -415,8 +415,17 @@ function addToMailQueue($data) {
     return true;
 }
 
-function createiCalStr($datetime, $title, $description, $location) {
-    require_once "libs/zapcal/zapcallib.php";
+function getTicketCalendarUid($ticket_id) {
+    // An invite and its later cancellation MUST carry the same UID or the
+    // recipient's calendar client cannot match them up. Derive it from the
+    // ticket so it is stable across both, rather than from the current time.
+    $ticket_id = intval($ticket_id);
+    $host = $_SERVER['SERVER_NAME'] ?? 'itflow';
+    return "ticket-$ticket_id@$host";
+}
+
+function createiCalStr($datetime, $title, $description, $location, $uid = null) {
+    require_once "../libs/zapcal/zapcallib.php";
 
     // Create the iCal object
     $cal_event = new ZCiCal();
@@ -431,8 +440,11 @@ function createiCalStr($datetime, $title, $description, $location) {
     // Todo: adjust this for actual duration
     $event->addNode(new ZCiCalDataNode("DTEND:" . ZCiCal::fromSqlDateTime($datetime)));
     $event->addNode(new ZCiCalDataNode("DTSTAMP:" . ZCiCal::fromSqlDateTime()));
-    $uid = date('Y-m-d-H-i-s') . "@" . $_SERVER['SERVER_NAME'];
+    if (empty($uid)) {
+        $uid = date('Y-m-d-H-i-s') . "@" . ($_SERVER['SERVER_NAME'] ?? 'itflow');
+    }
     $event->addNode(new ZCiCalDataNode("UID:" . $uid));
+    $event->addNode(new ZCiCalDataNode("SEQUENCE:0"));
     $event->addNode(new ZCiCalDataNode("LOCATION:" . $location));
     $event->addNode(new ZCiCalDataNode("DESCRIPTION:" . $description));
     // Todo: add organizer details
@@ -442,31 +454,27 @@ function createiCalStr($datetime, $title, $description, $location) {
     return $cal_event->export();
 }
 
-function createiCalStrCancel($originaliCalStr) {
-    require_once "libs/zapcal/zapcallib.php";
+function createiCalStrCancel($datetime, $title, $uid) {
+    require_once "../libs/zapcal/zapcallib.php";
 
-    // Import the original iCal string
-    $cal_event = new ZCiCal($originaliCalStr);
+    // Build the cancellation fresh. There is no stored copy of the original
+    // invite to reopen - the match is made by UID, not by the body.
+    $cal_event = new ZCiCal();
 
-    // Iterate through the iCalendar object to find VEVENT nodes
-    foreach($cal_event->tree->child as $node) {
-        if($node->getName() == "VEVENT") {
-            // Check if STATUS node exists, update it, or add a new one
-            $statusFound = false;
-            foreach($node->data as $key => $value) {
-                if($key == "STATUS") {
-                    $value->setValue("CANCELLED");
-                    $statusFound = true;
-                    break; // Exit the loop once the STATUS is updated
-                }
-            }
-            // If STATUS node is not found, add a new STATUS node
-            if (!$statusFound) {
-                $node->addNode(new ZCiCalDataNode("STATUS:CANCELLED"));
-            }
-        }
+    // METHOD belongs on the VCALENDAR, not on the VEVENT
+    $cal_event->tree->data['METHOD'] = new ZCiCalDataNode("METHOD:CANCEL");
+
+    $event = new ZCiCalNode("VEVENT", $cal_event->curnode);
+    $event->addNode(new ZCiCalDataNode("UID:" . $uid));
+    $event->addNode(new ZCiCalDataNode("SUMMARY:" . $title));
+    if (!empty($datetime)) {
+        $event->addNode(new ZCiCalDataNode("DTSTART:" . ZCiCal::fromSqlDateTime($datetime)));
+        $event->addNode(new ZCiCalDataNode("DTEND:" . ZCiCal::fromSqlDateTime($datetime)));
     }
+    $event->addNode(new ZCiCalDataNode("DTSTAMP:" . ZCiCal::fromSqlDateTime()));
+    // Must outrank the invite's SEQUENCE:0 or clients ignore the cancellation
+    $event->addNode(new ZCiCalDataNode("SEQUENCE:1"));
+    $event->addNode(new ZCiCalDataNode("STATUS:CANCELLED"));
 
-    // Return the modified iCal string
     return $cal_event->export();
 }
diff --git a/functions/auth.php b/functions/auth.php
index f25cbb549..d6acd13c7 100644
--- a/functions/auth.php
+++ b/functions/auth.php
@@ -62,6 +62,42 @@ function enforceUserPermission($module, $check_access_level = 1) {
     }
 }
 
+// Client-scope SQL fragment for a list query, built from the signed-in user's allow / deny lists.
+// Admin and unrestricted users get no restriction. This is the list-level counterpart to
+// enforceClientAccess(), which gates a single record.
+//
+// Column-aware on purpose: it scopes on the resource's OWN client column rather than a joined
+// clients.client_id, so a row with no client (column = 0) is judged on its real value instead of
+// becoming NULL through a LEFT JOIN and silently dropping out of the result set.
+//
+// Returns " AND ..." or "" - append it after a WHERE clause (add "WHERE 1=1" if there isn't one).
+function clientScopeSql($column) {
+    global $session_is_admin, $client_access_array, $client_deny_array;
+
+    if ($session_is_admin) {
+        return '';
+    }
+
+    if (empty($client_access_array) && empty($client_deny_array)) {
+        return ''; // Unrestricted user - all clients
+    }
+
+    $sql = '';
+
+    // 0 is included deliberately: a record with no client isn't any client's data, so a
+    // restricted user keeps seeing it. This also matches the deny branch below, where 0
+    // already passes NOT IN, and the old hand-rolled ticket override that did IN (0,...).
+    if (!empty($client_access_array)) {
+        $sql .= " AND $column IN (0," . implode(',', array_map('intval', $client_access_array)) . ")";
+    }
+
+    if (!empty($client_deny_array)) {
+        $sql .= " AND $column NOT IN (" . implode(',', array_map('intval', $client_deny_array)) . ")";
+    }
+
+    return $sql;
+}
+
 function enforceClientAccess($client_id = null) {
     global $mysqli, $session_user_id, $session_is_admin, $session_name;
 
diff --git a/functions/export.php b/functions/export.php
index d80739f29..c977b6e6c 100644
--- a/functions/export.php
+++ b/functions/export.php
@@ -348,6 +348,17 @@ function resolveExportFormat($format) {
     return ($format === 'pdf') ? 'pdf' : 'csv';
 }
 
+/*
+ * The gate every export handler opens on. Keying on isset() alone means any other
+ * field that happens to share the trigger's name fires the export - the client PDF
+ * pack's section checkboxes (export_assets=1, export_contacts=1, ...) did exactly
+ * that, and since post.php loads every handler, the first match won and streamed a
+ * CSV instead. Only 'csv' or 'pdf' - what renderExportButtons() posts - counts.
+ */
+function isExportRequest($trigger) {
+    return isset($_POST[$trigger]) && in_array($_POST[$trigger], ['csv', 'pdf'], true);
+}
+
 /*
  * PDF is capped - see EXPORT_PDF_MAX_ROWS. Call this after the row count is known
  * and before beginExport(); it redirects rather than returning on refusal.
@@ -797,3 +808,107 @@ function finishExport(&$export) {
 
