Merge pull request #1294 from itflow-org/develop

Develop to Master for point release

CHANGELOG.md

@@ -2,6 +2,37 @@
 
 This file documents all notable changes made to ITFlow.
 
+## [26.08.1] Maint Release
+
+### Upgrading to 26.08.1
+
+Update the files from Settings > Update as normal. This release moves the database to 2.6.7 and the web updater completes it for you — the command line step that 26.08 required is not needed again.
+
+### Breaking Changes and Notes
+
+- Client access: agents with restricted client access now see records that have no client assigned. Previously this varied by page — unassigned tickets and projects were visible, unassigned expenses and credentials were not. It is now consistent everywhere.
+
+### Bug Fixes
+- Setup: fixed the wizard closing itself after the first user, which left new 26.08 installs stuck in a redirect loop between `/setup` and `/login.php`.
+- API: tightened client scoping on the expense read and record update endpoints.
+- Income: revenue rows now respect restricted client access.
+- Client PDF Export: fixed the export producing a CSV file, and each section is now gated on the module that owns it.
+- AI: fixed model creation, per-use-case model selection, configurable temperature, and error reporting.
+- Ticket: system-generated replies no longer record time worked that was never worked.
+- Ticket: fixed an error when scheduling a ticket.
+- Ticket: cancelling a schedule now cancels the calendar event on the recipient's calendar.
+- Ticket: history no longer records a status change when the status did not change.
+- Recurring Ticket: bulk priority changes no longer deny access to agents who are not administrators.
+- Contact: deleting a contact now removes the linked portal user, and anonymizing now redacts the phone number.
+- Calendar: fixed event deletion.
+
+### New Features & Updates
+- Performance: queries now select only the columns they use instead of `SELECT *`, cutting memory use and query time across the app and especially in the crons.
+- Performance: removed client joins that were only there for scoping — side nav badge counts are significantly faster.
+- Client scoping: added a `clientScopeSql()` helper so list queries scope on the owning column instead of a joined `clients.client_id`.
+- Contributing: documented the column-selection and client-scoping conventions.
+
+
 ## [26.08]
  
 ### Upgrading to 26.08

CONTRIBUTING.md

@@ -74,6 +74,10 @@ if (isset($_POST['edit_ticket_priority'])) {
 ### The `_model.php` pattern
  
 Files named `agent/post/*_model.php` hold shared field collection/sanitization logic used by both the create and edit blocks of a module (e.g. `asset_model.php` is included by both `add_asset` and `edit_asset`). If create and edit share more than a couple of fields, use this pattern rather than duplicating. Model files carry the same `FROM_POST_HANDLER` guard and are excluded from the dispatcher's auto-load.
+
+**`_model.php` is a reserved suffix.** The exclusion is a filename match, so a *handler* named `*_model.php` is silently never loaded — its form posts, nothing claims the request, and the user gets a blank page with no error anywhere. This is what happened to `admin/post/ai_model.php`, which is why the AI Models handler is now `admin/post/ai_models.php`. Name entity handlers around the suffix (`ai_models.php`, `users.php`, `api_keys.php`).
+
+A POST that reaches the end of `admin/post.php` or `agent/post.php` without a handler claiming it is logged to App Logs as a `Request` warning, which is the fastest way to spot this class of mistake.
  
 ---
  
@@ -171,7 +175,25 @@ Everywhere else — anything under `agent/post/` — the call belongs in the blo
  
 ### 4. Client scoping is enforced, not assumed.
  
-After loading a record, call `enforceClientAccess()` (optionally with the record's client ID) so technicians restricted to specific clients cannot touch other clients' data by editing an ID in the URL. Look at how `resolve_ticket` does it — including the "skip if the record has no client" case.
+A user can be restricted to a subset of clients through `user_client_permissions`. Enforcing that has two halves, and a page usually needs both.
+
+**One record — `enforceClientAccess()`.** After loading a record, call it (optionally with the record's client ID) so technicians restricted to specific clients cannot touch other clients' data by editing an ID in the URL. Look at how `resolve_ticket` does it.
+
+**A list — `clientScopeSql()`.** Any query returning more than one row appends the fragment for that resource's own client column:
+
+```php
+$sql = mysqli_query($mysqli, "SELECT expense_id, expense_date, expense_amount, expense_description
+    FROM expenses
+    WHERE expense_archived_at IS NULL
+    " . clientScopeSql('expense_client_id') . "
+    ORDER BY expense_date DESC");
+```
+
+It returns `" AND ..."` or `""`, so it needs a `WHERE` to hang off — add `WHERE 1=1` if the query has no other condition. It is column-aware and takes an alias fine (`clientScopeSql('t.ticket_client_id')`). The API calls the same helper through the `apiClientScopeSql()` wrapper.
+
+Scope on the resource's **own** column, not on a joined `clients.client_id`. Joining `clients` just to scope makes the filter depend on the join: with a `LEFT JOIN`, a row whose client column is `0` produces `NULL`, and `NULL IN (...)` is neither true nor false, so the row silently vanishes. If the query joins `clients` for `client_name`, keep the join for that — but still scope on the owning column.
+
+**Records with no client (`0`) stay visible to restricted users.** `clientScopeSql()` emits `IN (0,...)` deliberately. Client restrictions partition *client* data, and a record belonging to no client is not any client's data to withhold. Do not hand-roll a variant that drops the `0` — the tree had accumulated several before this helper existed, disagreeing with each other, and reconciling them is what surfaced the inconsistency.
  
 ### 5. Escape on output.
  
@@ -206,8 +228,29 @@ Per [SECURITY.md](SECURITY.md) — never in a public issue.
 ---
  
 ## Conventions
- 
+
-**Database naming.** Every column is prefixed with the singular name of the entity it belongs to: `tickets.ticket_id`, `tickets.ticket_subject`, `clients.client_name`. This makes JOIN results unambiguous and is why queries can `SELECT *` across joins safely. New tables must follow it.
+**Only technician-entered time is time worked.** `ticket_replies.ticket_reply_time_worked` is billable labour and feeds ticket totals, the technician and client time reports, project totals, invoicing and the API. A reply the *system* writes — assignment, priority change, merge, close, invoice/quote created, schedule edited, task completed or reopened — is an audit trail, not work, and records `'00:00:00'`. Only a value the technician actually typed goes in that column. Task completion estimates are planning information and stay on the task; they are never converted into time worked. `agent/ticket.php` hides the clock badge on a reply whose time is exactly `00:00:00`, so a zero renders as no time rather than as "0m".
+
+**Database naming.** Every column is prefixed with the singular name of the entity it belongs to: `tickets.ticket_id`, `tickets.ticket_subject`, `clients.client_name`. This makes JOIN results unambiguous, so a `SELECT *` across joins is never *wrong*. New tables must follow it.
+
+**Select the columns you use, not `*`.** Unambiguous is not the same as cheap. `SELECT *` across three joined tables fetches every column of all three, including the `*_notes` and `*_details` TEXT columns, and throws away whatever the page never renders. A search result list that shows five fields was pulling sixty. List the columns instead:
+
+```php
+$sql = mysqli_query($mysqli, "SELECT ticket_id, ticket_prefix, ticket_number, ticket_subject, client_name
+    FROM tickets
+    LEFT JOIN clients ON ticket_client_id = client_id
+    WHERE ticket_archived_at IS NULL
+    " . clientScopeSql('ticket_client_id') . "");
+```
+
+Two things follow from that:
+
+- A query whose result only feeds `mysqli_num_rows()` needs no columns at all — write `SELECT 1`. Do not select a primary key "just in case": if the query joins two tables that both carry that column name, an unqualified `SELECT ticket_template_id` is an ambiguous-column error.
+- Keep the join even when no column of the joined table survives into the `SELECT`, if the join is doing work — supplying a `WHERE` term, an `ORDER BY`, or the client column you scope on. Dropping a join is a separate decision from trimming the column list.
+
+The trade is real and worth stating: `SELECT *` picks up new columns for free, an explicit list does not. Add a column to a table and every query that needs it must be updated by hand, and the failure mode is a blank field or a PHP 8 undefined-key warning rather than an error. That is the price of not fetching data nobody reads, and the project has decided to pay it on anything that loops or touches a TEXT column.
+
+The exception is `api/v1/*/read.php`. Those endpoints hand the whole row to `read_output.php`, which serialises it straight into the JSON response — there the row *is* the output contract, so `SELECT *` is correct and trimming it would silently drop fields from every consumer.
 
 The prefix is the entity name, which is usually but not always the singular of the table name. Where a table is named for its container rather than its row, the prefix follows the row: `calendar_events` → `event_*`, `asset_interfaces` → `interface_*`, `invoice_items` / `quote_items` → `item_*`, `rack_units` → `unit_*`, `user_roles` → `role_*`, `product_stock` → `stock_*`. Pick the prefix your columns will read best as and use it for every column in the table.
 
@@ -224,6 +267,8 @@ A single update run applies every pending migration in order, stopping at the fi
 **After acting, log and notify.** State changes call `logAudit($type, $action, $description, $client_id, $entity_id)` for the audit trail. User-facing events may also call `appNotify()`. Fire `triggerCustomAction()` where a site might reasonably want a hook. Then call `flashAlert($message, $type)` and `redirect()` (defaults to the referer) rather than setting session keys or `header()` manually.
 
 **Function names (post-rename).** Helpers were renamed for clarity in 2026; the old names **no longer exist** — code calling them fatals. If you're rebasing an old PR or following an old tutorial, translate: `sanitizeInput` → `escapeSql`, `nullable_htmlentities` → `escapeHtml`, `logAction` → `logAudit`, `flash_alert` → `flashAlert`, `customAction` → `triggerCustomAction`, `encryptLoginEntry`/`decryptLoginEntry` → `encryptCredentialEntry`/`decryptCredentialEntry`, `strtoAZaz09` → `toAlphanumeric`, `fetchUpdates` → `checkForUpdates`, `sanitize_url` → `escapeUrl`.
+
+One removed **variable** deserves its own warning: the old `$access_permission_query` global is gone, replaced by `clientScopeSql()` (security rule 4). Unlike a removed function, it does not fatal — an undefined variable interpolates as an empty string, so a rebased query keeps running with **no client scoping at all**. Grep for it before rebasing anything that touches a list query.
  
 **Helpers that fetch data return it raw.** If you add a `getXById()`-style helper, return the column value untouched and let callers escape it (security rule 1). Validating what the helper interpolates into its *own* query — table and column names, the id — is still the helper's job; that is query construction, not output escaping, and the two are not the same thing.
 

admin/ai_models.php

@@ -6,7 +6,8 @@ $order = "ASC";
 
 require_once "includes/inc_all_admin.php";
 
-$sql = mysqli_query($mysqli, "SELECT * FROM ai_models LEFT JOIN ai_providers ON ai_model_ai_provider_id = ai_provider_id ORDER BY $sort $order");
+$sql = mysqli_query($mysqli, "SELECT ai_model_id, ai_model_name, ai_model_prompt, ai_model_use_case, ai_provider_id,
+    ai_provider_name FROM ai_models LEFT JOIN ai_providers ON ai_model_ai_provider_id = ai_provider_id ORDER BY $sort $order");
 
 $num_rows = mysqli_num_rows($sql);
 

admin/ai_providers.php

@@ -6,7 +6,7 @@ $order = "ASC";
 
 require_once "includes/inc_all_admin.php";
 
-$sql = mysqli_query($mysqli, "SELECT * FROM ai_providers ORDER BY $sort $order");
+$sql = mysqli_query($mysqli, "SELECT ai_provider_api_key, ai_provider_api_url, ai_provider_id, ai_provider_name FROM ai_providers ORDER BY $sort $order");
 
 $num_rows = mysqli_num_rows($sql);
 

admin/api_keys.php

@@ -8,7 +8,7 @@ require_once "includes/inc_all_admin.php";
 
 $sql = mysqli_query(
     $mysqli,
-    "SELECT SQL_CALC_FOUND_ROWS * FROM api_keys
+    "SELECT SQL_CALC_FOUND_ROWS api_key_created_at, api_key_expire, api_key_id, api_key_name, api_key_secret, user_name FROM api_keys
     LEFT JOIN users on api_key_user_id = user_id
     WHERE (api_key_name LIKE '%$q%')
     ORDER BY $sort $order LIMIT $record_from, $record_to"

admin/app_logs.php

@@ -28,7 +28,7 @@ if (isset($_GET['category']) & !empty($_GET['catergory'])) {
 
 $sql = mysqli_query(
     $mysqli,
-    "SELECT SQL_CALC_FOUND_ROWS * FROM app_logs
+    "SELECT SQL_CALC_FOUND_ROWS app_log_category, app_log_created_at, app_log_details, app_log_id, app_log_type FROM app_logs
     WHERE (app_log_type LIKE '%$q%' OR app_log_category LIKE '%$q%' OR app_log_details LIKE '%$q%')
     AND DATE(app_log_created_at) BETWEEN '$dtf' AND '$dtt'
     $log_type_query

admin/audit_logs.php

@@ -48,7 +48,8 @@ if (isset($_GET['action']) & !empty($_GET['action'])) {
 
 $sql = mysqli_query(
     $mysqli,
-    "SELECT SQL_CALC_FOUND_ROWS * FROM logs
+    "SELECT SQL_CALC_FOUND_ROWS client_id, client_name, log_action, log_created_at, log_description, log_entity_id, log_id,
+        log_ip, log_type, log_user_agent, user_id, user_name FROM logs
     LEFT JOIN users ON log_user_id = user_id
     LEFT JOIN clients ON log_client_id = client_id
     WHERE (log_type LIKE '%$q%' OR log_action LIKE '%$q%' OR log_description LIKE '%$q%' OR log_ip LIKE '%$q%' OR log_user_agent LIKE '%$q%' OR user_name LIKE '%$q%' OR client_name LIKE '%$q%')
@@ -87,7 +88,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                                 <option value="">- All Clients -</option>
 
                                 <?php
-                                $sql_clients_filter = mysqli_query($mysqli, "SELECT * FROM clients ORDER BY client_name ASC");
+                                $sql_clients_filter = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients ORDER BY client_name ASC");
                                 while ($row = mysqli_fetch_assoc($sql_clients_filter)) {
                                     $client_id = intval($row['client_id']);
                                     $client_name = escapeHtml($row['client_name']);
@@ -107,7 +108,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                                 <option value="">- All Users -</option>
 
                                 <?php
-                                $sql_users_filter = mysqli_query($mysqli, "SELECT * FROM users ORDER BY user_name ASC");
+                                $sql_users_filter = mysqli_query($mysqli, "SELECT user_id, user_name FROM users ORDER BY user_name ASC");
                                 while ($row = mysqli_fetch_assoc($sql_users_filter)) {
                                     $user_id = intval($row['user_id']);
                                     $user_name = escapeHtml($row['user_name']);

admin/backup.php

@@ -19,7 +19,8 @@ $cron_is_running = $cron_last_dispatch_at !== null && (time() - strtotime($cron_
 
 $backup_job = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT cron_job_enabled, cron_job_daily_at FROM cron_jobs WHERE cron_job_name = 'backup'"));
 
-$backups = mysqli_query($mysqli, "SELECT * FROM backups ORDER BY backup_created_at DESC LIMIT 100");
+$backups = mysqli_query($mysqli, "SELECT backup_created_at, backup_error, backup_id, backup_size, backup_source, backup_status,
+    backup_type FROM backups ORDER BY backup_created_at DESC LIMIT 100");
 
 $pending_count = intval(mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT(*) AS c FROM backups WHERE backup_status IN ('Pending','Running')"))['c']);
 

admin/backup_download.php

@@ -23,7 +23,7 @@ if (!isset($_GET['backup_id'])) {
 
 $backup_id = intval($_GET['backup_id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM backups WHERE backup_id = $backup_id AND backup_status = 'Complete' LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT backup_file_name FROM backups WHERE backup_id = $backup_id AND backup_status = 'Complete' LIMIT 1");
 
 if (mysqli_num_rows($sql) !== 1) {
     http_response_code(404);

admin/categories.php

@@ -15,7 +15,7 @@ if (isset($_GET['category'])) {
 
 $sql = mysqli_query(
     $mysqli,
-    "SELECT SQL_CALC_FOUND_ROWS * FROM categories
+    "SELECT SQL_CALC_FOUND_ROWS category_color, category_description, category_id, category_name FROM categories
     WHERE category_name LIKE '%$q%'
     AND category_type = '$category'
     AND category_$archive_query

admin/contract_templates.php

@@ -63,15 +63,15 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                             $id = intval($row['contract_template_id']);
                             $name = escapeHtml($row['contract_template_name']);
                             $type = escapeHtml($row['contract_template_type']);
-                            $freq = escapeHtml($row['contract_template_update_frequency']);
+                            $freq = escapeHtml($row['contract_template_renewal_frequency']);
-                            $sla_low_resp = escapeHtml($row['sla_low_response_time']);
+                            $sla_low_resp = escapeHtml($row['contract_template_sla_low_response_time']);
-                            $sla_med_resp = escapeHtml($row['sla_medium_response_time']);
+                            $sla_med_resp = escapeHtml($row['contract_template_sla_medium_response_time']);
-                            $sla_high_resp = escapeHtml($row['sla_high_response_time']);
+                            $sla_high_resp = escapeHtml($row['contract_template_sla_high_response_time']);
-                            $sla_low_res = escapeHtml($row['sla_low_resolution_time']);
+                            $sla_low_res = escapeHtml($row['contract_template_sla_low_resolution_time']);
-                            $sla_med_res = escapeHtml($row['sla_medium_resolution_time']);
+                            $sla_med_res = escapeHtml($row['contract_template_sla_medium_resolution_time']);
-                            $sla_high_res = escapeHtml($row['sla_high_resolution_time']);
+                            $sla_high_res = escapeHtml($row['contract_template_sla_high_resolution_time']);
-                            $hourly_rate = escapeHtml($row['contract_template_hourly_rate']);
+                            $hourly_rate = escapeHtml($row['contract_template_rate_standard']);
-                            $after_hours = escapeHtml($row['contract_template_after_hours_hourly_rate']);
+                            $after_hours = escapeHtml($row['contract_template_rate_after_hours']);
                             $support_hours = escapeHtml($row['contract_template_support_hours']);
                             $net_terms = escapeHtml($row['contract_template_net_terms']);
                             $created = escapeHtml($row['contract_template_created_at']);

admin/cron.php

@@ -22,7 +22,7 @@ foreach (cronJobRegistry() as $job) {
     $cron_jobs[$job['name']]['row'] = null;
 }
 
-$sql = mysqli_query($mysqli, "SELECT * FROM cron_jobs");
+$sql = mysqli_query($mysqli, "SELECT cron_job_name FROM cron_jobs");
 while ($job_row = mysqli_fetch_assoc($sql)) {
     if (isset($cron_jobs[$job_row['cron_job_name']])) {
         $cron_jobs[$job_row['cron_job_name']]['row'] = $job_row;

admin/custom_links.php

@@ -8,7 +8,8 @@ require_once "includes/inc_all_admin.php";
 
 $sql = mysqli_query(
     $mysqli,
-    "SELECT SQL_CALC_FOUND_ROWS * FROM custom_links
+    "SELECT SQL_CALC_FOUND_ROWS custom_link_icon, custom_link_id, custom_link_location, custom_link_name,
+        custom_link_new_tab, custom_link_order, custom_link_uri FROM custom_links
     WHERE custom_link_name LIKE '%$q%'
     ORDER BY $sort $order LIMIT $record_from, $record_to"
 );

admin/database_updates/2.3.1.php

@@ -8,7 +8,7 @@
 defined('FROM_DB_UPDATER') || die("Direct file access is not allowed");
 
     // Migrate Payment Methods from Categories Table to new payment_methods table
-    $sql_categories = mysqli_query($mysqli, "SELECT * FROM categories WHERE category_type = 'Payment Method' AND category_name != 'Stripe' AND category_archived_at IS NULL");
+    $sql_categories = mysqli_query($mysqli, "SELECT category_name FROM categories WHERE category_type = 'Payment Method' AND category_name != 'Stripe' AND category_archived_at IS NULL");
 
     while ($row = mysqli_fetch_assoc($sql_categories)) {
         $category_name = escapeSql($row['category_name']);

admin/database_updates/2.6.7.php

@@ -0,0 +1,18 @@
+<?php
+
+/*
+ * ITFlow - Database update to version 2.6.7 (from 2.6.6)
+ * Included by admin/database_updates.php - do not access directly
+ */
+
+defined('FROM_DB_UPDATER') || die("Direct file access is not allowed");
+
+    // The AI endpoints used to send a hardcoded temperature (0.5, or 0.3 for ticket
+    // summaries). Newer OpenAI models accept nothing but their own default and reject
+    // the request outright, which surfaced as "Failed to get a response from the AI API".
+    //
+    // Temperature is now per-model and optional: NULL means don't send the parameter
+    // at all, which is the setting that works on every provider. Existing rows get
+    // NULL so they stop sending it.
+
+    mysqli_query($mysqli, "ALTER TABLE `ai_models` ADD COLUMN IF NOT EXISTS `ai_model_temperature` decimal(3,2) DEFAULT NULL AFTER `ai_model_use_case`");

admin/document_template.php

@@ -15,7 +15,8 @@ if (isset($_GET['document_template_id'])) {
     $document_template_id = intval($_GET['document_template_id']);
 }
 
-$sql_document = mysqli_query($mysqli, "SELECT * FROM document_templates WHERE document_template_id = $document_template_id LIMIT 1");
+$sql_document = mysqli_query($mysqli, "SELECT document_template_content, document_template_created_at, document_template_description,
+    document_template_name, document_template_updated_at FROM document_templates WHERE document_template_id = $document_template_id LIMIT 1");
 
 if (mysqli_num_rows($sql_document) == 0) {
     echo "<center><h1 class='text-secondary mt-5'>Nothing to see here</h1><a class='btn btn-lg btn-secondary mt-3' href='javascript:history.back()'><i class='fa fa-fw fa-arrow-left'></i> Go Back</a></center>";

admin/document_templates.php

@@ -8,7 +8,8 @@
 
     $sql = mysqli_query(
         $mysqli,
-        "SELECT SQL_CALC_FOUND_ROWS * FROM document_templates
+        "SELECT SQL_CALC_FOUND_ROWS document_template_content, document_template_created_at, document_template_description,
+            document_template_id, document_template_name, document_template_updated_at, user_name FROM document_templates
         LEFT JOIN users ON document_template_created_by = user_id
         WHERE user_name LIKE '%$q%' OR document_template_name LIKE '%$q%'
         ORDER BY $sort $order LIMIT $record_from, $record_to"

admin/includes/side_nav.php

@@ -314,7 +314,7 @@
                 </li>
 
                 <?php
-                $sql_custom_links = mysqli_query($mysqli, "SELECT * FROM custom_links
+                $sql_custom_links = mysqli_query($mysqli, "SELECT custom_link_icon, custom_link_name, custom_link_new_tab, custom_link_uri FROM custom_links
                     WHERE custom_link_location = 4 AND custom_link_archived_at IS NULL
                     ORDER BY custom_link_order ASC, custom_link_name ASC"
                 );

admin/mail_queue.php

@@ -8,7 +8,8 @@ require_once "includes/inc_all_admin.php";
 
 $sql = mysqli_query(
     $mysqli,
-    "SELECT SQL_CALC_FOUND_ROWS * FROM email_queue
+    "SELECT SQL_CALC_FOUND_ROWS email_attempts, email_failed_at, email_from, email_from_name, email_id, email_queued_at,
+        email_recipient, email_recipient_name, email_sent_at, email_status, email_subject FROM email_queue
     WHERE (email_id LIKE '%$q%' OR email_from LIKE '%$q%' OR email_from_name LIKE '%$q%' OR email_recipient LIKE '%$q%' OR email_recipient_name LIKE '%$q%' OR email_subject LIKE '%$q%')
     AND DATE(email_queued_at) BETWEEN '$dtf' AND '$dtt'
     ORDER BY $sort $order LIMIT $record_from, $record_to"

admin/modals/ai/ai_model_add.php

@@ -26,7 +26,7 @@ ob_start();
                 <select class="form-control select2" name="provider" required>
                     <option value="">- Select an AI Provider -</option>
                     <?php
-                        $sql_ai_providers = mysqli_query($mysqli, "SELECT * FROM ai_providers");
+                        $sql_ai_providers = mysqli_query($mysqli, "SELECT ai_provider_id, ai_provider_name FROM ai_providers");
                         while ($row = mysqli_fetch_assoc($sql_ai_providers)) {
                             $ai_provider_id = intval($row['ai_provider_id']);
                             $ai_provider_name = escapeHtml($row['ai_provider_name']);
@@ -62,6 +62,17 @@ ob_start();
             </div>
         </div>
 
+        <div class="form-group">
+            <label>Temperature</label>
+            <div class="input-group">
+                <div class="input-group-prepend">
+                    <span class="input-group-text"><i class="fa fa-fw fa-thermometer-half"></i></span>
+                </div>
+                <input type="number" class="form-control" name="temperature" step="0.1" min="0" max="2" value="" placeholder="Provider default">
+            </div>
+            <small class="form-text text-muted">Optional. Leave blank to let the provider use its default - some newer models reject every other value.</small>
+        </div>
+
         <div class="form-group">
             <textarea class="form-control" rows="8" name="prompt" placeholder="Enter a model prompt:"></textarea>
         </div>

admin/modals/ai/ai_model_edit.php

@@ -4,13 +4,14 @@ require_once '../../includes/modal_header.php';
 
 $model_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM ai_models WHERE ai_model_id = $model_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT ai_model_ai_provider_id, ai_model_id, ai_model_name, ai_model_prompt, ai_model_use_case, ai_model_temperature FROM ai_models WHERE ai_model_id = $model_id LIMIT 1");
 
 $row = mysqli_fetch_assoc($sql);
 $ai_model_ai_provider_id = intval($row['ai_model_ai_provider_id']);
 $model_id = intval($row['ai_model_id']);
 $model_name = escapeHtml($row['ai_model_name']);
 $use_case = escapeHtml($row['ai_model_use_case']);
+$temperature = escapeHtml($row['ai_model_temperature']);
 $prompt = escapeHtml($row['ai_model_prompt']);
 
 // Generate the HTML form content using output buffering.
@@ -38,7 +39,7 @@ ob_start();
                 <select class="form-control select2" name="provider" required>
                     <option value="">- Select an AI Provider -</option>
                     <?php
-                        $sql_ai_providers = mysqli_query($mysqli, "SELECT * FROM ai_providers");
+                        $sql_ai_providers = mysqli_query($mysqli, "SELECT ai_provider_id, ai_provider_name FROM ai_providers");
                         while ($row = mysqli_fetch_assoc($sql_ai_providers)) {
                             $ai_provider_id = intval($row['ai_provider_id']);
                             $ai_provider_name = escapeHtml($row['ai_provider_name']);
@@ -74,6 +75,16 @@ ob_start();
             </div>
         </div>
 
+        <div class="form-group">
+            <label>Temperature</label>
+            <div class="input-group">
+                <div class="input-group-prepend">
+                    <span class="input-group-text"><i class="fa fa-fw fa-thermometer-half"></i></span>
+                </div>
+                <input type="number" class="form-control" name="temperature" step="0.1" min="0" max="2" value="<?= $temperature ?>" placeholder="Provider default">
+            </div>
+            <small class="form-text text-muted">Optional. Leave blank to let the provider use its default - some newer models reject every other value.</small>
+        </div>
         <div class="form-group">
             <textarea class="form-control" rows="8" name="prompt" placeholder="Enter a model prompt:"><?= $prompt ?></textarea>
         </div>

admin/modals/ai/ai_provider_edit.php

@@ -4,7 +4,7 @@ require_once '../../includes/modal_header.php';
 
 $provider_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM ai_providers WHERE ai_provider_id = $provider_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT ai_provider_api_key, ai_provider_api_url, ai_provider_name FROM ai_providers WHERE ai_provider_id = $provider_id LIMIT 1");
 
 $row = mysqli_fetch_assoc($sql);
 $provider_name = escapeHtml($row['ai_provider_name']);

admin/modals/api/api_key_edit.php

@@ -4,7 +4,7 @@ require_once '../../includes/modal_header.php';
 
 $api_key_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM api_keys WHERE api_key_id = $api_key_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT api_key_expire, api_key_name, api_key_user_id FROM api_keys WHERE api_key_id = $api_key_id LIMIT 1");
 $row = mysqli_fetch_assoc($sql);
 $api_key_name = escapeHtml($row['api_key_name']);
 $api_key_expire = escapeHtml($row['api_key_expire']);

admin/modals/category/category_edit.php

@@ -4,7 +4,7 @@ require_once '../../includes/modal_header.php';
 
 $category_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM categories WHERE category_id = $category_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT category_color, category_description, category_name, category_type FROM categories WHERE category_id = $category_id LIMIT 1");
 
 $row = mysqli_fetch_assoc($sql);
 $category_name = escapeHtml($row['category_name']);

admin/modals/contract_template/contract_template_edit.php

@@ -7,7 +7,13 @@ $contract_types_array = ['Fully Managed', 'Partialy Managed', 'Break/Fix'];
 $update_frequency_array = ['Manual', 'Annually', '2 Year', '3 Year', '5 Year', '7 Year'];
 
 // Fetch existing template
-$sql = mysqli_query($mysqli, "SELECT * FROM contract_templates WHERE contract_template_id = $contract_template_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT contract_template_description, contract_template_details, contract_template_name,
+    contract_template_net_terms, contract_template_rate_after_hours,
+    contract_template_rate_standard, contract_template_renewal_frequency,
+    contract_template_sla_high_resolution_time, contract_template_sla_high_response_time,
+    contract_template_sla_low_resolution_time, contract_template_sla_low_response_time,
+    contract_template_sla_medium_resolution_time, contract_template_sla_medium_response_time,
+    contract_template_support_hours, contract_template_type FROM contract_templates WHERE contract_template_id = $contract_template_id LIMIT 1");
 $row = mysqli_fetch_assoc($sql);
 
 // Assign locals

admin/modals/cron/cron_edit.php

@@ -5,7 +5,8 @@ require_once '../../../includes/cron_jobs.php';
 
 $cron_job_id = intval($_GET['id']);
 
-$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT * FROM cron_jobs WHERE cron_job_id = $cron_job_id LIMIT 1"));
+$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT cron_job_daily_at, cron_job_enabled, cron_job_interval_minutes, cron_job_name,
+    cron_job_schedule FROM cron_jobs WHERE cron_job_id = $cron_job_id LIMIT 1"));
 