     return $export['rows'];
 }
+
+/*
+ * ---------------------------------------------------------------------------
+ * Client PDF pack
+ * ---------------------------------------------------------------------------
+ *
+ * The sections the client "Export Data" PDF can contain, in document order.
+ *
+ *   'label'   Checkbox label in the export modal.
+ *   'icon'    Font Awesome class shown beside it.
+ *   'module'  Permission module that owns the section - same mapping the list
+ *             exports use. A role without read access to it never sees the
+ *             checkbox and never gets the section, so one missing module drops a
+ *             section rather than refusing the whole export.
+ *   'default' Whether the box starts ticked.
+ *
+ * The modal renders from this and the handler resolves from it, so a section
+ * can't be offered by one and ignored by the other.
+ */
+function getClientPackSections() {
+    return [
+        'contacts'     => ['label' => 'Contacts',            'icon' => 'fa-users',          'module' => 'module_client',     'default' => true],
+        'locations'    => ['label' => 'Locations',           'icon' => 'fa-map-marker-alt', 'module' => 'module_client',     'default' => true],
+        'vendors'      => ['label' => 'Vendors',             'icon' => 'fa-building',       'module' => 'module_client',     'default' => true],
+        'credentials'  => ['label' => 'Credentials',         'icon' => 'fa-key',            'module' => 'module_credential', 'default' => false],
+        'assets'       => ['label' => 'Assets',              'icon' => 'fa-desktop',        'module' => 'module_support',    'default' => true],
+        'software'     => ['label' => 'Software / Licenses', 'icon' => 'fa-cube',           'module' => 'module_support',    'default' => true],
+        'networks'     => ['label' => 'Networks',            'icon' => 'fa-network-wired',  'module' => 'module_support',    'default' => true],
+        'domains'      => ['label' => 'Domains',             'icon' => 'fa-globe',          'module' => 'module_support',    'default' => true],
+        'certificates' => ['label' => 'Certificates',        'icon' => 'fa-lock',           'module' => 'module_support',    'default' => true],
+    ];
+}
+
+/*
+ * Read access per module, resolved once rather than once per section.
+ */
+function getClientPackSectionAccess() {
+    $access = [];
+    foreach (getClientPackSections() as $section) {
+        if (!isset($access[$section['module']])) {
+            $access[$section['module']] = lookupUserPermission($section['module']) >= 1;
+        }
+    }
+    return $access;
+}
+
+/*
+ * Resolves the posted checkboxes against the signed-in role. Returns
+ * ['contacts' => 1|0, ...]. A section the role can't read is 0 whatever was
+ * posted, so a hand-rolled POST can't pull in a section the modal never offered.
+ */
+function resolveClientPackSections() {
+
+    $access = getClientPackSectionAccess();
+
+    $selected = [];
+    foreach (getClientPackSections() as $key => $section) {
+        $selected[$key] = ($access[$section['module']] && !empty($_POST["include_$key"])) ? 1 : 0;
+    }
+
+    return $selected;
+}
+
+/*
+ * The section checkboxes for the client PDF pack modal, split across two columns.
+ * Sections the role can't read are left out entirely rather than shown and then
+ * silently dropped server side.
+ */
+function renderClientPackSections() {
+
+    $access = getClientPackSectionAccess();
+
+    $visible = [];
+    foreach (getClientPackSections() as $key => $section) {
+        if ($access[$section['module']]) {
+            $visible[$key] = $section;
+        }
+    }
+
+    $split = (int) ceil(count($visible) / 2);
+    $index = 0;
+
+    ?>
+    <div class="row">
+        <div class="col-sm-6">
+        <?php foreach ($visible as $key => $section) { ?>
+            <?php if ($index === $split) { ?>
+        </div>
+        <div class="col-sm-6">
+            <?php } ?>
+            <li class="list-group-item">
+                <div class="custom-control custom-checkbox">
+                    <input class="custom-control-input" type="checkbox" id="include_<?= $key ?>" name="include_<?= $key ?>" value="1" <?php if ($section['default']) { echo 'checked'; } ?>>
+                    <label for="include_<?= $key ?>" class="custom-control-label">
+                        <i class="fas fa-fw <?= $section['icon'] ?> mr-2"></i><?= escapeHtml($section['label']) ?>
+                    </label>
+                </div>
+            </li>
+            <?php $index++; ?>
+        <?php } ?>
+        </div>
+    </div>
+    <?php
+}
diff --git a/guest/guest_ajax.php b/guest/guest_ajax.php
index 68f9ffaf9..a4a4f1cf5 100644
--- a/guest/guest_ajax.php
+++ b/guest/guest_ajax.php
@@ -31,7 +31,8 @@ if (isset($_GET['stripe_create_pi'])) {
     // Query invoice details
     $invoice_sql = mysqli_query(
         $mysqli,
-        "SELECT * FROM invoices
+        "SELECT client_id, client_name, invoice_amount, invoice_currency_code, invoice_number,
+            invoice_prefix FROM invoices
         LEFT JOIN clients ON invoice_client_id = client_id
         WHERE invoice_id = $invoice_id
         AND invoice_url_key = '$url_key'
@@ -63,7 +64,7 @@ if (isset($_GET['stripe_create_pi'])) {
     }
 
     // Setup Stripe from payment_providers
-    $stripe_provider = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT * FROM payment_providers WHERE payment_provider_name = 'Stripe' LIMIT 1"));
+    $stripe_provider = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT payment_provider_private_key FROM payment_providers WHERE payment_provider_name = 'Stripe' LIMIT 1"));
     if (!$stripe_provider) {
         exit("Stripe not enabled / configured");
     }
diff --git a/guest/guest_approve_ticket_task.php b/guest/guest_approve_ticket_task.php
index 087b48774..1e758da1b 100644
--- a/guest/guest_approve_ticket_task.php
+++ b/guest/guest_approve_ticket_task.php
@@ -38,7 +38,8 @@ $approval_id = intval($_GET['task_approval_id']);
 $url_key = escapeSql($_GET['url_key']);
 
 $task_row = mysqli_fetch_assoc(mysqli_query($mysqli,
-    "SELECT * FROM task_approvals
+    "SELECT approval_scope, approval_status, approval_type, task_id, task_name, ticket_details,
+        ticket_number, ticket_prefix, ticket_priority, ticket_status_name, ticket_subject FROM task_approvals
         LEFT JOIN tasks ON approval_task_id = task_id
         LEFT JOIN tickets on task_ticket_id = ticket_id
         LEFT JOIN ticket_statuses ON ticket_status = ticket_status_id
diff --git a/guest/guest_calendar_feed.php b/guest/guest_calendar_feed.php
index 722470a80..97a07b900 100644
--- a/guest/guest_calendar_feed.php
+++ b/guest/guest_calendar_feed.php
@@ -45,7 +45,7 @@ $feed_key = escapeSql($_GET['key']);
 
 $sql = mysqli_query(
     $mysqli,
-    "SELECT * FROM calendars
+    "SELECT calendar_id, calendar_name FROM calendars
     WHERE calendar_feed_key = '$feed_key'
     AND calendar_feed_key IS NOT NULL
     AND calendar_archived_at IS NULL
diff --git a/guest/guest_download_file.php b/guest/guest_download_file.php
index a0e21f7f9..16cf3ea05 100644
--- a/guest/guest_download_file.php
+++ b/guest/guest_download_file.php
@@ -15,7 +15,7 @@ if (isset($_GET['id']) && isset($_GET['key'])) {
     $item_id = intval($_GET['id']);
     $item_key = escapeSql($_GET['key']);
 
-    $sql = mysqli_query($mysqli, "SELECT * FROM shared_items WHERE item_id = $item_id AND item_key = '$item_key' AND item_expire_at > NOW() LIMIT 1");
+    $sql = mysqli_query($mysqli, "SELECT item_active, item_client_id, item_related_id, item_type, item_view_limit, item_views FROM shared_items WHERE item_id = $item_id AND item_key = '$item_key' AND item_expire_at > NOW() LIMIT 1");
     $row = mysqli_fetch_assoc($sql);
 
     $item_active = intval($row['item_active']);
@@ -49,7 +49,7 @@ if (isset($_GET['id']) && isset($_GET['key'])) {
         }
     }
 