 $registry = cronJobRegistryByName();
 $job = $registry[$row['cron_job_name']] ?? null;

admin/modals/custom_link/custom_link_edit.php

@@ -4,7 +4,8 @@ require_once '../../includes/modal_header.php';
 
 $custom_link_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM custom_links WHERE custom_link_id = $custom_link_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT custom_link_icon, custom_link_location, custom_link_name, custom_link_new_tab,
+    custom_link_order, custom_link_uri FROM custom_links WHERE custom_link_id = $custom_link_id LIMIT 1");
 $row = mysqli_fetch_assoc($sql);
 $custom_link_name = escapeHtml($row['custom_link_name']);
 $custom_link_uri = escapeHtml($row['custom_link_uri']);

admin/modals/document_template/document_template_edit.php

@@ -4,7 +4,7 @@ require_once '../../includes/modal_header.php';
 
 $document_template_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM document_templates WHERE document_template_id = $document_template_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT document_template_content, document_template_description, document_template_name FROM document_templates WHERE document_template_id = $document_template_id LIMIT 1");
 $row = mysqli_fetch_assoc($sql);
 $document_template_name = escapeHtml($row['document_template_name']);
 $document_template_description = escapeHtml($row['document_template_description']);

admin/modals/mail_queue/mail_queue_message_view.php

@@ -12,7 +12,9 @@ $purifier_config->set('Cache.DefinitionImpl', null); // Disable cache by setting
 $purifier_config->set('URI.AllowedSchemes', ['data' => true, 'src' => true, 'http' => true, 'https' => true]);
 $purifier = new HTMLPurifier($purifier_config);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM email_queue WHERE email_id = $email_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT email_attempts, email_content, email_failed_at, email_from, email_from_name,
+    email_queued_at, email_recipient, email_recipient_name, email_sent_at, email_status,
+    email_subject FROM email_queue WHERE email_id = $email_id LIMIT 1");
 $row = mysqli_fetch_assoc($sql);
 
 $email_from = escapeHtml($row['email_from']);

admin/modals/payment_method/payment_method_edit.php

@@ -4,7 +4,7 @@ require_once '../../includes/modal_header.php';
 
 $payment_method_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM payment_methods WHERE payment_method_id = $payment_method_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT payment_method_description, payment_method_id, payment_method_name FROM payment_methods WHERE payment_method_id = $payment_method_id LIMIT 1");
 
 $row = mysqli_fetch_assoc($sql);
 $payment_method_id = intval($row['payment_method_id']);

admin/modals/payment_provider/payment_provider_edit.php

@@ -4,7 +4,9 @@ require_once '../../includes/modal_header.php';
 
 $provider_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM payment_providers WHERE payment_provider_id = $provider_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT payment_provider_account, payment_provider_expense_category,
+    payment_provider_expense_vendor, payment_provider_name, payment_provider_private_key,
+    payment_provider_public_key, payment_provider_threshold FROM payment_providers WHERE payment_provider_id = $provider_id LIMIT 1");
 
 $row = mysqli_fetch_assoc($sql);
 $provider_name = escapeHtml($row['payment_provider_name']);

admin/modals/project_template/project_template_edit.php

@@ -4,7 +4,7 @@ require_once '../../includes/modal_header.php';
 
 $project_template_id = intval($_GET['project_template_id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM project_templates WHERE project_template_id = $project_template_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT project_template_description, project_template_name FROM project_templates WHERE project_template_id = $project_template_id LIMIT 1");
 $row = mysqli_fetch_assoc($sql);
 $project_template_name = escapeHtml($row['project_template_name']);
 $project_template_description = escapeHtml($row['project_template_description']);

admin/modals/role/role_add.php

@@ -79,7 +79,7 @@ ob_start();
 
                 <?php
                 // Enumerate modules
-                $sql_modules = mysqli_query($mysqli, "SELECT * FROM modules");
+                $sql_modules = mysqli_query($mysqli, "SELECT module_description, module_id, module_name FROM modules");
                 while ($row_modules = mysqli_fetch_assoc($sql_modules)) {
 
                     $module_id = intval($row_modules['module_id']);

admin/modals/role/role_edit.php

@@ -15,7 +15,7 @@ $role_admin = intval($row['role_is_admin']);
 $sql_role_user_count = mysqli_query($mysqli, "SELECT COUNT(user_id) FROM users WHERE user_role_id = $role_id AND user_archived_at IS NULL");
 $role_user_count = mysqli_fetch_row($sql_role_user_count)[0];
 
-$sql_users = mysqli_query($mysqli, "SELECT * FROM users WHERE user_role_id = $role_id AND user_archived_at IS NULL");
+$sql_users = mysqli_query($mysqli, "SELECT user_name FROM users WHERE user_role_id = $role_id AND user_archived_at IS NULL");
 // Initialize an empty array to hold user names
 $user_names = [];
 
@@ -113,7 +113,7 @@ ob_start();
                 <?php
 
                 // Enumerate modules
-                $sql_modules = mysqli_query($mysqli, "SELECT * FROM modules");
+                $sql_modules = mysqli_query($mysqli, "SELECT module_description, module_id, module_name FROM modules");
                 while ($row_modules = mysqli_fetch_assoc($sql_modules)) {
                     $module_id = intval($row_modules['module_id']);
                     $module_name = escapeHtml($row_modules['module_name']);

admin/modals/sla/sla_edit.php

@@ -3,7 +3,7 @@ require_once '../../includes/modal_header.php';
 
 $sla_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM slas WHERE sla_id = $sla_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT sla_description, sla_name, sla_resolution_minutes, sla_response_minutes FROM slas WHERE sla_id = $sla_id LIMIT 1");
 $row = mysqli_fetch_assoc($sql);
 $sla_name = escapeHtml($row['sla_name']);
 $sla_description = escapeHtml($row['sla_description']);

admin/modals/software_template/software_template_edit.php

@@ -4,7 +4,8 @@ require_once '../../includes/modal_header.php';
 
 $software_template_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM software_templates WHERE software_template_id = $software_template_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT software_template_description, software_template_license_type, software_template_name,
+    software_template_notes, software_template_type, software_template_version FROM software_templates WHERE software_template_id = $software_template_id LIMIT 1");
 $row = mysqli_fetch_assoc($sql);
 $software_name = escapeHtml($row['software_template_name']);
 $software_version = escapeHtml($row['software_template_version']);

admin/modals/tag/tag_edit.php

@@ -4,7 +4,7 @@ require_once '../../includes/modal_header.php';
 
 $tag_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM tags WHERE tag_id = $tag_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT tag_color, tag_icon, tag_name, tag_type FROM tags WHERE tag_id = $tag_id LIMIT 1");
 
 $row = mysqli_fetch_assoc($sql);
 $tag_name = escapeHtml($row['tag_name']);

admin/modals/tax/tax_edit.php

@@ -4,7 +4,7 @@ require_once '../../includes/modal_header.php';
 
 $tax_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM taxes WHERE tax_id = $tax_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT tax_name, tax_percent FROM taxes WHERE tax_id = $tax_id LIMIT 1");
 $row = mysqli_fetch_assoc($sql);
 $tax_name = escapeHtml($row['tax_name']);
 $tax_percent = floatval($row['tax_percent']);

admin/modals/ticket_status/ticket_status_edit.php

@@ -4,7 +4,8 @@ require_once '../../includes/modal_header.php';
 
 $ticket_status_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM ticket_statuses WHERE ticket_status_id = $ticket_status_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT ticket_status_active, ticket_status_color, ticket_status_name, ticket_status_order,
+    ticket_status_pauses_sla FROM ticket_statuses WHERE ticket_status_id = $ticket_status_id LIMIT 1");
 $row = mysqli_fetch_assoc($sql);
 $ticket_status_name = escapeHtml($row['ticket_status_name']);
 $ticket_status_color = escapeHtml($row['ticket_status_color']);

admin/modals/ticket_template/ticket_template_add.php

@@ -60,7 +60,7 @@ ob_start();
                     <option value="0">- No -</option>
                     <?php
 
-                    $sql_project_templates = mysqli_query($mysqli, "SELECT * FROM project_templates WHERE project_template_archived_at IS NULL ORDER BY project_template_name ASC");
+                    $sql_project_templates = mysqli_query($mysqli, "SELECT project_template_id, project_template_name FROM project_templates WHERE project_template_archived_at IS NULL ORDER BY project_template_name ASC");
                     while ($row = mysqli_fetch_assoc($sql_project_templates)) {
                         $project_template_id_select = intval($row['project_template_id']);
                         $project_template_name_select = escapeHtml($row['project_template_name']); ?>

admin/modals/ticket_template/ticket_template_task_edit.php

@@ -4,7 +4,7 @@ require_once '../../includes/modal_header.php';
 
 $task_template_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM task_templates WHERE task_template_id = $task_template_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT task_template_completion_estimate, task_template_name, task_template_order FROM task_templates WHERE task_template_id = $task_template_id LIMIT 1");
 
 $row = mysqli_fetch_assoc($sql);
 $task_template_name = escapeHtml($row['task_template_name']);

admin/modals/user/user_add.php

@@ -75,7 +75,7 @@ ob_start();
                         <select class="form-control select2" name="role" required>
                             <option value="">- Role -</option>
                             <?php
-                                $sql_user_roles = mysqli_query($mysqli, "SELECT * FROM user_roles WHERE role_archived_at IS NULL");
+                                $sql_user_roles = mysqli_query($mysqli, "SELECT role_id, role_name FROM user_roles WHERE role_archived_at IS NULL");
                                 while ($row = mysqli_fetch_assoc($sql_user_roles)) {
                                     $role_id = intval($row['role_id']);
                                     $role_name = escapeHtml($row['role_name']);
@@ -138,7 +138,7 @@ ob_start();
                         <tbody>
 
                         <?php
-                        $sql_client_select = mysqli_query($mysqli, "SELECT * FROM clients WHERE client_archived_at IS NULL ORDER BY client_name ASC");
+                        $sql_client_select = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients WHERE client_archived_at IS NULL ORDER BY client_name ASC");
                         while ($row = mysqli_fetch_assoc($sql_client_select)) {
                             $client_id = intval($row['client_id']);
                             $client_name = escapeHtml($row['client_name']);

admin/modals/user/user_archive.php

@@ -4,7 +4,7 @@ require_once '../../includes/modal_header.php';
 
 $user_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM users WHERE users.user_id = $user_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT user_avatar, user_email, user_name FROM users WHERE users.user_id = $user_id LIMIT 1");
 
 $row = mysqli_fetch_assoc($sql);
 $user_name = escapeHtml($row['user_name']);
@@ -12,13 +12,13 @@ $user_email = escapeHtml($row['user_email']);
 $user_avatar = escapeHtml($row['user_avatar']);
 $user_initials = escapeHtml(initials($user_name));
 
-$sql_related_tickets = mysqli_query($mysqli, "SELECT * FROM tickets
+$sql_related_tickets = mysqli_query($mysqli, "SELECT 1 FROM tickets
     WHERE ticket_assigned_to = $user_id AND ticket_resolved_at IS NULL AND ticket_closed_at IS NULL");
 
 $ticket_count = mysqli_num_rows($sql_related_tickets);
 
 // Related Recurring Tickets Query
-$sql_related_recurring_tickets = mysqli_query($mysqli, "SELECT * FROM recurring_tickets WHERE recurring_ticket_assigned_to = $user_id");
+$sql_related_recurring_tickets = mysqli_query($mysqli, "SELECT 1 FROM recurring_tickets WHERE recurring_ticket_assigned_to = $user_id");
 
 $recurring_ticket_count = mysqli_num_rows($sql_related_recurring_tickets);
 
@@ -59,7 +59,7 @@ ob_start();
                 <select class="form-control select2" name="ticket_assign" required>
                     <option value="0">No one</option>
                     <?php
-                    $sql_users = mysqli_query($mysqli, "SELECT * FROM users WHERE user_type = 1 AND user_archived_at IS NULL");
+                    $sql_users = mysqli_query($mysqli, "SELECT user_id, user_name FROM users WHERE user_type = 1 AND user_archived_at IS NULL");
                     while ($row = mysqli_fetch_assoc($sql_users)) {
                         $user_id_select = intval($row['user_id']);
                         $user_name_select = escapeHtml($row['user_name']);

admin/modals/user/user_edit.php

@@ -4,7 +4,7 @@ require_once '../../includes/modal_header.php';
 
 $user_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM users
+$sql = mysqli_query($mysqli, "SELECT user_avatar, user_config_force_mfa, user_email, user_name, user_role_id, user_token FROM users
     LEFT JOIN user_settings ON users.user_id = user_settings.user_id
     WHERE users.user_id = $user_id LIMIT 1"
 );
@@ -119,7 +119,7 @@ ob_start();
                         </div>
                         <select class="form-control select2" name="role" required>
                             <?php
-                            $sql_user_roles = mysqli_query($mysqli, "SELECT * FROM user_roles WHERE role_archived_at IS NULL");
+                            $sql_user_roles = mysqli_query($mysqli, "SELECT role_id, role_name FROM user_roles WHERE role_archived_at IS NULL");
                             while ($row = mysqli_fetch_assoc($sql_user_roles)) {
                                 $role_id = intval($row['role_id']);
                                 $role_name = escapeHtml($row['role_name']);
@@ -190,7 +190,7 @@ ob_start();
                         <tbody>
 
                         <?php
-                        $sql_client_select = mysqli_query($mysqli, "SELECT * FROM clients WHERE client_archived_at IS NULL ORDER BY client_name ASC");
+                        $sql_client_select = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients WHERE client_archived_at IS NULL ORDER BY client_name ASC");
                         while ($row = mysqli_fetch_assoc($sql_client_select)) {
                             $client_id_select = intval($row['client_id']);
                             $client_name_select = escapeHtml($row['client_name']);

admin/modals/user/user_restore.php

@@ -4,7 +4,7 @@ require_once '../../includes/modal_header.php';
 
 $user_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM users WHERE user_id = $user_id AND user_archived_at IS NOT NULL LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT user_avatar, user_email, user_name, user_role_id FROM users WHERE user_id = $user_id AND user_archived_at IS NOT NULL LIMIT 1");
 
 $row = mysqli_fetch_assoc($sql);
 $user_name = str_replace(" (archived)", "", $row['user_name']); //Removed (archived) from user_name
@@ -63,7 +63,7 @@ ob_start();
                 </div>
                 <select class="form-control select2" name="role" required>
                     <?php
-                    $sql_user_roles = mysqli_query($mysqli, "SELECT * FROM user_roles WHERE role_archived_at IS NULL");
+                    $sql_user_roles = mysqli_query($mysqli, "SELECT role_id, role_name FROM user_roles WHERE role_archived_at IS NULL");
                     while ($row = mysqli_fetch_assoc($sql_user_roles)) {
                         $role_id = intval($row['role_id']);
                         $role_name = escapeHtml($row['role_name']);

admin/modals/vendor_template/vendor_template_edit.php

@@ -4,7 +4,10 @@ require_once '../../includes/modal_header.php';
 