-    $file_sql = mysqli_query($mysqli, "SELECT * FROM files WHERE file_id = $item_related_id AND file_client_id = $client_id LIMIT 1");
+    $file_sql = mysqli_query($mysqli, "SELECT file_client_id, file_name, file_reference_name FROM files WHERE file_id = $item_related_id AND file_client_id = $client_id LIMIT 1");
     $file_row = mysqli_fetch_assoc($file_sql);
 
     if (mysqli_num_rows($file_sql) !== 1 || !$file_row) {
diff --git a/guest/guest_pay_invoice_stripe.php b/guest/guest_pay_invoice_stripe.php
index 8109a55f7..d32258aa3 100644
--- a/guest/guest_pay_invoice_stripe.php
+++ b/guest/guest_pay_invoice_stripe.php
@@ -5,7 +5,7 @@ require_once 'includes/inc_all_guest.php';
 DEFINE("WORDING_PAYMENT_FAILED", "<br><h2>There was an error verifying your payment. Please contact us for more information before attempting payment again.</h2>");
 
 // --- Get Stripe config from payment_providers table ---
-$stripe_provider = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT * FROM payment_providers"));
+$stripe_provider = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT payment_provider_account, payment_provider_private_key, payment_provider_public_key FROM payment_providers"));
 
 
 $stripe_publishable      = escapeHtml($stripe_provider['payment_provider_public_key']);
@@ -21,7 +21,9 @@ if (isset($_GET['invoice_id'], $_GET['url_key']) && !isset($_GET['payment_intent
     // Query invoice details
     $sql = mysqli_query(
         $mysqli,
-        "SELECT * FROM invoices
+        "SELECT client_id, client_name, invoice_amount, invoice_currency_code, invoice_date,
+            invoice_discount_amount, invoice_due, invoice_id, invoice_number, invoice_prefix,
+            invoice_status FROM invoices
          LEFT JOIN clients ON invoice_client_id = client_id
          WHERE invoice_id = $invoice_id
          AND invoice_url_key = '$invoice_url_key'
@@ -54,7 +56,6 @@ if (isset($_GET['invoice_id'], $_GET['url_key']) && !isset($_GET['payment_intent
     $sql_company = mysqli_query($mysqli, "SELECT * FROM companies WHERE company_id = 1");
     $company_row = mysqli_fetch_assoc($sql_company);
     $company_locale = escapeHtml($company_row['company_locale']);
-    $config_base_url = escapeHtml($company_row['company_base_url'] ?? ''); // You might want to pull from settings if needed
 
     // Add up all payments made to the invoice
     $sql_amount_paid = mysqli_query($mysqli, "SELECT SUM(payment_amount) AS amount_paid FROM payments WHERE payment_invoice_id = $invoice_id");
@@ -62,7 +63,7 @@ if (isset($_GET['invoice_id'], $_GET['url_key']) && !isset($_GET['payment_intent
     $balance_to_pay = round($invoice_amount - $amount_paid, 2);
 
     // Get invoice items
-    $sql_invoice_items = mysqli_query($mysqli, "SELECT * FROM invoice_items WHERE item_invoice_id = $invoice_id ORDER BY item_id ASC");
+    $sql_invoice_items = mysqli_query($mysqli, "SELECT item_name, item_quantity, item_total FROM invoice_items WHERE item_invoice_id = $invoice_id ORDER BY item_id ASC");
 
     // Currency formatting
     $currency_format = numfmt_create($company_locale, NumberFormatter::CURRENCY);
@@ -182,7 +183,8 @@ if (isset($_GET['invoice_id'], $_GET['url_key']) && !isset($_GET['payment_intent
     // Get/Check invoice (& client/primary contact)
     $invoice_sql = mysqli_query(
         $mysqli,
-        "SELECT * FROM invoices
+        "SELECT client_id, client_name, contact_email, contact_name, invoice_amount, invoice_currency_code,
+            invoice_id, invoice_number, invoice_prefix, invoice_url_key FROM invoices
          LEFT JOIN clients ON invoice_client_id = client_id
          LEFT JOIN contacts ON clients.client_id = contacts.contact_client_id AND contact_primary = 1
          WHERE invoice_id = $pi_invoice_id
@@ -206,7 +208,7 @@ if (isset($_GET['invoice_id'], $_GET['url_key']) && !isset($_GET['payment_intent
     $contact_name = escapeSql($row['contact_name']);
     $contact_email = escapeSql($row['contact_email']);
 
-    $sql_company = mysqli_query($mysqli, "SELECT * FROM companies WHERE company_id = 1");
+    $sql_company = mysqli_query($mysqli, "SELECT company_locale, company_name, company_phone FROM companies WHERE company_id = 1");
     $row = mysqli_fetch_assoc($sql_company);
     $company_name = escapeSql($row['company_name']);
     $company_phone = escapeSql(formatPhoneNumber($row['company_phone']));
@@ -252,7 +254,8 @@ if (isset($_GET['invoice_id'], $_GET['url_key']) && !isset($_GET['payment_intent
     mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'Payment', log_action = 'Create', log_description = 'Stripe payment of $pi_currency $pi_amount_paid against invoice $invoice_prefix$invoice_number - $pi_id $extended_log_desc', log_ip = '$ip', log_user_agent = '$user_agent', log_client_id = $pi_client_id");
 
     // Email Receipt
-    $sql_settings = mysqli_query($mysqli, "SELECT * FROM settings WHERE company_id = 1");
+    $sql_settings = mysqli_query($mysqli, "SELECT config_invoice_from_email, config_invoice_from_name,
+        config_invoice_paid_notification_email, config_smtp_host FROM settings WHERE company_id = 1");
     $settings = mysqli_fetch_assoc($sql_settings);
 
     $config_smtp_host = $settings['config_smtp_host'];
diff --git a/guest/guest_post.php b/guest/guest_post.php
index b23a1ae2c..5dda1dce2 100644
--- a/guest/guest_post.php
+++ b/guest/guest_post.php
@@ -48,7 +48,9 @@ if (isset($_GET['accept_quote'], $_GET['url_key'])) {
         $row = mysqli_fetch_assoc($sql_company);
         $company_name = escapeSql($row['company_name']);
 
-        $sql_settings = mysqli_query($mysqli, "SELECT * FROM settings WHERE company_id = 1");
+        $sql_settings = mysqli_query($mysqli, "SELECT config_quote_from_email, config_quote_from_name, config_quote_notification_email,
+            config_smtp_encryption, config_smtp_host, config_smtp_password, config_smtp_port,
+            config_smtp_username FROM settings WHERE company_id = 1");
         $row = mysqli_fetch_assoc($sql_settings);
         $config_smtp_host = $row['config_smtp_host'];
         $config_smtp_port = intval($row['config_smtp_port']);
@@ -121,7 +123,9 @@ if (isset($_GET['decline_quote'], $_GET['url_key'])) {
         $row = mysqli_fetch_assoc($sql_company);
         $company_name = escapeSql($row['company_name']);
 
-        $sql_settings = mysqli_query($mysqli, "SELECT * FROM settings WHERE company_id = 1");
+        $sql_settings = mysqli_query($mysqli, "SELECT config_quote_from_email, config_quote_from_name, config_quote_notification_email,
+            config_smtp_encryption, config_smtp_host, config_smtp_password, config_smtp_port,
+            config_smtp_username FROM settings WHERE company_id = 1");
         $row = mysqli_fetch_assoc($sql_settings);
         $config_smtp_host = $row['config_smtp_host'];
         $config_smtp_port = intval($row['config_smtp_port']);
@@ -253,7 +257,8 @@ if (isset($_GET['approve_ticket_task'])) {
     $approval_id = intval($_GET['approval_id']);
     $url_key = escapeSql($_GET['approval_url_key']);
 
-    $approval_row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT * FROM task_approvals LEFT JOIN tasks on task_id = approval_task_id WHERE approval_id = $approval_id AND approval_task_id = $task_id AND approval_url_key = '$url_key' AND approval_status = 'pending'"));
+    $approval_row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT approval_created_by, approval_required_user_id, approval_scope, approval_type, task_name,
+        task_ticket_id FROM task_approvals LEFT JOIN tasks on task_id = approval_task_id WHERE approval_id = $approval_id AND approval_task_id = $task_id AND approval_url_key = '$url_key' AND approval_status = 'pending'"));
 
     $task_name = escapeHtml($approval_row['task_name']);
     $scope = escapeHtml($approval_row['approval_scope']);
@@ -287,7 +292,12 @@ if (isset($_GET['export_quote_pdf'])) {
 
     $sql = mysqli_query(
         $mysqli,
-        "SELECT * FROM quotes
+        "SELECT client_currency_code, client_id, client_name, client_net_terms, client_website,
+            contact_email, contact_extension, contact_mobile, contact_mobile_country_code,
+            contact_phone, contact_phone_country_code, location_address, location_city,
+            location_country, location_state, location_zip, quote_amount, quote_category_id,
+            quote_created_at, quote_currency_code, quote_date, quote_discount_amount, quote_expire,
+            quote_id, quote_note, quote_number, quote_prefix, quote_scope, quote_status, quote_url_key FROM quotes
         LEFT JOIN clients ON quote_client_id = client_id
         LEFT JOIN contacts ON clients.client_id = contacts.contact_client_id AND contact_primary = 1
         LEFT JOIN locations ON clients.client_id = locations.location_client_id AND location_primary = 1
@@ -332,7 +342,9 @@ if (isset($_GET['export_quote_pdf'])) {
             $client_net_terms = $config_default_net_terms;
         }
 
-        $sql = mysqli_query($mysqli, "SELECT * FROM companies, settings WHERE companies.company_id = settings.company_id AND companies.company_id = 1");
+        $sql = mysqli_query($mysqli, "SELECT company_address, company_city, company_country, company_email, settings.company_id,
+            company_locale, company_logo, company_name, company_phone, company_phone_country_code,
+            company_state, company_website, company_zip FROM companies, settings WHERE companies.company_id = settings.company_id AND companies.company_id = 1");
         $row = mysqli_fetch_assoc($sql);
 
         $company_id = intval($row['company_id']);
@@ -423,7 +435,7 @@ if (isset($_GET['export_quote_pdf'])) {
         $sub_total = 0;
         $total_tax = 0;
 
-        $sql_items = mysqli_query($mysqli, "SELECT * FROM quote_items WHERE item_quote_id = $quote_id ORDER BY item_order ASC");
+        $sql_items = mysqli_query($mysqli, "SELECT item_description, item_name, item_price, item_quantity, item_tax, item_total FROM quote_items WHERE item_quote_id = $quote_id ORDER BY item_order ASC");
         while ($item = mysqli_fetch_assoc($sql_items)) {
             $name = $item['item_name'];
             $desc = $item['item_description'];
@@ -488,7 +500,13 @@ if (isset($_GET['export_invoice_pdf'])) {
 
     $sql = mysqli_query(
         $mysqli,
-        "SELECT * FROM invoices
+        "SELECT client_currency_code, client_id, client_name, client_net_terms, client_website,
+            contact_email, contact_extension, contact_mobile, contact_mobile_country_code,
+            contact_phone, contact_phone_country_code, invoice_amount, invoice_category_id,
+            invoice_created_at, invoice_currency_code, invoice_date, invoice_discount_amount,
+            invoice_due, invoice_id, invoice_note, invoice_number, invoice_prefix, invoice_scope,
+            invoice_status, invoice_url_key, location_address, location_city, location_country,
+            location_state, location_zip FROM invoices
         LEFT JOIN clients ON invoice_client_id = client_id
         LEFT JOIN contacts ON clients.client_id = contacts.contact_client_id AND contact_primary = 1
         LEFT JOIN locations ON clients.client_id = locations.location_client_id AND location_primary = 1
@@ -533,7 +551,9 @@ if (isset($_GET['export_invoice_pdf'])) {
             $client_net_terms = $config_default_net_terms;
         }
 
-        $sql = mysqli_query($mysqli, "SELECT * FROM companies WHERE company_id = 1");
+        $sql = mysqli_query($mysqli, "SELECT company_address, company_city, company_country, company_email, company_id, company_locale,
+            company_logo, company_name, company_phone, company_phone_country_code, company_state,
+            company_tax_id, company_website, company_zip FROM companies WHERE company_id = 1");
         $row = mysqli_fetch_assoc($sql);
         $company_id = intval($row['company_id']);
         $company_name = escapeHtml($row['company_name']);
@@ -646,7 +666,7 @@ if (isset($_GET['export_invoice_pdf'])) {
         $sub_total = 0;
         $total_tax = 0;
 
-        $sql_items = mysqli_query($mysqli, "SELECT * FROM invoice_items WHERE item_invoice_id = $invoice_id ORDER BY item_order ASC");
+        $sql_items = mysqli_query($mysqli, "SELECT item_description, item_name, item_price, item_quantity, item_tax, item_total FROM invoice_items WHERE item_invoice_id = $invoice_id ORDER BY item_order ASC");
         while ($item = mysqli_fetch_assoc($sql_items)) {
             $name = $item['item_name'];
             $desc = $item['item_description'];
@@ -757,7 +777,7 @@ if (isset($_POST['guest_quote_upload_file'])) {
                     $dest_path = $upload_file_dir . $file_reference_name;
 
                     // Get/Create a top-level folder called Client Uploads
-                    $folder_sql = mysqli_query($mysqli, "SELECT * FROM folders WHERE folder_name = 'Client Uploads' AND parent_folder = 0 AND folder_client_id = $client_id LIMIT 1");
+                    $folder_sql = mysqli_query($mysqli, "SELECT folder_id FROM folders WHERE folder_name = 'Client Uploads' AND parent_folder = 0 AND folder_client_id = $client_id LIMIT 1");
                     if (mysqli_num_rows($folder_sql) == 1) {
                         // Get
                         $row = mysqli_fetch_assoc($folder_sql);
diff --git a/guest/guest_view_invoice.php b/guest/guest_view_invoice.php
index f430c3d5f..62a03ff31 100644
--- a/guest/guest_view_invoice.php
+++ b/guest/guest_view_invoice.php
@@ -14,7 +14,12 @@ $invoice_id = intval($_GET['invoice_id']);
 
 $sql = mysqli_query(
     $mysqli,
-    "SELECT * FROM invoices
+    "SELECT client_currency_code, client_id, client_name, client_net_terms, client_website,
+        contact_email, contact_extension, contact_mobile, contact_mobile_country_code,
+        contact_phone, contact_phone_country_code, invoice_amount, invoice_category_id,
+        invoice_currency_code, invoice_date, invoice_discount_amount, invoice_due, invoice_id,
+        invoice_note, invoice_number, invoice_prefix, invoice_status, location_address,
+        location_city, location_country, location_state, location_zip FROM invoices
     LEFT JOIN clients ON invoice_client_id = client_id
     LEFT JOIN locations ON clients.client_id = locations.location_client_id AND location_primary = 1
     LEFT JOIN contacts ON clients.client_id = contacts.contact_client_id AND contact_primary = 1
@@ -61,7 +66,9 @@ $client_website = escapeHtml($row['client_website']);
 $client_currency_code = escapeHtml($row['client_currency_code']);
 $client_net_terms = intval($row['client_net_terms']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM companies, settings WHERE companies.company_id = settings.company_id AND companies.company_id = 1");
+$sql = mysqli_query($mysqli, "SELECT company_address, company_city, company_country, company_email, company_locale,
+    company_logo, company_name, company_phone, company_phone_country_code, company_state,
+    company_tax_id, company_website, company_zip, config_invoice_footer FROM companies, settings WHERE companies.company_id = settings.company_id AND companies.company_id = 1");
 $row = mysqli_fetch_assoc($sql);
 
 $company_name = escapeHtml($row['company_name']);
@@ -88,7 +95,7 @@ $company_locale = escapeHtml($row['company_locale']);
 $config_invoice_footer = escapeHtml($row['config_invoice_footer']);
 
 // Get Payment Provide Details
-$sql = mysqli_query($mysqli, "SELECT * FROM payment_providers WHERE payment_provider_active = 1 LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT payment_provider_id, payment_provider_name, payment_provider_threshold FROM payment_providers WHERE payment_provider_active = 1 LIMIT 1");
 $row = mysqli_fetch_assoc($sql);
 $payment_provider_id = intval($row['payment_provider_id']);
 $payment_provider_name = escapeHtml($row['payment_provider_name']);
@@ -135,7 +142,7 @@ if ($invoice_status !== "Paid" && $invoice_status !== "Draft" && $invoice_status
 }
 