 $vendor_template_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM vendor_templates WHERE vendor_template_id = $vendor_template_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT vendor_template_account_number, vendor_template_code, vendor_template_contact_name,
+    vendor_template_description, vendor_template_email, vendor_template_extension,
+    vendor_template_hours, vendor_template_name, vendor_template_notes, vendor_template_phone,
+    vendor_template_phone_country_code, vendor_template_sla, vendor_template_website FROM vendor_templates WHERE vendor_template_id = $vendor_template_id LIMIT 1");
 $row = mysqli_fetch_assoc($sql);
 $vendor_name = escapeHtml($row['vendor_template_name']);
 $vendor_description = escapeHtml($row['vendor_template_description']);

admin/modules.php

@@ -8,7 +8,7 @@ require_once "includes/inc_all_admin.php";
 
 $sql = mysqli_query(
     $mysqli,
-    "SELECT SQL_CALC_FOUND_ROWS * FROM modules
+    "SELECT SQL_CALC_FOUND_ROWS module_description, module_id, module_name FROM modules
     WHERE (module_name LIKE '%$q%' OR module_description LIKE '%$q%')
     ORDER BY $sort $order LIMIT $record_from, $record_to"
 );

admin/payment_methods.php

@@ -6,7 +6,8 @@ $order = "ASC";
 
 require_once "includes/inc_all_admin.php";
 
-$sql = mysqli_query($mysqli, "SELECT * FROM payment_methods ORDER BY $sort $order");
+$sql = mysqli_query($mysqli, "SELECT payment_method_created_at, payment_method_description, payment_method_id,
+    payment_method_name FROM payment_methods ORDER BY $sort $order");
 
 $num_rows = mysqli_num_rows($sql);
 

admin/payment_providers.php

@@ -6,7 +6,8 @@ $order = "ASC";
 
 require_once "includes/inc_all_admin.php";
 
-$sql = mysqli_query($mysqli, "SELECT * FROM payment_providers
+$sql = mysqli_query($mysqli, "SELECT account_name, category_name, payment_provider_description, payment_provider_id,
+    payment_provider_name, payment_provider_threshold, vendor_name FROM payment_providers
     LEFT JOIN accounts ON payment_provider_account = account_id
     LEFT JOIN vendors ON payment_provider_expense_vendor = vendor_id
     LEFT JOIN categories ON payment_provider_expense_category = category_id

admin/post.php

@@ -10,7 +10,11 @@ require_once __DIR__ . "/../includes/check_login.php";
 // Only allow running post files via inclusion (prevents people/bots poking them directly)
 define('FROM_POST_HANDLER', true);
 
-// Load all admin module POST logic
+// Load all admin module POST logic.
+// *_model.php is a RESERVED suffix: those files are not handlers, they are inline
+// field-parsing fragments that read $_POST at include time, so the glob must not
+// pull them in. A handler named *_model.php is silently never loaded - name entity
+// handlers around it (admin/post/ai_models.php, not ai_model.php).
 if (!empty($session_is_admin)) {
     foreach (glob(__DIR__ . "/post/*.php") as $admin_module) {
         if (!str_ends_with($admin_module, '_model.php')) {
@@ -22,3 +26,11 @@ if (!empty($session_is_admin)) {
 // Logout is shared between portals
 require_once __DIR__ . "/../post/logout.php";
 require_once __DIR__ . "/../post/misc.php";
+
+// Every handler above exits or redirects, so getting here means no handler claimed
+// the request - a blank page and no trace of why. Log it; the usual cause is a
+// handler file that never loaded.
+if ($_SERVER['REQUEST_METHOD'] === 'POST') {
+    $unhandled = implode(', ', array_slice(array_keys($_POST), 0, 10));
+    logApp('Request', 'warning', "Unhandled POST to admin/post.php - no handler matched. Fields: $unhandled");
+}

admin/post/ai_models.php

@@ -1,7 +1,7 @@
 <?php
 
 /*
- * ITFlow - GET/POST request handler for AI Models ('ai_model')
+ * ITFlow - GET/POST request handler for AI Models ('ai_models')
  */
 
 defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
@@ -15,9 +15,17 @@ if (isset($_POST['add_ai_model'])) {
     $prompt = escapeSql($_POST['prompt']);
     $use_case = escapeSql($_POST['use_case']);
 
-    mysqli_query($mysqli,"INSERT INTO ai_models SET ai_model_name = '$model', ai_model_prompt = '$prompt', ai_model_use_case = '$use_case', ai_model_ai_provider_id = $provider_id");
+    // Blank means "send no temperature at all" - the only setting that works on every
+    // provider. Anything else rides as a numeric literal, so no quoting.
+    $temperature = ($_POST['temperature'] ?? '') === '' ? 'NULL' : floatval($_POST['temperature']);
 
-    $ai_model_id = mysqli_insert_id($mysqli);
+    mysqli_query($mysqli,"INSERT INTO ai_models SET ai_model_name = '$model', ai_model_prompt = '$prompt', ai_model_use_case = '$use_case', ai_model_temperature = $temperature, ai_model_ai_provider_id = $provider_id");
+
+    if (!mysqli_affected_rows($mysqli)) {
+        logApp('AI', 'error', 'Failed to create AI Model ' . $model . ': ' . mysqli_error($mysqli));
+        flashAlert("AI Model <strong>$model</strong> could not be created - see Admin > App Logs", 'error');
+        redirect();
+    }
 
     logAudit("AI Model", "Create", "$session_name created AI Model $model");
 
@@ -36,7 +44,11 @@ if (isset($_POST['edit_ai_model'])) {
     $prompt = escapeSql($_POST['prompt']);
     $use_case = escapeSql($_POST['use_case']);
 
-    mysqli_query($mysqli,"UPDATE ai_models SET ai_model_name = '$model', ai_model_prompt = '$prompt', ai_model_use_case = '$use_case' WHERE ai_model_id = $model_id");
+    // Blank means "send no temperature at all" - the only setting that works on every
+    // provider. Anything else rides as a numeric literal, so no quoting.
+    $temperature = ($_POST['temperature'] ?? '') === '' ? 'NULL' : floatval($_POST['temperature']);
+
+    mysqli_query($mysqli,"UPDATE ai_models SET ai_model_name = '$model', ai_model_prompt = '$prompt', ai_model_use_case = '$use_case', ai_model_temperature = $temperature WHERE ai_model_id = $model_id");
 
     logAudit("AI Model", "Edit", "$session_name edited AI Model $model");
 

admin/post/users.php

@@ -54,7 +54,7 @@ if (isset($_POST['add_user'])) {
     // Create Settings
     mysqli_query($mysqli, "INSERT INTO user_settings SET user_id = $user_id, user_config_force_mfa = $force_mfa");
 
-    $sql = mysqli_query($mysqli,"SELECT * FROM companies WHERE company_id = 1");
+    $sql = mysqli_query($mysqli,"SELECT company_name FROM companies WHERE company_id = 1");
     $row = mysqli_fetch_assoc($sql);
     $company_name = escapeSql($row['company_name']);
 
@@ -328,7 +328,7 @@ if (isset($_POST['restore_user'])) {
 
 }
 
-if (isset($_POST['export_users'])) {
+if (isExportRequest('export_users')) {
 
     validateCSRFToken();
 
@@ -355,7 +355,7 @@ if (isset($_POST['export_users'])) {
 
     $sql = mysqli_query(
         $mysqli,
-        "SELECT * FROM users
+        "SELECT user_status FROM users
         LEFT JOIN user_roles ON user_role_id = role_id
         WHERE (user_name LIKE '%$q%' OR user_email LIKE '%$q%')
         AND user_type = 1
@@ -402,7 +402,7 @@ if (isset($_POST['ir_reset_user_password'])) {
 
     // Confirm logged-in user password, for security
     $admin_password = $_POST['admin_password'];
-    $sql = mysqli_query($mysqli, "SELECT * FROM users WHERE user_id = $session_user_id");
+    $sql = mysqli_query($mysqli, "SELECT user_password FROM users WHERE user_id = $session_user_id");
     $userRow = mysqli_fetch_assoc($sql);
 
     if (!password_verify($admin_password, $userRow['user_password'])) {
@@ -411,7 +411,7 @@ if (isset($_POST['ir_reset_user_password'])) {
     }
 
     // Get agents/users, other than the current user
-    $sql_users = mysqli_query($mysqli, "SELECT * FROM users WHERE (user_archived_at IS NULL AND user_id != $session_user_id)");
+    $sql_users = mysqli_query($mysqli, "SELECT user_email, user_id FROM users WHERE (user_archived_at IS NULL AND user_id != $session_user_id)");
 
     // Reset passwords
     while ($row = mysqli_fetch_assoc($sql_users)) {

admin/project_template.php

@@ -8,7 +8,8 @@ if (isset($_GET['project_template_id'])) {
 
     $sql_project_templates = mysqli_query(
         $mysqli,
-        "SELECT * FROM project_templates
+        "SELECT project_template_created_at, project_template_description, project_template_name,
+            project_template_updated_at FROM project_templates
         WHERE project_template_id = $project_template_id LIMIT 1"
     );
 
@@ -27,7 +28,9 @@ if (isset($_GET['project_template_id'])) {
     $project_template_updated_at = escapeHtml($row['project_template_updated_at']);
 
     // Get Associated Ticket Templates
-    $sql_ticket_templates = mysqli_query($mysqli, "SELECT * FROM ticket_templates, project_template_ticket_templates
+    $sql_ticket_templates = mysqli_query($mysqli, "SELECT ticket_template_created_at, ticket_template_description,
+        project_template_ticket_templates.ticket_template_id, ticket_template_name,
+        ticket_template_order, ticket_template_subject, ticket_template_updated_at FROM ticket_templates, project_template_ticket_templates
         WHERE ticket_templates.ticket_template_id = project_template_ticket_templates.ticket_template_id
         AND project_template_ticket_templates.project_template_id = $project_template_id
         ORDER BY ticket_template_order ASC, ticket_template_name ASC");
@@ -35,7 +38,7 @@ if (isset($_GET['project_template_id'])) {
 
     // Get All Task Templates
     $sql_task_templates = mysqli_query($mysqli,
-        "SELECT * FROM ticket_templates, task_templates, project_template_ticket_templates
+        "SELECT task_template_id, task_template_name FROM ticket_templates, task_templates, project_template_ticket_templates
         WHERE ticket_templates.ticket_template_id = project_template_ticket_templates.ticket_template_id
         AND project_template_ticket_templates.project_template_id = $project_template_id
         AND ticket_templates.ticket_template_id = task_template_ticket_template_id

admin/project_templates.php

@@ -8,7 +8,8 @@ require_once "includes/inc_all_admin.php";
 
 $sql = mysqli_query(
     $mysqli,
-    "SELECT SQL_CALC_FOUND_ROWS * FROM project_templates
+    "SELECT SQL_CALC_FOUND_ROWS project_template_created_at, project_template_description, project_template_id,
+        project_template_name FROM project_templates
     WHERE (project_template_name LIKE '%$q%' OR project_template_description LIKE '%$q%')
     AND project_template_archived_at IS NULL
     ORDER BY $sort $order LIMIT $record_from, $record_to"
@@ -68,7 +69,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                     $project_template_created_at = escapeHtml($row['project_template_created_at']);
 
                     // Get Ticket Template Count
-                    $sql_ticket_templates = mysqli_query($mysqli, "SELECT * FROM ticket_templates, project_template_ticket_templates
+                    $sql_ticket_templates = mysqli_query($mysqli, "SELECT 1 FROM ticket_templates, project_template_ticket_templates
                         WHERE ticket_templates.ticket_template_id = project_template_ticket_templates.ticket_template_id
                         AND project_template_ticket_templates.project_template_id = $project_template_id
                         ORDER BY ticket_template_order ASC, ticket_template_name ASC");
@@ -76,7 +77,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
 
                     // Get Tasks Template Count
                     $sql_task_templates = mysqli_query($mysqli,
-                        "SELECT * FROM ticket_templates, task_templates, project_template_ticket_templates
+                        "SELECT 1 FROM ticket_templates, task_templates, project_template_ticket_templates
                         WHERE ticket_templates.ticket_template_id = project_template_ticket_templates.ticket_template_id
                         AND project_template_ticket_templates.project_template_id = $project_template_id
                         AND ticket_templates.ticket_template_id = task_template_ticket_template_id

admin/roles.php

@@ -75,7 +75,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                         $sql_role_user_count = mysqli_query($mysqli, "SELECT COUNT(user_id) FROM users WHERE user_role_id = $role_id AND user_archived_at IS NULL");
                         $role_user_count = mysqli_fetch_row($sql_role_user_count)[0];
 
-                        $sql_users = mysqli_query($mysqli, "SELECT * FROM users WHERE user_role_id = $role_id AND user_archived_at IS NULL");
+                        $sql_users = mysqli_query($mysqli, "SELECT user_name FROM users WHERE user_role_id = $role_id AND user_archived_at IS NULL");
                         // Initialize an empty array to hold user names
                         $user_names = [];
 

admin/settings_company.php

@@ -2,7 +2,9 @@
 require_once "includes/inc_all_admin.php";
 
 
-$sql = mysqli_query($mysqli,"SELECT * FROM companies, settings WHERE companies.company_id = settings.company_id AND companies.company_id = 1");
+$sql = mysqli_query($mysqli,"SELECT company_address, company_city, company_country, company_currency, company_email,
+    settings.company_id, company_locale, company_logo, company_name, company_phone,
+    company_phone_country_code, company_state, company_tax_id, company_website, company_zip FROM companies, settings WHERE companies.company_id = settings.company_id AND companies.company_id = 1");
 
 $row = mysqli_fetch_assoc($sql);
 $company_id = intval($row['company_id']);

admin/settings_default.php

@@ -59,7 +59,7 @@ $net_terms_array = array (
                         <option value="0">- None -</option>
                         <?php
 
-                        $sql = mysqli_query($mysqli, "SELECT * FROM calendars ORDER BY calendar_name ASC");
+                        $sql = mysqli_query($mysqli, "SELECT calendar_id, calendar_name FROM calendars ORDER BY calendar_name ASC");
                         while ($row = mysqli_fetch_assoc($sql)) {
                             $calendar_id = intval($row['calendar_id']);
                             $calendar_name = escapeHtml($row['calendar_name']); ?>
@@ -82,7 +82,7 @@ $net_terms_array = array (
                         <option value="0">- None -</option>
                         <?php
 
-                        $sql = mysqli_query($mysqli, "SELECT * FROM accounts WHERE account_archived_at IS NULL ORDER BY account_name ASC");
+                        $sql = mysqli_query($mysqli, "SELECT account_id, account_name FROM accounts WHERE account_archived_at IS NULL ORDER BY account_name ASC");
                         while ($row = mysqli_fetch_assoc($sql)) {
                             $account_id = intval($row['account_id']);
                             $account_name = escapeHtml($row['account_name']); ?>
@@ -105,7 +105,7 @@ $net_terms_array = array (
                         <option value="0">- None -</option>
                         <?php
 
-                        $sql = mysqli_query($mysqli, "SELECT * FROM accounts WHERE account_archived_at IS NULL ORDER BY account_name ASC");
+                        $sql = mysqli_query($mysqli, "SELECT account_id, account_name FROM accounts WHERE account_archived_at IS NULL ORDER BY account_name ASC");
                         while ($row = mysqli_fetch_assoc($sql)) {
                             $account_id = intval($row['account_id']);
                             $account_name = escapeHtml($row['account_name']); ?>
@@ -128,7 +128,7 @@ $net_terms_array = array (
                         <option value="0">- None -</option>
                         <?php
 
-                        $sql = mysqli_query($mysqli, "SELECT * FROM accounts WHERE account_archived_at IS NULL ORDER BY account_name ASC");
+                        $sql = mysqli_query($mysqli, "SELECT account_id, account_name FROM accounts WHERE account_archived_at IS NULL ORDER BY account_name ASC");
                         while ($row = mysqli_fetch_assoc($sql)) {
                             $account_id = intval($row['account_id']);
                             $account_name = escapeHtml($row['account_name']); ?>
@@ -153,7 +153,7 @@ $net_terms_array = array (
                         <option value="0">- None -</option>
                         <?php
 
-                        $sql = mysqli_query($mysqli, "SELECT * FROM accounts WHERE account_archived_at IS NULL ORDER BY account_name ASC");
+                        $sql = mysqli_query($mysqli, "SELECT account_id, account_name FROM accounts WHERE account_archived_at IS NULL ORDER BY account_name ASC");
                         while ($row = mysqli_fetch_assoc($sql)) {
                             $account_id = intval($row['account_id']);
                             $account_name = escapeHtml($row['account_name']); ?>
@@ -176,7 +176,7 @@ $net_terms_array = array (
                         <option value="">- None -</option>
                         <?php
 
-                        $sql = mysqli_query($mysqli, "SELECT * FROM categories WHERE category_type = 'Payment Method' ORDER BY category_name ASC");
+                        $sql = mysqli_query($mysqli, "SELECT category_name FROM categories WHERE category_type = 'Payment Method' ORDER BY category_name ASC");
                         while ($row = mysqli_fetch_assoc($sql)) {
                             $payment_method = escapeHtml($row['category_name']); ?>
                             <option <?php if ($config_default_payment_method == $payment_method) {
@@ -198,7 +198,7 @@ $net_terms_array = array (
                         <option value="">- None -</option>
                         <?php
 
-                        $sql = mysqli_query($mysqli, "SELECT * FROM categories WHERE category_type = 'Payment Method' ORDER BY category_name ASC");
+                        $sql = mysqli_query($mysqli, "SELECT category_name FROM categories WHERE category_type = 'Payment Method' ORDER BY category_name ASC");
                         while ($row = mysqli_fetch_assoc($sql)) {
                             $payment_method = escapeHtml($row['category_name']); ?>
                             <option <?php if ($config_default_expense_payment_method == $payment_method) {

admin/settings_localization.php

@@ -2,7 +2,7 @@
 require_once "includes/inc_all_admin.php";
 
 
-$sql = mysqli_query($mysqli,"SELECT * FROM companies, settings WHERE companies.company_id = settings.company_id AND companies.company_id = 1");
+$sql = mysqli_query($mysqli,"SELECT company_currency, company_locale FROM companies, settings WHERE companies.company_id = settings.company_id AND companies.company_id = 1");
 
 $row = mysqli_fetch_assoc($sql);
 $company_locale = escapeHtml($row['company_locale']);

admin/sla.php

@@ -12,7 +12,8 @@ $config_sla_warning_percent = intval($row['config_sla_warning_percent']);
 $config_sla_notification_email = escapeHtml($row['config_sla_notification_email']);
 
 // SLA plans (active first)
-$sql_slas = mysqli_query($mysqli, "SELECT * FROM slas ORDER BY sla_archived_at IS NOT NULL, sla_name ASC");
+$sql_slas = mysqli_query($mysqli, "SELECT sla_archived_at, sla_description, sla_id, sla_name, sla_resolution_minutes,
+    sla_response_minutes FROM slas ORDER BY sla_archived_at IS NOT NULL, sla_name ASC");
 
 // Active plans for the assignment dropdowns
 $active_slas = [];

admin/software_templates.php

@@ -8,7 +8,9 @@ require_once "includes/inc_all_admin.php";
 
 $sql = mysqli_query(
     $mysqli,
-    "SELECT SQL_CALC_FOUND_ROWS * FROM software_templates
+    "SELECT SQL_CALC_FOUND_ROWS software_template_description, software_template_id, software_template_license_type,
+        software_template_name, software_template_notes, software_template_type,
+        software_template_version FROM software_templates
     WHERE software_template_name LIKE '%$q%' OR software_template_type LIKE '%$q%'
     ORDER BY $sort $order LIMIT $record_from, $record_to"
 );

admin/tags.php

@@ -26,7 +26,7 @@ $tag_type_display = $tag_types[$type_filter]['label'] ?? 'Unknown';
 
 $sql = mysqli_query(
     $mysqli,
-    "SELECT SQL_CALC_FOUND_ROWS * FROM tags
+    "SELECT SQL_CALC_FOUND_ROWS tag_color, tag_icon, tag_id, tag_name FROM tags
     WHERE tag_name LIKE '%$q%'
     AND tag_type = $type_filter
     ORDER BY $sort $order LIMIT $record_from, $record_to"

admin/tax_rates.php

@@ -8,7 +8,7 @@ require_once "includes/inc_all_admin.php";
 
 $sql = mysqli_query(
     $mysqli,
-    "SELECT * FROM taxes
+    "SELECT tax_id, tax_name, tax_percent FROM taxes
     WHERE tax_archived_at IS NULL
     ORDER BY $sort $order"
 );

admin/ticket_statuses.php

@@ -8,7 +8,8 @@ require_once "includes/inc_all_admin.php";
 
 $sql = mysqli_query(
     $mysqli,
-    "SELECT SQL_CALC_FOUND_ROWS * FROM ticket_statuses
+    "SELECT SQL_CALC_FOUND_ROWS ticket_status_active, ticket_status_color, ticket_status_id, ticket_status_name,
+        ticket_status_pauses_sla FROM ticket_statuses
     WHERE ticket_status_name LIKE '%$q%'
     ORDER BY $sort $order LIMIT $record_from, $record_to"
 );

admin/ticket_template.php

@@ -15,7 +15,8 @@ if (isset($_GET['ticket_template_id'])) {
     $ticket_template_id = intval($_GET['ticket_template_id']);
 }
 
-$sql_ticket_template = mysqli_query($mysqli, "SELECT * FROM ticket_templates WHERE ticket_template_id = $ticket_template_id LIMIT 1");
+$sql_ticket_template = mysqli_query($mysqli, "SELECT ticket_template_created_at, ticket_template_description, ticket_template_details,
+    ticket_template_name, ticket_template_subject, ticket_template_updated_at FROM ticket_templates WHERE ticket_template_id = $ticket_template_id LIMIT 1");
 
 if (mysqli_num_rows($sql_ticket_template) == 0) {
     echo "<center><h1 class='text-secondary mt-5'>Nothing to see here</h1><a class='btn btn-lg btn-secondary mt-3' href='javascript:history.back()'><i class='fa fa-fw fa-arrow-left'></i> Go Back</a></center>";
@@ -33,7 +34,7 @@ $ticket_template_created_at = escapeHtml($row['ticket_template_created_at']);
 $ticket_template_updated_at = escapeHtml($row['ticket_template_updated_at']);
 
 // Get Task Templates
-$sql_task_templates = mysqli_query($mysqli, "SELECT * FROM task_templates WHERE task_template_ticket_template_id = $ticket_template_id ORDER BY task_template_order ASC, task_template_id ASC");
+$sql_task_templates = mysqli_query($mysqli, "SELECT task_template_completion_estimate, task_template_id, task_template_name FROM task_templates WHERE task_template_ticket_template_id = $ticket_template_id ORDER BY task_template_order ASC, task_template_id ASC");
 
 ?>
 

admin/users.php

@@ -8,7 +8,8 @@ require_once "includes/inc_all_admin.php";
 
 $sql = mysqli_query(
     $mysqli,
-    "SELECT SQL_CALC_FOUND_ROWS * FROM users
+    "SELECT SQL_CALC_FOUND_ROWS role_name, user_archived_at, user_avatar, user_config_force_mfa, user_email,
+        user_settings.user_id, user_name, user_role_id, user_status, user_token FROM users
     LEFT JOIN user_roles ON user_role_id = role_id
     LEFT JOIN user_settings ON users.user_id = user_settings.user_id
     WHERE (user_name LIKE '%$q%' OR user_email LIKE '%$q%')
@@ -132,7 +133,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
 
                     $sql_last_login = mysqli_query(
                         $mysqli,
-                        "SELECT * FROM logs
+                        "SELECT log_created_at, log_ip, log_user_agent FROM logs
                         WHERE log_user_id = $user_id AND log_type = 'Login'
                         ORDER BY log_id DESC LIMIT 1"
                     );
@@ -155,7 +156,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                         $client_access_array[] = intval($row['client_id']);
                     }
 
-                    $sql_remember_tokens = mysqli_query($mysqli, "SELECT * FROM remember_tokens WHERE remember_token_user_id = $user_id");
+                    $sql_remember_tokens = mysqli_query($mysqli, "SELECT 1 FROM remember_tokens WHERE remember_token_user_id = $user_id");
                     $remember_token_count = mysqli_num_rows($sql_remember_tokens);
 
 

admin/vendor_templates.php

@@ -8,7 +8,10 @@ require_once "includes/inc_all_admin.php";
 
 $sql = mysqli_query(
     $mysqli,
-    "SELECT SQL_CALC_FOUND_ROWS * FROM vendor_templates
+    "SELECT SQL_CALC_FOUND_ROWS vendor_template_account_number, vendor_template_code, vendor_template_contact_name,
+        vendor_template_description, vendor_template_email, vendor_template_extension,
+        vendor_template_hours, vendor_template_id, vendor_template_name, vendor_template_notes,
+        vendor_template_phone, vendor_template_sla, vendor_template_website FROM vendor_templates
     WHERE vendor_template_name LIKE '%$q%' OR vendor_template_description LIKE '%$q%' OR vendor_template_account_number LIKE '%$q%' OR vendor_template_website LIKE '%$q%' OR vendor_template_contact_name LIKE '%$q%' OR vendor_template_email LIKE '%$q%' OR vendor_template_phone LIKE '%$phone_query%' ORDER BY $sort $order LIMIT $record_from, $record_to"
 );
 

agent/accounts.php

@@ -11,7 +11,7 @@ enforceUserPermission('module_financial');
 
 $sql = mysqli_query(
     $mysqli,
-    "SELECT SQL_CALC_FOUND_ROWS * FROM accounts
+    "SELECT SQL_CALC_FOUND_ROWS account_currency_code, account_id, account_name, account_notes, opening_balance FROM accounts
     WHERE (account_name LIKE '%$q%')
     AND account_archived_at IS NULL
     ORDER BY $sort $order LIMIT $record_from, $record_to"

agent/ajax.php

@@ -239,7 +239,7 @@ if (isset($_GET['share_generate_link'])) {
         $url = "https://$config_base_url/guest/guest_view_item.php?id=$share_id&key=$item_key";
     }
 
-    $sql = mysqli_query($mysqli,"SELECT * FROM companies WHERE company_id = 1");
+    $sql = mysqli_query($mysqli,"SELECT company_name, company_phone, company_phone_country_code FROM companies WHERE company_id = 1");
     $row = mysqli_fetch_assoc($sql);
     $company_name = escapeSql($row['company_name']);
     $company_phone = escapeSql(formatPhoneNumber($row['company_phone'], $row['company_phone_country_code']));
@@ -294,7 +294,7 @@ if (isset($_GET['get_active_clients'])) {
         $mysqli,
         "SELECT client_id, client_name FROM clients
         WHERE client_archived_at IS NULL
-        $access_permission_query
+        " . clientScopeSql('clients.client_id') . "
         ORDER BY client_accessed_at DESC"
     );
 
@@ -320,7 +320,7 @@ if (isset($_GET['get_client_contacts'])) {
         "SELECT contact_id, contact_name, contact_title, contact_email, contact_primary, contact_important, contact_technical FROM contacts
         LEFT JOIN clients on contact_client_id = client_id
         WHERE contacts.contact_archived_at IS NULL AND contact_client_id = $client_id
-        $access_permission_query
+        " . clientScopeSql('contact_client_id') . "
         ORDER BY contact_primary DESC, contact_technical DESC, contact_important DESC, contact_name"
     );
 
@@ -350,7 +350,7 @@ if (isset($_GET['get_client_assets'])) {
         LEFT JOIN clients on asset_client_id = client_id
         LEFT JOIN contacts ON contact_id = asset_contact_id
         WHERE assets.asset_archived_at IS NULL AND asset_client_id = $client_id
-        $access_permission_query
+        " . clientScopeSql('asset_client_id') . "
         ORDER BY asset_type ASC, asset_favorite DESC, asset_name"
     );
 
@@ -379,7 +379,7 @@ if (isset($_GET['get_client_locations'])) {
         "SELECT location_id, location_name FROM locations
         LEFT JOIN clients on location_client_id = client_id
         WHERE locations.location_archived_at IS NULL AND location_client_id = $client_id
-        $access_permission_query
+        " . clientScopeSql('location_client_id') . "
         ORDER BY location_primary DESC, location_name ASC"
     );
 
@@ -408,7 +408,7 @@ if (isset($_GET['get_client_vendors'])) {
         "SELECT vendor_id, vendor_name FROM vendors
         LEFT JOIN clients on vendor_client_id = client_id
         WHERE vendors.vendor_archived_at IS NULL AND vendor_client_id = $client_id
-        $access_permission_query
+        " . clientScopeSql('vendor_client_id') . "
         ORDER BY vendor_name ASC"
     );
 
@@ -437,7 +437,7 @@ if (isset($_GET['get_client_projects'])) {
         "SELECT project_id, project_name FROM projects
         LEFT JOIN clients on project_client_id = client_id
         WHERE projects.project_archived_at IS NULL AND projects.project_completed_at IS NULL AND project_client_id = $client_id
-        $access_permission_query
+        " . clientScopeSql('project_client_id') . "
         ORDER BY project_name ASC"
     );
 
@@ -564,7 +564,6 @@ if (isset($_POST['update_kanban_ticket'])) {
 
                     // Get details
                     $ticket_sql = mysqli_query($mysqli, "SELECT contact_name, contact_email, ticket_prefix, ticket_number, ticket_subject, ticket_status_name, ticket_assigned_to, ticket_url_key, ticket_client_id FROM tickets
-                        LEFT JOIN clients ON ticket_client_id = client_id
                         LEFT JOIN contacts ON ticket_contact_id = contact_id
                         LEFT JOIN ticket_statuses ON ticket_status = ticket_status_id
                         WHERE ticket_id = $ticket_id
@@ -838,127 +837,88 @@ if (isset($_GET['ai_reword'])) {
 
     header('Content-Type: application/json');
 
-    $sql = mysqli_query($mysqli, "SELECT * FROM ai_models LEFT JOIN ai_providers ON ai_model_ai_provider_id = ai_provider_id WHERE ai_model_use_case = 'General' LIMIT 1");
+    // The reword button sits on every TinyMCE instance, so the ticket editor asks for
+    // the Tickets model and everything else gets General. Anything unrecognised is
+    // treated as General rather than trusted into the query.
+    $use_case = ($_GET['use_case'] ?? '') === 'Tickets' ? 'Tickets' : 'General';
 
-    $row = mysqli_fetch_assoc($sql);
+    $model = getAiModel($use_case);
-    $model_name = $row['ai_model_name'];
+
-    $promptText = $row['ai_model_prompt'];
+    if (!$model) {
-    $url = $row['ai_provider_api_url'];
+        echo json_encode(['error' => aiModelMissingError($use_case)]);
-    $key = $row['ai_provider_api_key'];
+        exit;
+    }
 
     // Collecting the input data from the AJAX request.
     $inputJSON = file_get_contents('php://input');
     $input = json_decode($inputJSON, TRUE); // Convert JSON into array.
 