 // Invoice individual items
-$sql_invoice_items = mysqli_query($mysqli, "SELECT * FROM invoice_items WHERE item_invoice_id = $invoice_id ORDER BY item_order ASC");
+$sql_invoice_items = mysqli_query($mysqli, "SELECT item_description, item_id, item_name, item_price, item_quantity, item_tax, item_total FROM invoice_items WHERE item_invoice_id = $invoice_id ORDER BY item_order ASC");
 
 
 // Get Total Account Balance
@@ -358,7 +365,8 @@ if ($balance > 0) {
 
 // CURRENT INVOICES
 
-$sql_current_invoices = mysqli_query($mysqli, "SELECT * FROM invoices WHERE invoice_client_id = $client_id AND invoice_due > CURDATE() AND(invoice_status = 'Sent' OR invoice_status = 'Viewed' OR invoice_status = 'Partial') ORDER BY invoice_number DESC");
+$sql_current_invoices = mysqli_query($mysqli, "SELECT invoice_amount, invoice_currency_code, invoice_date, invoice_due, invoice_id,
+    invoice_number, invoice_prefix, invoice_url_key FROM invoices WHERE invoice_client_id = $client_id AND invoice_due > CURDATE() AND(invoice_status = 'Sent' OR invoice_status = 'Viewed' OR invoice_status = 'Partial') ORDER BY invoice_number DESC");
 
 $current_invoices_count = mysqli_num_rows($sql_current_invoices);
 
@@ -420,7 +428,8 @@ if ($current_invoices_count > 0) { ?>
 
 // OUTSTANDING INVOICES
 
-$sql_outstanding_invoices = mysqli_query($mysqli, "SELECT * FROM invoices WHERE invoice_client_id = $client_id AND invoice_due < CURDATE() AND(invoice_status = 'Sent' OR invoice_status = 'Viewed' OR invoice_status = 'Partial') ORDER BY invoice_date DESC");
+$sql_outstanding_invoices = mysqli_query($mysqli, "SELECT invoice_amount, invoice_currency_code, invoice_date, invoice_due, invoice_id,
+    invoice_number, invoice_prefix, invoice_url_key FROM invoices WHERE invoice_client_id = $client_id AND invoice_due < CURDATE() AND(invoice_status = 'Sent' OR invoice_status = 'Viewed' OR invoice_status = 'Partial') ORDER BY invoice_date DESC");
 
 $outstanding_invoices_count = mysqli_num_rows($sql_outstanding_invoices);
 
diff --git a/guest/guest_view_item.php b/guest/guest_view_item.php
index f513c5161..1515f63fd 100644
--- a/guest/guest_view_item.php
+++ b/guest/guest_view_item.php
@@ -15,7 +15,9 @@ $purifier_config->set('Cache.DefinitionImpl', null); // Disable cache by setting
 $purifier_config->set('URI.AllowedSchemes', ['data' => true, 'src' => true, 'http' => true, 'https' => true]);
 $purifier = new HTMLPurifier($purifier_config);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM companies, settings WHERE companies.company_id = settings.company_id AND companies.company_id = 1");
+$sql = mysqli_query($mysqli, "SELECT company_address, company_city, company_email, company_locale, company_logo, company_name,
+    company_phone, company_phone_country_code, company_state, company_website, company_zip,
+    config_invoice_footer FROM companies, settings WHERE companies.company_id = settings.company_id AND companies.company_id = 1");
 $row = mysqli_fetch_assoc($sql);
 
 $company_name = escapeHtml($row['company_name']);
@@ -47,7 +49,9 @@ if (!isset($_GET['id']) || !isset($_GET['key'])) {
 $item_id = intval($_GET['id']);
 $item_key = escapeSql($_GET['key']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM shared_items WHERE item_id = $item_id AND item_key = '$item_key' AND item_expire_at > NOW() LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT item_active, item_client_id, item_created_at, item_encrypted_credential,
+    item_encrypted_username, item_expire_at, item_note, item_recipient, item_related_id,
+    item_type, item_view_limit, item_views FROM shared_items WHERE item_id = $item_id AND item_key = '$item_key' AND item_expire_at > NOW() LIMIT 1");
 $row = mysqli_fetch_assoc($sql);
 
 // Check we got a result
@@ -171,7 +175,7 @@ if ($item_type == "Document") {
 } elseif ($item_type == "Credential") {
     $encryption_key = $_GET['ek'];
 
-    $credential_sql = mysqli_query($mysqli, "SELECT * FROM credentials WHERE credential_id = $item_related_id AND credential_client_id = $client_id LIMIT 1");
+    $credential_sql = mysqli_query($mysqli, "SELECT credential_id, credential_name, credential_note, credential_otp_secret, credential_uri FROM credentials WHERE credential_id = $item_related_id AND credential_client_id = $client_id LIMIT 1");
     $credential_row = mysqli_fetch_assoc($credential_sql);
     if (mysqli_num_rows($credential_sql) !== 1 || !$credential_row) {
         echo "<div class='alert alert-danger'>Error retrieving login.</div>";
diff --git a/guest/guest_view_quote.php b/guest/guest_view_quote.php
index f9ce5f4b6..e4363843a 100644
--- a/guest/guest_view_quote.php
+++ b/guest/guest_view_quote.php
@@ -16,7 +16,12 @@ $quote_id = intval($_GET['quote_id']);
 
 $sql = mysqli_query(
     $mysqli,
-    "SELECT * FROM quotes
+    "SELECT client_currency_code, client_id, client_name, client_website, contact_email,
+        contact_extension, contact_mobile, contact_mobile_country_code, contact_phone,
+        contact_phone_country_code, location_address, location_city, location_country,
+        location_state, location_zip, quote_amount, quote_currency_code, quote_date,
+        quote_discount_amount, quote_expire, quote_id, quote_note, quote_number, quote_prefix,
+        quote_status FROM quotes
     LEFT JOIN clients ON quote_client_id = client_id
     LEFT JOIN contacts ON clients.client_id = contacts.contact_client_id AND contact_primary = 1
     LEFT JOIN locations ON clients.client_id = locations.location_client_id AND location_primary = 1
@@ -61,7 +66,9 @@ $contact_mobile = escapeHtml(formatPhoneNumber($row['contact_mobile'], $contact_
 $client_website = escapeHtml($row['client_website']);
 $client_currency_code = escapeHtml($row['client_currency_code']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM companies, settings WHERE companies.company_id = settings.company_id AND companies.company_id = 1");
+$sql = mysqli_query($mysqli, "SELECT company_address, company_city, company_country, company_email, company_locale,
+    company_logo, company_name, company_phone, company_phone_country_code, company_state,
+    company_website, company_zip, config_quote_footer FROM companies, settings WHERE companies.company_id = settings.company_id AND companies.company_id = 1");
 $row = mysqli_fetch_assoc($sql);
 $company_name = escapeHtml($row['company_name']);
 $company_address = escapeHtml($row['company_address']);
@@ -174,7 +181,7 @@ if ($quote_status == "Draft" || $quote_status == "Sent" || $quote_status == "Vie
             </div>
         </div>
 
-        <?php $sql_items = mysqli_query($mysqli, "SELECT * FROM quote_items WHERE item_quote_id = $quote_id ORDER BY item_order ASC"); ?>
+        <?php $sql_items = mysqli_query($mysqli, "SELECT item_description, item_id, item_name, item_price, item_quantity, item_tax, item_total FROM quote_items WHERE item_quote_id = $quote_id ORDER BY item_order ASC"); ?>
 
         <div class="row mb-3">
             <div class="col-md-12">
diff --git a/guest/guest_view_ticket.php b/guest/guest_view_ticket.php
index 8a5544362..b4e4e4270 100644
--- a/guest/guest_view_ticket.php
+++ b/guest/guest_view_ticket.php
@@ -147,7 +147,9 @@ if ($ticket_row) {
     <br>
 