-    $userText = $input['text'];
+    $userText = $input['text'] ?? '';
 
-    // Preparing the data for the OpenAI Chat API request.
+    $result = callAiApi($model, [
-    $data = [
+        ["role" => "system", "content" => $model['ai_model_prompt']],
-        "model" => "$model_name", // Specify the model
+        ["role" => "user", "content" => $userText],
-        "messages" => [
-            ["role" => "system", "content" => $promptText],
-            ["role" => "user", "content" => $userText],
-        ],
-        "temperature" => 0.5
-    ];
-
-    // Initialize cURL session to the OpenAI Chat API.
-    $ch = curl_init("$url");
-
-    // Set cURL options for the request.
-    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
-    curl_setopt($ch, CURLOPT_POST, true);
-    curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($data));
-    curl_setopt($ch, CURLOPT_HTTPHEADER, [
-        'Content-Type: application/json',
-        'Authorization: Bearer ' . $key,
     ]);
 
-    // Execute the cURL session and capture the response.
+    // Report failures as an error, never as reworded text - the editor writes
-    $response = curl_exec($ch);
+    // rewordedText straight back over the user's content
-    curl_close($ch);
+    if (!$result['ok']) {
-
+        echo json_encode(['error' => $result['error']]);
-    // Decode the JSON response.
+        exit;
-    $responseData = json_decode($response, true);
-
-    // Check if the response contains the expected data and return it.
-    if (isset($responseData['choices'][0]['message']['content'])) {
-        // Get the response content.
-        $content = $responseData['choices'][0]['message']['content'];
-
-        // Clean any leading "html" word or other unwanted text at the beginning.
-        $content = preg_replace('/^html/i', '', $content);  // Remove any occurrence of 'html' at the start
-
-        // Clean the response content to remove backticks or code block markers.
-        $cleanedContent = str_replace('```', '', $content); // Remove backticks if they exist.
-
-        // Trim any leading/trailing whitespace.
-        $cleanedContent = trim($cleanedContent);
-
-        // Return the cleaned response.
-        echo json_encode(['rewordedText' => $cleanedContent]);
-    } else {
-        // Handle errors or unexpected response structure.
-        echo json_encode(['rewordedText' => 'Failed to get a response from the AI API.']);
     }
 
+    $content = $result['content'];
+
+    // Clean any leading "html" word or other unwanted text at the beginning.
+    $content = preg_replace('/^html/i', '', $content);  // Remove any occurrence of 'html' at the start
+
+    // Clean the response content to remove backticks or code block markers.
+    $cleanedContent = str_replace('```', '', $content); // Remove backticks if they exist.
+
+    // Trim any leading/trailing whitespace.
+    $cleanedContent = trim($cleanedContent);
+
+    echo json_encode(['rewordedText' => $cleanedContent]);
+
 }
 
 if (isset($_GET['ai_create_document_template'])) {
-    // get_ai_document_template.php
+
+    enforceUserPermission('module_support');
 
     header('Content-Type: text/html; charset=UTF-8');
 
-    $sql = mysqli_query($mysqli, "SELECT * FROM ai_models LEFT JOIN ai_providers ON ai_model_ai_provider_id = ai_provider_id WHERE ai_model_use_case = 'General' LIMIT 1");
-
-    $row = mysqli_fetch_assoc($sql);
-    $model_name = $row['ai_model_name'];
-    $url = $row['ai_provider_api_url'];
-    $key = $row['ai_provider_api_key'];
-
     $prompt = $_POST['prompt'] ?? '';
 
     // Basic validation
-    if(empty($prompt)){
+    if (empty($prompt)) {
         echo "No prompt provided.";
         exit;
     }
 
+    $model = getAiModel('Documentation');
+
+    if (!$model) {
+        echo escapeHtml(aiModelMissingError('Documentation'));
+        exit;
+    }
+
     // Prepare prompt
     $system_message = "You are a helpful IT documentation assistant. You will create a well-structured HTML template for IT documentation based on a given prompt. Include headings, subheadings, bullet points, and possibly tables for clarity. No Lorem Ipsum, use realistic placeholders and professional language.";
     $user_message = "Create an HTML formatted IT documentation template based on the following request:\n\n\"$prompt\"\n\nThe template should be structured, professional, and useful for IT staff. Include relevant sections, instructions, prerequisites, and best practices.";
 
-    $post_data = [
+    $result = callAiApi($model, [
-        "model" => "$model_name",
+        ["role" => "system", "content" => $system_message],
-        "messages" => [
+        ["role" => "user", "content" => $user_message]
-            ["role" => "system", "content" => $system_message],
-            ["role" => "user", "content" => $user_message]
-        ],
-        "temperature" => 0.5
-    ];
-
-    $ch = curl_init();
-    curl_setopt($ch, CURLOPT_URL, $url);
-    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
-    curl_setopt($ch, CURLOPT_POST, true);
-    curl_setopt($ch, CURLOPT_HTTPHEADER, [
-        'Content-Type: application/json',
-        'Authorization: Bearer ' . $key
     ]);
-    curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($post_data));
 
-    $response = curl_exec($ch);
+    if (!$result['ok']) {
-    if (curl_errno($ch)) {
+        echo "<p>" . escapeHtml($result['error']) . "</p>";
-        echo "Error: " . curl_error($ch);
         exit;
     }
-    curl_close($ch);
-
-    $response_data = json_decode($response, true);
-    $template = $response_data['choices'][0]['message']['content'] ?? "<p>No content returned from AI.</p>";
 
     // Print the generated HTML template directly
-    echo $template;
+    echo $result['content'];
 }
 
 if (isset($_GET['ai_ticket_summary'])) {
@@ -967,12 +927,12 @@ if (isset($_GET['ai_ticket_summary'])) {
 
     header('Content-Type: text/html; charset=UTF-8');
 
-    $sql = mysqli_query($mysqli, "SELECT * FROM ai_models LEFT JOIN ai_providers ON ai_model_ai_provider_id = ai_provider_id WHERE ai_model_use_case = 'General' LIMIT 1");
+    $model = getAiModel('Tickets');
 
-    $row = mysqli_fetch_assoc($sql);
+    if (!$model) {
-    $model_name = $row['ai_model_name'];
+        echo escapeHtml(aiModelMissingError('Tickets'));
-    $url = $row['ai_provider_api_url'];
+        exit;
-    $key = $row['ai_provider_api_key'];
+    }
 
     // Retrieve the ticket_id from POST
     $ticket_id = intval($_POST['ticket_id']);
@@ -1049,38 +1009,17 @@ if (isset($_GET['ai_ticket_summary'])) {
     If any part of the ticket or replies is unclear or ambiguous, mention it in the summary and suggest if further clarification is needed.
     ";
 
-    // Prepare the POST data
+    $result = callAiApi($model, [
-    $post_data = [
+        ["role" => "system", "content" => "Your task is to summarize IT support tickets with clear, concise details."],
-        "model" => "$model_name",
+        ["role" => "user", "content" => $prompt]
-        "messages" => [
-            ["role" => "system", "content" => "Your task is to summarize IT support tickets with clear, concise details."],
-            ["role" => "user", "content" => $prompt]
-        ],
-        "temperature" => 0.3
-    ];
-
-    $ch = curl_init();
-    curl_setopt($ch, CURLOPT_URL, $url);
-    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
-    curl_setopt($ch, CURLOPT_POST, true);
-    curl_setopt($ch, CURLOPT_HTTPHEADER, [
-        'Content-Type: application/json',
-        'Authorization: Bearer ' . $key
     ]);
-    curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($post_data));
 
-    $response = curl_exec($ch);
+    if (!$result['ok']) {
-    if (curl_errno($ch)) {
+        echo "<p>" . escapeHtml($result['error']) . "</p>";
-        echo "Error: " . curl_error($ch);
         exit;
     }
-    curl_close($ch);
 
-    $response_data = json_decode($response, true);
+    echo $result['content'];
-    $summary = $response_data['choices'][0]['message']['content'] ?? "No summary available.";
-
-
-    echo $summary; // nl2br to convert newlines to <br>, htmlspecialchars to prevent XSS
 }
 
 // Stops people trying to use sub-domains in the domains tracker

agent/asset.php

@@ -14,7 +14,15 @@ if (isset($_GET['client_id'])) {
 if (isset($_GET['asset_id'])) {
     $asset_id = intval($_GET['asset_id']);
 
-    $sql = mysqli_query($mysqli, "SELECT * FROM assets
+    $sql = mysqli_query($mysqli, "SELECT asset_contact_id, asset_created_at, asset_description, asset_favorite, asset_id,
+        asset_install_date, asset_location_id, asset_make, asset_model, asset_name, asset_notes,
+        asset_os, asset_photo, asset_physical_location, asset_purchase_date,
+        asset_purchase_reference, asset_serial, asset_status, asset_type, asset_uri, asset_uri_2,
+        asset_uri_client, asset_vendor_id, asset_warranty_expire, client_id, client_name,
+        contact_archived_at, contact_email, contact_extension, contact_mobile,
+        contact_mobile_country_code, contact_name, contact_phone, contact_phone_country_code,
+        interface_ip, interface_ipv6, interface_mac, interface_nat_ip, interface_network_id,
+        location_archived_at, location_name FROM assets
         LEFT JOIN clients ON client_id = asset_client_id
         LEFT JOIN contacts ON asset_contact_id = contact_id
         LEFT JOIN locations ON asset_location_id = location_id
@@ -114,7 +122,7 @@ if (isset($_GET['asset_id'])) {
         $recurring_ticket_count = mysqli_num_rows($sql_related_recurring_tickets);
 
         // Related Documents
-        $sql_related_documents = mysqli_query($mysqli, "SELECT * FROM asset_documents
+        $sql_related_documents = mysqli_query($mysqli, "SELECT 1 FROM asset_documents
             LEFT JOIN documents ON asset_documents.document_id = documents.document_id
             WHERE asset_documents.asset_id = $asset_id
             AND document_archived_at IS NULL
@@ -125,7 +133,7 @@ if (isset($_GET['asset_id'])) {
         // Tags - many to many relationship
         $asset_tag_name_display_array = array();
         $asset_tag_id_array = array();
-        $sql_asset_tags = mysqli_query($mysqli, "SELECT * FROM asset_tags LEFT JOIN tags ON asset_tag_tag_id = tag_id WHERE asset_tag_asset_id = $asset_id ORDER BY tag_name ASC");
+        $sql_asset_tags = mysqli_query($mysqli, "SELECT tag_color, tag_icon, tag_id, tag_name FROM asset_tags LEFT JOIN tags ON asset_tag_tag_id = tag_id WHERE asset_tag_asset_id = $asset_id ORDER BY tag_name ASC");
         while ($row = mysqli_fetch_assoc($sql_asset_tags)) {
 
             $asset_tag_id = intval($row['tag_id']);
@@ -186,7 +194,7 @@ if (isset($_GET['asset_id'])) {
         $interface_count = mysqli_num_rows($sql_related_interfaces);
 
         // Related Files
-        $sql_related_files = mysqli_query($mysqli, "SELECT * FROM asset_files
+        $sql_related_files = mysqli_query($mysqli, "SELECT file_created_at, file_description, file_ext, files.file_id, file_name FROM asset_files
             LEFT JOIN files ON asset_files.file_id = files.file_id
             WHERE asset_files.asset_id = $asset_id
             AND file_archived_at IS NULL
@@ -206,7 +214,8 @@ if (isset($_GET['asset_id'])) {
         }
 
         // Related Documents
-        $sql_related_documents = mysqli_query($mysqli, "SELECT * FROM asset_documents, documents
+        $sql_related_documents = mysqli_query($mysqli, "SELECT document_created_at, document_description, documents.document_id, document_name,
+            document_updated_at, user_name FROM asset_documents, documents
             LEFT JOIN users ON document_created_by = user_id
             WHERE asset_documents.asset_id = $asset_id
             AND asset_documents.document_id = documents.document_id
@@ -243,7 +252,9 @@ if (isset($_GET['asset_id'])) {
         // Related Software Query
         $sql_related_software = mysqli_query(
             $mysqli,
-            "SELECT * FROM software_assets
+            "SELECT software_expire, software_assets.software_id, software_key, software_license_type,
+                software_name, software_notes, software_purchase, software_seats, software_type,
+                software_version FROM software_assets
             LEFT JOIN software ON software_assets.software_id = software.software_id
             WHERE software_assets.asset_id = $asset_id
             AND software_archived_at IS NULL
@@ -253,7 +264,8 @@ if (isset($_GET['asset_id'])) {
         $software_count = mysqli_num_rows($sql_related_software);
 
         // Linked Services
-        $sql_linked_services = mysqli_query($mysqli, "SELECT * FROM service_assets, services
+        $sql_linked_services = mysqli_query($mysqli, "SELECT service_category, service_description, service_assets.service_id, service_importance,
+            service_name FROM service_assets, services
             WHERE service_assets.asset_id = $asset_id
             AND service_assets.service_id = services.service_id
             ORDER BY service_name ASC"
@@ -263,7 +275,7 @@ if (isset($_GET['asset_id'])) {
         $linked_services = array();
 
         // Notes - 1 to many relationship
-        $sql_related_notes = mysqli_query($mysqli, "SELECT * FROM asset_notes
+        $sql_related_notes = mysqli_query($mysqli, "SELECT asset_note, asset_note_created_at, asset_note_id, asset_note_type, user_name FROM asset_notes
             LEFT JOIN users ON asset_note_created_by = user_id
             WHERE asset_note_asset_id = $asset_id
             AND asset_note_archived_at IS NULL
@@ -690,7 +702,7 @@ if (isset($_GET['asset_id'])) {
                                     // Tags
                                     $credential_tag_name_display_array = array();
                                     $credential_tag_id_array = array();
-                                    $sql_credential_tags = mysqli_query($mysqli, "SELECT * FROM credential_tags LEFT JOIN tags ON credential_tags.tag_id = tags.tag_id WHERE credential_id = $credential_id ORDER BY tag_name ASC");
+                                    $sql_credential_tags = mysqli_query($mysqli, "SELECT tag_color, tag_icon, credential_tags.tag_id, tag_name FROM credential_tags LEFT JOIN tags ON credential_tags.tag_id = tags.tag_id WHERE credential_id = $credential_id ORDER BY tag_name ASC");
                                     while ($row = mysqli_fetch_assoc($sql_credential_tags)) {
 
                                         $credential_tag_id = intval($row['tag_id']);

agent/assets.php

@@ -124,7 +124,7 @@ $row = mysqli_fetch_assoc(mysqli_query($mysqli, "
         LEFT JOIN tags ON tag_id = asset_tag_tag_id
         WHERE $archive_query
         $tag_query
-        $access_permission_query
+        " . clientScopeSql('asset_client_id') . "
         $client_query
         GROUP BY asset_id
     ) AS filtered_assets;
@@ -150,7 +150,14 @@ $other_count = intval($row['other_count']);
 
 $sql = mysqli_query(
     $mysqli,
-    "SELECT SQL_CALC_FOUND_ROWS * FROM assets
+    "SELECT SQL_CALC_FOUND_ROWS asset_archived_at, asset_contact_id, asset_created_at, asset_description, asset_favorite,
+        asset_id, asset_install_date, asset_location_id, asset_make, asset_model, asset_name,
+        asset_notes, asset_os, asset_photo, asset_physical_location, asset_purchase_date,
+        asset_purchase_reference, asset_serial, asset_status, asset_type, asset_uri, asset_uri_2,
+        asset_uri_client, asset_vendor_id, asset_warranty_expire, client_id, client_name,
+        contact_archived_at, contact_name, interface_ip, interface_ipv6, interface_mac,
+        interface_nat_ip, interface_network_id, location_archived_at, location_name, tag_color,
+        tag_icon, tag_id, tag_name FROM assets
     LEFT JOIN clients ON asset_client_id = client_id
     LEFT JOIN contacts ON asset_contact_id = contact_id
     LEFT JOIN locations ON asset_location_id = location_id
@@ -161,7 +168,7 @@ $sql = mysqli_query(
     $tag_query
     AND (asset_name LIKE '%$q%' OR asset_description LIKE '%$q%' OR asset_type LIKE '%$q%' OR interface_ip LIKE '%$q%' OR interface_ipv6 LIKE '%$q%' OR interface_mac LIKE '%$q%' OR asset_make LIKE '%$q%' OR asset_model LIKE '%$q%' OR asset_serial LIKE '%$q%' OR asset_os LIKE '%$q%' OR contact_name LIKE '%$q%' OR location_name LIKE '%$q%' OR client_name LIKE '%$q%' OR tag_name LIKE '%$q%')
     AND ($type_query)
-    $access_permission_query
+    " . clientScopeSql('asset_client_id') . "
     $location_query
     $expire_query
     $client_query
@@ -288,7 +295,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                                 FROM clients
                                 JOIN assets ON asset_client_id = client_id
                                 WHERE $archive_query
-                                $access_permission_query
+                                " . clientScopeSql('clients.client_id') . "
                                 ORDER BY client_name ASC
                             ");
                             while ($row = mysqli_fetch_assoc($sql_clients_filter)) {
@@ -634,13 +641,13 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                             $location_name_display = $location_name;
                         }
 
-                        $sql_credentials = mysqli_query($mysqli, "SELECT * FROM credentials WHERE credential_asset_id = $asset_id");
+                        $sql_credentials = mysqli_query($mysqli, "SELECT 1 FROM credentials WHERE credential_asset_id = $asset_id");
                         $credential_count = mysqli_num_rows($sql_credentials);
 
                         // Tags
                         $asset_tag_name_display_array = array();
                         $asset_tag_id_array = array();
-                        $sql_asset_tags = mysqli_query($mysqli, "SELECT * FROM asset_tags LEFT JOIN tags ON asset_tag_tag_id = tag_id WHERE asset_tag_asset_id = $asset_id ORDER BY tag_name ASC");
+                        $sql_asset_tags = mysqli_query($mysqli, "SELECT tag_color, tag_icon, tag_id, tag_name FROM asset_tags LEFT JOIN tags ON asset_tag_tag_id = tag_id WHERE asset_tag_asset_id = $asset_id ORDER BY tag_name ASC");
                         while ($row = mysqli_fetch_assoc($sql_asset_tags)) {
 
                             $asset_tag_id = intval($row['tag_id']);

agent/calendar.php

@@ -38,7 +38,7 @@ if (isset($_GET['calendar_id'])) {
             </div>
             <div class="card-body">
                 <?php
-                $sql = mysqli_query($mysqli, "SELECT * FROM calendars");
+                $sql = mysqli_query($mysqli, "SELECT calendar_color, calendar_feed_key, calendar_id, calendar_name FROM calendars");
                 while ($row = mysqli_fetch_assoc($sql)) {
                     $calendar_id = intval($row['calendar_id']);
                     $calendar_name = escapeHtml($row['calendar_name']);
@@ -135,7 +135,8 @@ if (isset($_GET['calendar_id'])) {
 require_once "modals/calendar/calendar_event_add.php";
 
 //loop through IDs and create a modal for each
-$sql = mysqli_query($mysqli, "SELECT * FROM calendar_events LEFT JOIN calendars ON event_calendar_id = calendar_id $client_event_query");
+$sql = mysqli_query($mysqli, "SELECT calendar_color, calendar_id, calendar_name, event_client_id, event_description, event_end,
+    event_id, event_location, event_repeat, event_start, event_title FROM calendar_events LEFT JOIN calendars ON event_calendar_id = calendar_id $client_event_query");
 while ($row = mysqli_fetch_assoc($sql)) {
     $event_id = intval($row['event_id']);
     $event_title = escapeHtml($row['event_title']);
@@ -303,7 +304,8 @@ while ($row = mysqli_fetch_assoc($sql)) {
         },
         events: [
             <?php
-            $sql = mysqli_query($mysqli, "SELECT * FROM calendar_events LEFT JOIN calendars ON event_calendar_id = calendar_id $client_event_query");
+            $sql = mysqli_query($mysqli, "SELECT calendar_color, calendar_id, calendar_name, event_all_day, event_id, event_repeat,
+                event_title FROM calendar_events LEFT JOIN calendars ON event_calendar_id = calendar_id $client_event_query");
 
             // Repeating events are stored as a single row, so the occurrences have to
             // be materialised here - the bundled FullCalendar build has no rrule
@@ -341,7 +343,7 @@ while ($row = mysqli_fetch_assoc($sql)) {
             }
 
             // Invoices Created
-            $sql = mysqli_query($mysqli, "SELECT * FROM clients LEFT JOIN invoices ON client_id = invoice_client_id $client_query $access_permission_query");
+            $sql = mysqli_query($mysqli, "SELECT invoice_date, invoice_id, invoice_number, invoice_prefix, invoice_scope FROM clients LEFT JOIN invoices ON client_id = invoice_client_id $client_query " . clientScopeSql('clients.client_id') . "");
             while ($row = mysqli_fetch_assoc($sql)) {
                 $event_id = intval($row['invoice_id']);
                 $scope = strval($row['invoice_scope']);
@@ -356,7 +358,7 @@ while ($row = mysqli_fetch_assoc($sql)) {
             }
 
             // Quotes Created
-            $sql = mysqli_query($mysqli, "SELECT * FROM clients LEFT JOIN quotes ON client_id = quote_client_id $client_query $access_permission_query");
+            $sql = mysqli_query($mysqli, "SELECT quote_date, quote_id, quote_number, quote_prefix, quote_scope FROM clients LEFT JOIN quotes ON client_id = quote_client_id $client_query " . clientScopeSql('clients.client_id') . "");
             while ($row = mysqli_fetch_assoc($sql)) {
                 $event_id = intval($row['quote_id']);
                 $event_title = json_encode($row['quote_prefix'] . $row['quote_number'] . " " . $row['quote_scope']);
@@ -366,11 +368,12 @@ while ($row = mysqli_fetch_assoc($sql)) {
             }
 
             // Tickets Created
-            $sql = mysqli_query($mysqli, "SELECT * FROM clients
+            $sql = mysqli_query($mysqli, "SELECT ticket_created_at, ticket_id, ticket_number, ticket_prefix, ticket_status,
+                ticket_status_name, ticket_subject, user_name FROM clients
                 LEFT JOIN tickets ON client_id = ticket_client_id
                 LEFT JOIN ticket_statuses ON ticket_status = ticket_status_id
                 LEFT JOIN users ON ticket_assigned_to = user_id
-                $client_query $access_permission_query"
+                $client_query " . clientScopeSql('clients.client_id') . ""
             );
             while ($row = mysqli_fetch_assoc($sql)) {
                 $event_id = intval($row['ticket_id']);
@@ -401,10 +404,11 @@ while ($row = mysqli_fetch_assoc($sql)) {
             }
 
             // Recurring Tickets
-            $sql = mysqli_query($mysqli, "SELECT * FROM clients
+            $sql = mysqli_query($mysqli, "SELECT client_id, recurring_ticket_frequency, recurring_ticket_id, recurring_ticket_next_run,
+                recurring_ticket_subject, user_name FROM clients
                 LEFT JOIN recurring_tickets ON client_id = recurring_ticket_client_id
                 LEFT JOIN users ON recurring_ticket_assigned_to = user_id
-                $client_query $access_permission_query"
+                $client_query " . clientScopeSql('clients.client_id') . ""
             );
             while ($row = mysqli_fetch_assoc($sql)) {
                 $event_id = intval($row['recurring_ticket_id']);
@@ -425,11 +429,12 @@ while ($row = mysqli_fetch_assoc($sql)) {
             }
 
             // Tickets Scheduled
-            $sql = mysqli_query($mysqli, "SELECT * FROM clients
+            $sql = mysqli_query($mysqli, "SELECT ticket_id, ticket_number, ticket_prefix, ticket_schedule, ticket_status_name,
+                ticket_subject, user_name FROM clients
                 LEFT JOIN tickets ON client_id = ticket_client_id
                 LEFT JOIN ticket_statuses ON ticket_status = ticket_status_id
                 LEFT JOIN users ON ticket_assigned_to = user_id
-                $client_query $access_permission_query AND ticket_schedule IS NOT NULL"
+                $client_query " . clientScopeSql('clients.client_id') . " AND ticket_schedule IS NOT NULL"
             );
             while ($row = mysqli_fetch_assoc($sql)) {
                 $event_id = intval($row['ticket_id']);
@@ -460,7 +465,7 @@ while ($row = mysqli_fetch_assoc($sql)) {
             }
 
             // Vendors Added Created
-            $sql = mysqli_query($mysqli, "SELECT * FROM clients LEFT JOIN vendors ON client_id = vendor_client_id $client_query $access_permission_query");
+            $sql = mysqli_query($mysqli, "SELECT client_id, vendor_created_at, vendor_id, vendor_name FROM clients LEFT JOIN vendors ON client_id = vendor_client_id $client_query " . clientScopeSql('clients.client_id') . "");
             while ($row = mysqli_fetch_assoc($sql)) {
                 $event_id = intval($row['vendor_id']);
                 $client_id = intval($row['client_id']);
@@ -472,7 +477,7 @@ while ($row = mysqli_fetch_assoc($sql)) {
 
             if (!isset($_GET['client_id'])) {
                 //Clients Added
-                $sql = mysqli_query($mysqli, "SELECT * FROM clients");
+                $sql = mysqli_query($mysqli, "SELECT client_created_at, client_id, client_name FROM clients");
                 while ($row = mysqli_fetch_assoc($sql)) {
                     $event_id = intval($row['client_id']);
                     $event_title = json_encode("Client: '" . $row['client_name'] . "' created");

agent/certificates.php

@@ -61,11 +61,13 @@ if (!$client_url) {
     }
 }
 
-$sql = mysqli_query($mysqli, "SELECT SQL_CALC_FOUND_ROWS * FROM certificates
+$sql = mysqli_query($mysqli, "SELECT SQL_CALC_FOUND_ROWS certificate_archived_at, certificate_created_at, certificate_description,
+    certificate_domain, certificate_expire, certificate_id, certificate_issued_by,
+    certificate_name, client_id, client_name FROM certificates
     LEFT JOIN clients ON client_id = certificate_client_id
     WHERE $archive_query
     AND (certificate_name LIKE '%$q%' OR certificate_domain LIKE '%$q%' OR certificate_description LIKE '%$q%' OR certificate_issued_by LIKE '%$q%' OR client_name LIKE '%$q%')
-    $access_permission_query
+    " . clientScopeSql('certificate_client_id') . "
     $client_query
     $expire_query
     ORDER BY $sort $order LIMIT $record_from, $record_to"
@@ -122,7 +124,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                                 FROM clients
                                 JOIN certificates ON certificate_client_id = client_id
                                 WHERE $archive_query
-                                $access_permission_query
+                                " . clientScopeSql('clients.client_id') . "
                                 ORDER BY client_name ASC
                             ");
                             while ($row = mysqli_fetch_assoc($sql_clients_filter)) {

agent/client_overview.php

@@ -4,7 +4,7 @@ require_once "includes/inc_all_client.php";
 
 $sql_recent_activities = mysqli_query(
     $mysqli,
-    "SELECT * FROM logs
+    "SELECT log_created_at, log_description FROM logs
     WHERE log_client_id = $client_id
     ORDER BY log_created_at DESC
     LIMIT 5"
@@ -12,7 +12,9 @@ $sql_recent_activities = mysqli_query(
 
 $sql_important_contacts = mysqli_query(
     $mysqli,
-    "SELECT * FROM contacts
+    "SELECT contact_email, contact_extension, contact_id, contact_mobile, contact_mobile_country_code,
+        contact_name, contact_phone, contact_phone_country_code, contact_photo, contact_primary,
+        contact_title FROM contacts
     WHERE contact_client_id = $client_id
         AND (contact_important = 1
             OR contact_billing = 1
@@ -25,7 +27,7 @@ $sql_important_contacts = mysqli_query(
 
 $sql_favorite_assets = mysqli_query(
     $mysqli,
-    "SELECT * FROM assets
+    "SELECT asset_id, asset_make, asset_model, asset_name, asset_type FROM assets
     WHERE asset_client_id = $client_id
         AND asset_favorite = 1
         AND asset_archived_at IS NULL
@@ -34,7 +36,8 @@ $sql_favorite_assets = mysqli_query(
 
 $sql_favorite_credentials = mysqli_query(
     $mysqli,
-    "SELECT * FROM credentials
+    "SELECT credential_description, credential_id, credential_name, credential_otp_secret,
+        credential_uri, credential_uri_2, credential_username FROM credentials
     WHERE credential_client_id = $client_id
         AND credential_favorite = 1
         AND credential_archived_at IS NULL
@@ -60,7 +63,8 @@ $sql_recent_credentials = mysqli_query(
 