     <?php
-    $sql = mysqli_query($mysqli, "SELECT * FROM ticket_replies LEFT JOIN users ON ticket_reply_by = user_id LEFT JOIN contacts ON ticket_reply_by = contact_id WHERE ticket_reply_ticket_id = $ticket_id AND ticket_reply_archived_at IS NULL AND ticket_reply_type != 'Internal' ORDER BY ticket_reply_id DESC");
+    $sql = mysqli_query($mysqli, "SELECT contact_name, contact_photo, ticket_reply, ticket_reply_by, ticket_reply_created_at,
+        ticket_reply_id, ticket_reply_type, ticket_reply_updated_at, user_avatar, user_id,
+        user_name FROM ticket_replies LEFT JOIN users ON ticket_reply_by = user_id LEFT JOIN contacts ON ticket_reply_by = contact_id WHERE ticket_reply_ticket_id = $ticket_id AND ticket_reply_archived_at IS NULL AND ticket_reply_type != 'Internal' ORDER BY ticket_reply_id DESC");
 
     while ($row = mysqli_fetch_assoc($sql)) {
         $ticket_reply_id = intval($row['ticket_reply_id']);
diff --git a/includes/app_version.php b/includes/app_version.php
index 49e871292..188420bc1 100644
--- a/includes/app_version.php
+++ b/includes/app_version.php
@@ -5,4 +5,4 @@
  * Update this file each time we merge develop into master. Format is YY.MM (add a .v if there is more than one release a month.
  */
 
-DEFINE("APP_VERSION", "26.08");
+DEFINE("APP_VERSION", "26.08.1");
diff --git a/includes/load_company_settings.php b/includes/load_company_settings.php
index e4b86a54a..722010c94 100644
--- a/includes/load_company_settings.php
+++ b/includes/load_company_settings.php
@@ -1,5 +1,5 @@
 <?php
-$sql = mysqli_query($mysqli, "SELECT * FROM companies, settings WHERE settings.company_id = companies.company_id AND companies.company_id = 1");
+$sql = mysqli_query($mysqli, "SELECT company_country, company_currency, company_locale, company_name FROM companies, settings WHERE settings.company_id = companies.company_id AND companies.company_id = 1");
 $row = mysqli_fetch_assoc($sql);
 
 $session_company_name = $row['company_name'];
diff --git a/includes/load_global_settings.php b/includes/load_global_settings.php
index 6931145a1..24e151987 100644
--- a/includes/load_global_settings.php
+++ b/includes/load_global_settings.php
@@ -1,7 +1,37 @@
 <?php
 
 // Query Settings
-$sql_settings = mysqli_query($mysqli, "SELECT * FROM settings WHERE company_id = 1");
+$sql_settings = mysqli_query($mysqli, "SELECT config_azure_client_id, config_azure_client_secret, config_client_portal_enable,
+    config_current_database_version, config_default_calendar, config_default_expense_account,
+    config_default_expense_payment_method, config_default_hourly_rate,
+    config_default_net_terms, config_default_payment_account, config_default_payment_method,
+    config_default_transfer_from_account, config_default_transfer_to_account,
+    config_destructive_deletes_enable, config_enable_alert_domain_expire, config_enable_cron,
+    config_imap_encryption, config_imap_host, config_imap_password, config_imap_port,
+    config_imap_provider, config_imap_username, config_invoice_footer,
+    config_invoice_from_email, config_invoice_from_name, config_invoice_late_fee_enable,
+    config_invoice_late_fee_percent, config_invoice_next_number,
+    config_invoice_paid_notification_email, config_invoice_prefix, config_invoice_show_tax_id,
+    config_log_retention, config_login_key_required, config_login_key_secret,
+    config_login_message, config_login_remember_me_expire, config_mail_from_email,
+    config_mail_from_name, config_mail_oauth_access_token,
+    config_mail_oauth_access_token_expires_at, config_mail_oauth_client_id,
+    config_mail_oauth_client_secret, config_mail_oauth_refresh_token,
+    config_mail_oauth_tenant_id, config_module_enable_accounting, config_module_enable_itdoc,
+    config_module_enable_ticketing, config_project_next_number, config_project_prefix,
+    config_quote_footer, config_quote_from_email, config_quote_from_name,
+    config_quote_next_number, config_quote_notification_email, config_quote_prefix,
+    config_recurring_auto_send_invoice, config_recurring_invoice_next_number,
+    config_recurring_invoice_prefix, config_send_invoice_reminders, config_smtp_encryption,
+    config_smtp_host, config_smtp_password, config_smtp_port, config_smtp_provider,
+    config_smtp_username, config_start_page, config_telemetry, config_theme,
+    config_ticket_autoclose_hours, config_ticket_client_general_notifications,
+    config_ticket_default_billable, config_ticket_default_view, config_ticket_email_parse,
+    config_ticket_email_parse_unknown_senders, config_ticket_from_email,
+    config_ticket_from_name, config_ticket_moving_columns,
+    config_ticket_new_ticket_notification_email, config_ticket_next_number,
+    config_ticket_ordering, config_ticket_prefix, config_ticket_timer_autostart,
+    config_timezone, config_whitelabel_enabled, config_whitelabel_key FROM settings WHERE company_id = 1");
 $row = mysqli_fetch_assoc($sql_settings);
 
 // Database version
diff --git a/includes/load_user_session.php b/includes/load_user_session.php
index 00c3997af..686f25ecd 100644
--- a/includes/load_user_session.php
+++ b/includes/load_user_session.php
@@ -6,7 +6,9 @@ $session_user_id = intval($_SESSION['user_id']);
 
 $sql = mysqli_query(
     $mysqli,
-    "SELECT * FROM users
+    "SELECT role_is_admin, role_name, user_archived_at, user_avatar, user_config_force_mfa,
+        user_config_records_per_page, user_config_theme_dark, user_email, user_name, user_role_id,
+        user_status, user_token, user_type FROM users
      LEFT JOIN user_settings ON users.user_id = user_settings.user_id
      LEFT JOIN user_roles ON user_role_id = role_id
      WHERE users.user_id = $session_user_id"
@@ -62,17 +64,3 @@ while ($row = mysqli_fetch_assoc($user_client_access_result)) {
         $client_access_array[] = (int) $row['client_id'];
     }
 }
-
-$client_access_string = implode(',', $client_access_array);
-$client_deny_string = implode(',', $client_deny_array);
-
-$access_permission_query = "";
-if (!$session_is_admin) {
-    // Restrict to the allow list (if any), then subtract the deny list
-    if ($client_access_string) {
-        $access_permission_query .= " AND clients.client_id IN ($client_access_string)";
-    }
-    if ($client_deny_string) {
-        $access_permission_query .= " AND clients.client_id NOT IN ($client_deny_string)";
-    }
-}
diff --git a/includes/top_nav.php b/includes/top_nav.php
index 27b73f3ea..eddbefc4d 100644
--- a/includes/top_nav.php
+++ b/includes/top_nav.php
@@ -30,7 +30,7 @@
 
         <!--Custom Nav Link -->
         <?php
-        $sql_custom_links = mysqli_query($mysqli, "SELECT * FROM custom_links WHERE custom_link_location = 2 AND custom_link_archived_at IS NULL
+        $sql_custom_links = mysqli_query($mysqli, "SELECT custom_link_icon, custom_link_name, custom_link_new_tab, custom_link_uri FROM custom_links WHERE custom_link_location = 2 AND custom_link_archived_at IS NULL
             ORDER BY custom_link_order ASC, custom_link_name ASC"
         );
 
diff --git a/js/app.js b/js/app.js
index 0b988a571..e1b08476e 100644
--- a/js/app.js
+++ b/js/app.js
@@ -145,13 +145,23 @@ $(document).ready(function() {
                             return response.json();
                         })
                         .then(data => {
-                            editor.undoManager.transact(function() {
-                                editor.setContent(data.rewordedText || 'Error: Could not reword the text.');
-                            });
-
                             editor.setProgressState(false);
                             rewordButtonApi.setEnabled(true);
 
+                            // Leave the user's text alone if the reword failed
+                            if (data.error || !data.rewordedText) {
+                                editor.notificationManager.open({
+                                    text: data.error || 'Could not reword the text.',
+                                    type: 'error',
+                                    timeout: 8000
+                                });
+                                return;
+                            }
+
+                            editor.undoManager.transact(function() {
+                                editor.setContent(data.rewordedText);
+                            });
+
                             editor.notificationManager.open({
                                 text: 'Text reworded successfully!',
                                 type: 'success',
@@ -245,7 +255,7 @@ $(document).ready(function() {
                     rewordButtonApi.setEnabled(false);
                     editor.setProgressState(true);
 
-                    fetch('ajax.php?ai_reword', {
+                    fetch('ajax.php?ai_reword&use_case=Tickets', {
                         method: 'POST',
                         headers: { 'Content-Type': 'application/json' },
                         body: JSON.stringify({ text: content }),
@@ -255,11 +265,22 @@ $(document).ready(function() {
                             return response.json();
                         })
                         .then(data => {
-                            editor.undoManager.transact(function() {
-                                editor.setContent(data.rewordedText || 'Error: Could not reword the text.');
-                            });
                             editor.setProgressState(false);
                             rewordButtonApi.setEnabled(true);
+
+                            // Leave the user's text alone if the reword failed
+                            if (data.error || !data.rewordedText) {
+                                editor.notificationManager.open({
+                                    text: data.error || 'Could not reword the text.',
+                                    type: 'error',
+                                    timeout: 8000
+                                });
+                                return;
+                            }
+
+                            editor.undoManager.transact(function() {
+                                editor.setContent(data.rewordedText);
+                            });
                             editor.notificationManager.open({
                                 text: 'Text reworded successfully!',
                                 type: 'success',
diff --git a/post/misc.php b/post/misc.php
index 492545ff8..321bf92f4 100644
--- a/post/misc.php
+++ b/post/misc.php
@@ -39,7 +39,7 @@ if (isset($_GET['dismiss_all_notifications'])) {
 
     validateCSRFToken();
 
-    $sql = mysqli_query($mysqli,"SELECT * FROM notifications WHERE notification_user_id = $session_user_id AND notification_dismissed_at IS NULL");
+    $sql = mysqli_query($mysqli,"SELECT notification_dismissed_at, notification_id FROM notifications WHERE notification_user_id = $session_user_id AND notification_dismissed_at IS NULL");
 
     $num_notifications = mysqli_num_rows($sql);
 
diff --git a/scripts/setup_cli.php b/scripts/setup_cli.php
index fe00d8e1f..7cbf9f024 100644
--- a/scripts/setup_cli.php
+++ b/scripts/setup_cli.php
@@ -301,7 +301,8 @@ if (!$non_interactive) {
         echo "Any comments to include? Press Enter if none: ";
         $comments = trim(fgets(STDIN));
 
-        $sql = mysqli_query($mysqli,"SELECT * FROM companies WHERE company_id = 1");
+        $sql = mysqli_query($mysqli,"SELECT company_city, company_country, company_currency, company_name, company_state,
+            company_website FROM companies WHERE company_id = 1");
         $row = mysqli_fetch_assoc($sql);
         $company_name_db = $row['company_name'];
         $website_db = $row['company_website'];
diff --git a/setup/index.php b/setup/index.php
index 03e5ddc5e..72d4f8dad 100644
--- a/setup/index.php
+++ b/setup/index.php
@@ -15,22 +15,25 @@ $can_show_restore = false;
 $should_skip_to_user = false;
 
 /*
- * An install with users in it is a live install, and setup is closed on one whatever
- * config.php says.
+ * How far through the wizard this install already is. Each step is a separate question
+ * because each one guards a different handler below - answering all of them with "are there
+ * users?" is what used to lock the wizard out three steps early.
  *
- * This used to default $config_enable_setup to 1 when the flag was absent, which fails the
- * wrong way: config.php is written when the database step completes but the flag is only
- * appended at the very end of a successful run, so an install abandoned in between - or one
- * where that final append failed - left the restore below reachable with no authentication
- * at all. That endpoint drops every table and imports whatever archive it is handed, and it
- * rewrites the uploads directory, including the .htaccess that stops PHP running there.
+ *   $install_is_live   - users exist. A restore would destroy real data, so restore closes
+ *                        and points at the CLI. One user row is enough.
+ *   $company_exists    - the company step has run (companies row, and settings seeded).
+ *   $localization_done - the localization step has run (company_locale filled in).
  */
 $install_is_live = false;
+$company_exists = false;
+$localization_done = false;
+$resume_step = 'checks';
 
 if (file_exists("../config.php") && $mysqli_available) {
     $table_result = mysqli_query($mysqli, "SHOW TABLES LIKE 'users'");
     if ($table_result && mysqli_num_rows($table_result) > 0) {
         $should_skip_to_user = true;
+        $resume_step = 'user';
 
         $user_count_result = mysqli_query($mysqli, "SELECT COUNT(*) AS user_count FROM users");
         if ($user_count_result) {
@@ -44,6 +47,26 @@ if (file_exists("../config.php") && $mysqli_available) {
         }
     }
 
+    if ($install_is_live) {
+        $resume_step = 'company';
+
+        $company_result = mysqli_query($mysqli, "SELECT company_locale FROM companies WHERE company_id = 1");
+        if (!$company_result) {
+            // Cannot prove either step is outstanding, so treat both as done
+            $company_exists = true;
+            $localization_done = true;
+            $resume_step = 'telemetry';
+        } elseif ($company_row = mysqli_fetch_assoc($company_result)) {
+            $company_exists = true;
+            $resume_step = 'localization';
+
+            if (trim($company_row['company_locale'] ?? '') !== '') {
+                $localization_done = true;
+                $resume_step = 'telemetry';
+            }
+        }
+    }
+
     // Restore needs a database connection and an empty install. A populated one restores
     // from the command line instead - scripts/restore_cli.php.
     if (!$install_is_live) {
@@ -54,11 +77,27 @@ if (file_exists("../config.php") && $mysqli_available) {
     }
 }
 
+/*
+ * config.php is written when the database step completes, but $config_enable_setup is only
+ * appended to it by the LAST step, so the flag is absent for the whole middle of an install
+ * and the wizard has to stay open across that gap or it cannot be finished.
+ *
+ * Deriving the flag from the database instead - closing setup as soon as the install looked
+ * "live" - is what stranded people: the first user made it live, three steps before there
+ * were companies or settings rows, and /setup and /login.php then redirected at each other
+ * until the browser gave up. Deriving it from any later step has the same shape, because the
+ * step that writes the flag is behind the gate that reads it.
+ *
+ * So the page stays open until the flag says otherwise, and each handler below refuses to run
+ * a second time on its own. That keeps the reason the derived flag was added in the first
+ * place - the restore handler drops every table, imports whatever archive it is handed and
+ * rewrites the uploads directory - without the page-level gate that came with it.
+ */
 if (!isset($config_enable_setup)) {
-    $config_enable_setup = $install_is_live ? 0 : 1;
+    $config_enable_setup = 1;
 }
 
-if ($config_enable_setup == 0 || $install_is_live) {
+if ($config_enable_setup == 0) {
     header("Location: /login.php");
     exit;
 }
@@ -246,8 +285,12 @@ if (isset($_POST['restore'])) {
 }
 
 if (isset($_POST['add_user'])) {
-    $user_count = mysqli_num_rows(mysqli_query($mysqli,"SELECT COUNT(*) FROM users"));
-    if ($user_count < 0) {
+
+    // SELECT COUNT(*) returns exactly one row whatever the count is, so the mysqli_num_rows()
+    // test this replaces was always 1 and never fired: a resubmitted form created a second
+    // user and then died on the duplicate user_settings row. $install_is_live is the same
+    // count, taken at the top of the file, and it fails closed.
+    if ($install_is_live) {
         $_SESSION['alert_message'] = "Users already exist in the database. Clear them to reconfigure here.";
         header("Location: ?company");
         exit;
@@ -265,7 +308,10 @@ if (isset($_POST['add_user'])) {
 
     mysqli_query($mysqli,"INSERT INTO users SET user_name = '$name', user_email = '$email', user_password = '$password', user_specific_encryption_ciphertext = '$user_specific_encryption_ciphertext', user_role_id = 3");
 
-    mkdirMissing("../uploads/users/1");
+    // Normally 1, but the table's AUTO_INCREMENT can already have moved on, so ask for it.
+    $user_id = intval(mysqli_insert_id($mysqli));
+
+    mkdirMissing("../uploads/users/$user_id");
 
     //Check to see if a file is attached
     if ($_FILES['file']['tmp_name'] != '') {
@@ -295,13 +341,13 @@ if (isset($_POST['add_user'])) {
 
         if ($file_error == 0) {
             // directory in which the uploaded file will be moved
-            $upload_file_dir = "../uploads/users/1/";
+            $upload_file_dir = "../uploads/users/$user_id/";
             $dest_path = $upload_file_dir . $new_file_name;
 
             move_uploaded_file($file_tmp_path, $dest_path);
 
             //Set Avatar
-            mysqli_query($mysqli,"UPDATE users SET user_avatar = '$new_file_name' WHERE user_id = 1");
+            mysqli_query($mysqli,"UPDATE users SET user_avatar = '$new_file_name' WHERE user_id = $user_id");
 
             $_SESSION['alert_message'] = 'File successfully uploaded.';
         } else {
@@ -311,7 +357,7 @@ if (isset($_POST['add_user'])) {
     }
 
     //Create Settings
-    mysqli_query($mysqli,"INSERT INTO user_settings SET user_id = 1");
+    mysqli_query($mysqli,"INSERT INTO user_settings SET user_id = $user_id");
 
     $_SESSION['alert_message'] = "User <strong>$name</strong> created";
 
@@ -322,6 +368,13 @@ if (isset($_POST['add_user'])) {
 
 if (isset($_POST['add_company_settings'])) {
 
+    // Run once. A second pass would add a second companies row and re-seed the defaults.
+    if ($company_exists) {
+        $_SESSION['alert_message'] = "Company details have already been saved.";
+        header("Location: ?localization");
+        exit;
+    }
+
     $name = escapeSql($_POST['name']);
     $country = escapeSql($_POST['country']);
     $address = escapeSql($_POST['address']);
@@ -388,6 +441,13 @@ if (isset($_POST['add_company_settings'])) {
 
 if (isset($_POST['add_localization_settings'])) {
 
+    // Run once. A second pass would add a second Cash account.
+    if ($localization_done) {
+        $_SESSION['alert_message'] = "Localization has already been saved.";
+        header("Location: ?telemetry");
+        exit;
+    }
+
     $locale = escapeSql($_POST['locale']);
     $currency_code = escapeSql($_POST['currency_code']);
     $timezone = escapeSql($_POST['timezone']);
@@ -414,7 +474,8 @@ if (isset($_POST['add_telemetry'])) {
 
         $comments = escapeSql($_POST['comments']);
 
-        $sql = mysqli_query($mysqli,"SELECT * FROM companies WHERE company_id = 1");
+        $sql = mysqli_query($mysqli,"SELECT company_city, company_country, company_currency, company_name, company_state,
+            company_website FROM companies WHERE company_id = 1");
         $row = mysqli_fetch_assoc($sql);
 
         $company_name = $row['company_name'];
@@ -1047,6 +1108,14 @@ if (isset($_POST['add_telemetry'])) {
                         </div>
                         <div class="card-body">
 
+                            <?php if ($install_is_live): ?>
+
+                                <p>This install already has a user - the rest of your team is added from Admin &gt; Users once you are logged in.</p>
+                                <hr>
+                                <a href="?<?= $resume_step ?>" class="btn btn-primary text-bold">Continue Setup <i class="fa fa-fw fa-arrow-circle-right"></i></a>
+
+                            <?php else: ?>
+
                             <form method="post" enctype="multipart/form-data" autocomplete="off">
                                 <div class="form-group">
                                     <label>Name <strong class="text-danger">*</strong></label>
@@ -1090,6 +1159,9 @@ if (isset($_POST['add_telemetry'])) {
 
                                 <button type="submit" name="add_user" class="btn btn-primary text-bold">Next (Company details) <i class="fa fa-fw fa-arrow-circle-right"></i></button>
                             </form>
+
+                            <?php endif; ?>
+
                         </div>
                     </div>
 
@@ -1100,6 +1172,14 @@ if (isset($_POST['add_telemetry'])) {
                             <h3 class="card-title"><i class="fas fa-fw fa-briefcase mr-2"></i>Step 4 - Company Details</h3>
                         </div>
                         <div class="card-body">
+
+                            <?php if ($company_exists): ?>
+
+                                <p>Company details have already been saved - they can be changed later from Admin &gt; Settings.</p>
+                                <hr>
+                                <a href="?<?= $resume_step ?>" class="btn btn-primary text-bold">Continue Setup <i class="fa fa-fw fa-arrow-circle-right"></i></a>
+
+                            <?php else: ?>
                             <form method="post" enctype="multipart/form-data" autocomplete="off">
 
                                 <div class="form-group">
@@ -1219,6 +1299,9 @@ if (isset($_POST['add_telemetry'])) {
                                 </button>
 
                             </form>
+
+                            <?php endif; ?>
+
                         </div>
                     </div>
 
@@ -1229,6 +1312,14 @@ if (isset($_POST['add_telemetry'])) {
                             <h3 class="card-title"><i class="fas fa-fw fa-globe-americas mr-2"></i>Step 5 - Region and Language</h3>
                         </div>
                         <div class="card-body">
+
+                            <?php if ($localization_done): ?>
+
+                                <p>Localization has already been saved - it can be changed later from Admin &gt; Settings.</p>
+                                <hr>
+                                <a href="?<?= $resume_step ?>" class="btn btn-primary text-bold">Continue Setup <i class="fa fa-fw fa-arrow-circle-right"></i></a>
+
+                            <?php else: ?>
                             <form method="post" autocomplete="off">
 
                                 <div class="form-group">
@@ -1283,6 +1374,9 @@ if (isset($_POST['add_telemetry'])) {
                                 </button>
 
                             </form>
+
+                            <?php endif; ?>
+
                         </div>
                     </div>
 
@@ -1355,7 +1449,11 @@ if (isset($_POST['add_telemetry'])) {
                                 <li>Don't hesitate to reach out on the <a href="https://forum.itflow.org/t/support" target="_blank">forums</a> if you need any assistance</li>
                                 <li><i>Apache/PHP Error log: <?= $errorLog ?></i></li>
                             </ul>
-                            <br><p>A database must be created before proceeding - click on the button below to get started.</p>
+                            <?php if ($install_is_live): ?>
+                                <br><p>This install was left part-way through setup - click on the button below to pick up where it stopped.</p>
+                            <?php else: ?>
+                                <br><p>A database must be created before proceeding - click on the button below to get started.</p>
+                            <?php endif; ?>
                             <br><hr>
                             <p class="text-muted">ITFlow is <b>free software</b>: you can redistribute and/or modify it under the terms of the <a href="https://www.gnu.org/licenses/gpl-3.0.en.html" target="_blank">GNU General Public License</a>. <br> It is distributed in the hope that it will be useful, but <b>without any warranty</b>; without even the implied warranty of merchantability or fitness for a particular purpose.</p>
                             <?php
@@ -1366,7 +1464,11 @@ if (isset($_POST['add_telemetry'])) {
                             ?>
                             <hr>
                             <div class="text-center">
-                                <?php if ($should_skip_to_user): ?>
+                                <?php if ($install_is_live): ?>
+                                    <a href="?<?= $resume_step ?>" class="btn btn-primary text-bold mr-2">
+                                        Continue Setup <i class="fas fa-fw fa-arrow-alt-circle-right ml-2"></i>
+                                    </a>
+                                <?php elseif ($should_skip_to_user): ?>
                                     <a href="?user" class="btn btn-primary text-bold mr-2">
                                         Create First User <i class="fas fa-fw fa-user ml-2"></i>
                                     </a>