 $sql_shared_items = mysqli_query(
     $mysqli,
-    "SELECT * FROM shared_items
+    "SELECT item_active, item_created_at, item_expire_at, item_id, item_key, item_note, item_recipient,
+        item_related_id, item_type, item_view_limit, item_views FROM shared_items
     WHERE item_client_id = $client_id
         AND item_active = 1
     ORDER BY item_created_at ASC
@@ -74,7 +78,7 @@ $sql_shared_items = mysqli_query(
 // Stale Tickets
 $sql_stale_tickets = mysqli_query(
     $mysqli,
-    "SELECT * FROM tickets
+    "SELECT ticket_created_at, ticket_id, ticket_number, ticket_prefix, ticket_subject FROM tickets
     WHERE ticket_client_id = $client_id
         AND ticket_updated_at < CURRENT_DATE - INTERVAL 7 DAY
         AND ticket_resolved_At IS NULL
@@ -87,7 +91,7 @@ $sql_stale_tickets = mysqli_query(
 // Get Domains Expiring
 $sql_domains_expiring = mysqli_query(
     $mysqli,
-    "SELECT * FROM domains
+    "SELECT domain_expire, domain_id, domain_name FROM domains
     WHERE domain_client_id = $client_id
         AND domain_expire IS NOT NULL
         AND domain_archived_at IS NULL
@@ -99,7 +103,7 @@ $sql_domains_expiring = mysqli_query(
 // Get Certificates Expiring
 $sql_certificates_expiring = mysqli_query(
     $mysqli,
-    "SELECT * FROM certificates
+    "SELECT certificate_expire, certificate_id, certificate_name FROM certificates
     WHERE certificate_client_id = $client_id
         AND certificate_expire IS NOT NULL
         AND certificate_archived_at IS NULL
@@ -111,7 +115,7 @@ $sql_certificates_expiring = mysqli_query(
 // Get Licenses Expiring
 $sql_licenses_expiring = mysqli_query(
     $mysqli,
-    "SELECT * FROM software
+    "SELECT software_expire, software_id, software_name FROM software
     WHERE software_client_id = $client_id
         AND software_expire IS NOT NULL
         AND software_archived_at IS NULL
@@ -123,7 +127,7 @@ $sql_licenses_expiring = mysqli_query(
 // Get Asset Warranties Expiring
 $sql_asset_warranties_expiring = mysqli_query(
     $mysqli,
-    "SELECT * FROM assets
+    "SELECT asset_id, asset_name, asset_warranty_expire FROM assets
     WHERE asset_client_id = $client_id
         AND asset_warranty_expire IS NOT NULL
         AND asset_archived_at IS NULL
@@ -135,7 +139,7 @@ $sql_asset_warranties_expiring = mysqli_query(
 // Get Assets Retiring 7 Year
 $sql_asset_retire = mysqli_query(
     $mysqli,
-    "SELECT * FROM assets
+    "SELECT asset_id, asset_install_date, asset_name FROM assets
     WHERE asset_client_id = $client_id
         AND asset_install_date IS NOT NULL
         AND asset_archived_at IS NULL
@@ -151,7 +155,7 @@ $sql_asset_retire = mysqli_query(
 // Get Domains Expired
 $sql_domains_expired = mysqli_query(
     $mysqli,
-    "SELECT * FROM domains
+    "SELECT domain_expire, domain_id, domain_name FROM domains
     WHERE domain_client_id = $client_id
         AND domain_expire IS NOT NULL
         AND domain_archived_at IS NULL
@@ -162,7 +166,7 @@ $sql_domains_expired = mysqli_query(
 // Get Certificates Expired
 $sql_certificates_expired = mysqli_query(
     $mysqli,
-    "SELECT * FROM certificates
+    "SELECT certificate_expire, certificate_id, certificate_name FROM certificates
     WHERE certificate_client_id = $client_id
         AND certificate_expire IS NOT NULL
         AND certificate_archived_at IS NULL
@@ -173,7 +177,7 @@ $sql_certificates_expired = mysqli_query(
 // Get Licenses Expired
 $sql_licenses_expired = mysqli_query(
     $mysqli,
-    "SELECT * FROM software
+    "SELECT software_expire, software_id, software_name FROM software
     WHERE software_client_id = $client_id
         AND software_expire IS NOT NULL
         AND software_archived_at IS NULL
@@ -184,7 +188,7 @@ $sql_licenses_expired = mysqli_query(
 // Get Asset Warranties Expired
 $sql_asset_warranties_expired = mysqli_query(
     $mysqli,
-    "SELECT * FROM assets
+    "SELECT asset_id, asset_name, asset_warranty_expire FROM assets
     WHERE asset_client_id = $client_id
         AND asset_warranty_expire IS NOT NULL
         AND asset_archived_at IS NULL
@@ -195,7 +199,7 @@ $sql_asset_warranties_expired = mysqli_query(
 // Get Retired Assets
 $sql_asset_retired = mysqli_query(
     $mysqli,
-    "SELECT * FROM assets
+    "SELECT asset_id, asset_install_date, asset_name FROM assets
     WHERE asset_client_id = $client_id
         AND asset_install_date IS NOT NULL
         AND asset_archived_at IS NULL

agent/clients.php

@@ -67,7 +67,7 @@ $sql = mysqli_query(
       AND client_$archive_query
       AND DATE(client_created_at) BETWEEN '$dtf' AND '$dtt'
       $leads_query
-      $access_permission_query
+      " . clientScopeSql('clients.client_id') . "
       $tag_query
       $industry_query
       $referral_query
@@ -369,7 +369,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                     // Client Tags
                     $client_tag_name_display_array = array();
                     $client_tag_id_array = array();
-                    $sql_client_tags = mysqli_query($mysqli, "SELECT * FROM client_tags LEFT JOIN tags ON client_tags.tag_id = tags.tag_id WHERE client_id = $client_id ORDER BY tag_name ASC");
+                    $sql_client_tags = mysqli_query($mysqli, "SELECT tag_color, tag_icon, client_tags.tag_id, tag_name FROM client_tags LEFT JOIN tags ON client_tags.tag_id = tags.tag_id WHERE client_id = $client_id ORDER BY tag_name ASC");
                     while ($row = mysqli_fetch_assoc($sql_client_tags)) {
                         $client_tag_id = intval($row['tag_id']);
                         $client_tag_name = escapeHtml($row['tag_name']);

agent/contact.php

@@ -14,7 +14,11 @@ if (isset($_GET['client_id'])) {
 if (isset($_GET['contact_id'])) {
     $contact_id = intval($_GET['contact_id']);
 
-    $sql = mysqli_query($mysqli, "SELECT * FROM contacts
+    $sql = mysqli_query($mysqli, "SELECT client_id, client_name, contact_billing, contact_client_id, contact_created_at,
+        contact_department, contact_email, contact_extension, contact_important,
+        contact_location_id, contact_mobile, contact_mobile_country_code, contact_name,
+        contact_notes, contact_phone, contact_phone_country_code, contact_photo, contact_pin,
+        contact_primary, contact_technical, contact_title, location_name, user_auth_method FROM contacts
         LEFT JOIN clients ON client_id = contact_client_id
         LEFT JOIN locations ON location_id = contact_location_id
         LEFT JOIN users ON user_id = contact_user_id
@@ -64,7 +68,11 @@ if (isset($_GET['contact_id'])) {
     }
 
     // Related Assets Query - 1 to 1 relationship
-    $sql_related_assets = mysqli_query($mysqli, "SELECT * FROM assets
+    $sql_related_assets = mysqli_query($mysqli, "SELECT asset_created_at, asset_description, asset_favorite, asset_id, asset_install_date,
+        asset_make, asset_model, asset_name, asset_notes, asset_os, asset_photo,
+        asset_physical_location, asset_purchase_date, asset_serial, asset_status, asset_type,
+        asset_uri, asset_uri_2, asset_warranty_expire, interface_ip, interface_ipv6, interface_mac,
+        interface_nat_ip, tag_color, tag_icon, tag_id, tag_name FROM assets
         LEFT JOIN asset_interfaces ON interface_asset_id = asset_id AND interface_primary = 1
         LEFT JOIN asset_tags ON asset_tag_asset_id = asset_id
         LEFT JOIN tags ON tag_id = asset_tag_tag_id
@@ -75,7 +83,9 @@ if (isset($_GET['contact_id'])) {
     $asset_count = mysqli_num_rows($sql_related_assets);
 
     // Linked Software Licenses
-    $sql_linked_software = mysqli_query($mysqli, "SELECT * FROM software_contacts, software
+    $sql_linked_software = mysqli_query($mysqli, "SELECT software_expire, software_contacts.software_id, software_key, software_license_type,
+        software_name, software_notes, software_purchase, software_seats, software_type,
+        software_version FROM software_contacts, software
         WHERE software_contacts.contact_id = $contact_id
         AND software_contacts.software_id = software.software_id
         AND software_archived_at IS NULL
@@ -102,14 +112,17 @@ if (isset($_GET['contact_id'])) {
     $credential_count = mysqli_num_rows($sql_related_credentials);
 
     // Related Tickets Query - 1 to 1 relationship
-    $sql_related_tickets = mysqli_query($mysqli, "SELECT * FROM tickets
+    $sql_related_tickets = mysqli_query($mysqli, "SELECT ticket_assigned_to, ticket_closed_at, ticket_created_at, ticket_id, ticket_number,
+        ticket_prefix, ticket_priority, ticket_status, ticket_status_color, ticket_status_name,
+        ticket_subject, ticket_updated_at, user_name FROM tickets
         LEFT JOIN users ON ticket_assigned_to = user_id
         LEFT JOIN ticket_statuses ON ticket_status = ticket_status_id
         WHERE ticket_contact_id = $contact_id ORDER BY ticket_id DESC");
     $ticket_count = mysqli_num_rows($sql_related_tickets);
 
     // Related Recurring Tickets Query
-    $sql_related_recurring_tickets = mysqli_query($mysqli, "SELECT * FROM recurring_tickets
+    $sql_related_recurring_tickets = mysqli_query($mysqli, "SELECT recurring_ticket_frequency, recurring_ticket_id, recurring_ticket_next_run,
+        recurring_ticket_priority, recurring_ticket_subject FROM recurring_tickets
         WHERE recurring_ticket_contact_id = $contact_id
         ORDER BY recurring_ticket_next_run DESC"
     );
@@ -119,7 +132,7 @@ if (isset($_GET['contact_id'])) {
     // Tags - many to many relationship
     $contact_tag_name_display_array = array();
     $contact_tag_id_array = array();
-    $sql_contact_tags = mysqli_query($mysqli, "SELECT * FROM contact_tags LEFT JOIN tags ON contact_tags.tag_id = tags.tag_id WHERE contact_id = $contact_id ORDER BY tag_name ASC");
+    $sql_contact_tags = mysqli_query($mysqli, "SELECT tag_color, tag_icon, contact_tags.tag_id, tag_name FROM contact_tags LEFT JOIN tags ON contact_tags.tag_id = tags.tag_id WHERE contact_id = $contact_id ORDER BY tag_name ASC");
     while ($row = mysqli_fetch_assoc($sql_contact_tags)) {
 
         $contact_tag_id = intval($row['tag_id']);
@@ -139,7 +152,7 @@ if (isset($_GET['contact_id'])) {
     $contact_tags_display = implode('', $contact_tag_name_display_array);
 
     // Notes - 1 to 1 relationship
-    $sql_related_notes = mysqli_query($mysqli, "SELECT * FROM contact_notes LEFT JOIN users ON contact_note_created_by = user_id WHERE contact_note_contact_id = $contact_id AND contact_note_archived_at IS NULL ORDER BY contact_note_created_at DESC");
+    $sql_related_notes = mysqli_query($mysqli, "SELECT contact_note, contact_note_created_at, contact_note_id, contact_note_type, user_name FROM contact_notes LEFT JOIN users ON contact_note_created_by = user_id WHERE contact_note_contact_id = $contact_id AND contact_note_archived_at IS NULL ORDER BY contact_note_created_at DESC");
     $note_count = mysqli_num_rows($sql_related_notes);
 
     // Note type icons, read from the categories list so the seeded icons
@@ -151,7 +164,8 @@ if (isset($_GET['contact_id'])) {
     }
 
      // Linked Services
-    $sql_linked_services = mysqli_query($mysqli, "SELECT * FROM service_contacts, services
+    $sql_linked_services = mysqli_query($mysqli, "SELECT service_category, service_description, service_contacts.service_id, service_importance,
+        service_name FROM service_contacts, services
         WHERE service_contacts.contact_id = $contact_id
         AND service_contacts.service_id = services.service_id
         ORDER BY service_name ASC"
@@ -161,7 +175,8 @@ if (isset($_GET['contact_id'])) {
     $linked_services = array();
 
     // Linked Documents
-    $sql_linked_documents = mysqli_query($mysqli, "SELECT * FROM contact_documents, documents
+    $sql_linked_documents = mysqli_query($mysqli, "SELECT document_created_at, document_description, documents.document_id, document_name,
+        document_updated_at, user_name FROM contact_documents, documents
         LEFT JOIN users ON document_created_by = user_id
         WHERE contact_documents.contact_id = $contact_id
         AND contact_documents.document_id = documents.document_id
@@ -173,7 +188,7 @@ if (isset($_GET['contact_id'])) {
     $linked_documents = array();
 
     // Linked Files
-    $sql_linked_files = mysqli_query($mysqli, "SELECT * FROM contact_files, files
+    $sql_linked_files = mysqli_query($mysqli, "SELECT file_created_at, file_description, files.file_id, file_mime_type, file_name, file_size FROM contact_files, files
         WHERE contact_files.contact_id = $contact_id
         AND contact_files.file_id = files.file_id
         AND file_archived_at IS NULL
@@ -420,7 +435,7 @@ if (isset($_GET['contact_id'])) {
                                 // Tags
                                 $asset_tag_name_display_array = array();
                                 $asset_tag_id_array = array();
-                                $sql_asset_tags = mysqli_query($mysqli, "SELECT * FROM asset_tags LEFT JOIN tags ON asset_tag_tag_id = tag_id WHERE asset_tag_asset_id = $asset_id ORDER BY tag_name ASC");
+                                $sql_asset_tags = mysqli_query($mysqli, "SELECT tag_color, tag_icon, tag_id, tag_name FROM asset_tags LEFT JOIN tags ON asset_tag_tag_id = tag_id WHERE asset_tag_asset_id = $asset_id ORDER BY tag_name ASC");
                                 while ($row = mysqli_fetch_assoc($sql_asset_tags)) {
 
                                     $asset_tag_id = intval($row['tag_id']);
@@ -574,7 +589,7 @@ if (isset($_GET['contact_id'])) {
                                 // Tags
                                 $credential_tag_name_display_array = array();
                                 $credential_tag_id_array = array();
-                                $sql_credential_tags = mysqli_query($mysqli, "SELECT * FROM credential_tags LEFT JOIN tags ON credential_tags.tag_id = tags.tag_id WHERE credential_id = $credential_id ORDER BY tag_name ASC");
+                                $sql_credential_tags = mysqli_query($mysqli, "SELECT tag_color, tag_icon, credential_tags.tag_id, tag_name FROM credential_tags LEFT JOIN tags ON credential_tags.tag_id = tags.tag_id WHERE credential_id = $credential_id ORDER BY tag_name ASC");
                                 while ($row = mysqli_fetch_assoc($sql_credential_tags)) {
 
                                     $credential_tag_id = intval($row['tag_id']);

agent/contacts.php

@@ -74,7 +74,7 @@ $sql = mysqli_query($mysqli, "SELECT SQL_CALC_FOUND_ROWS contacts.*, clients.*,
     WHERE $archive_query
     $tag_query
     AND (contact_name LIKE '%$q%' OR contact_title LIKE '%$q%' OR location_name LIKE '%$q%'  OR contact_email LIKE '%$q%' OR contact_department LIKE '%$q%' OR contact_phone LIKE '%$phone_query%' OR contact_extension LIKE '%$q%' OR contact_mobile LIKE '%$phone_query%' OR tag_name LIKE '%$q%' OR client_name LIKE '%$q%')
-    $access_permission_query
+    " . clientScopeSql('contact_client_id') . "
     $client_query
     $location_query
     GROUP BY contact_id
@@ -193,7 +193,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                                 FROM clients
                                 JOIN contacts ON contact_client_id = client_id
                                 WHERE $archive_query
-                                $access_permission_query
+                                " . clientScopeSql('clients.client_id') . "
                                 ORDER BY client_name ASC
                             ");
                             while ($row = mysqli_fetch_assoc($sql_clients_filter)) {
@@ -444,7 +444,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                         // Tags
                         $contact_tag_name_display_array = array();
                         $contact_tag_id_array = array();
-                        $sql_contact_tags = mysqli_query($mysqli, "SELECT * FROM contact_tags LEFT JOIN tags ON contact_tags.tag_id = tags.tag_id WHERE contact_id = $contact_id ORDER BY tag_name ASC");
+                        $sql_contact_tags = mysqli_query($mysqli, "SELECT tag_color, tag_icon, contact_tags.tag_id, tag_name FROM contact_tags LEFT JOIN tags ON contact_tags.tag_id = tags.tag_id WHERE contact_id = $contact_id ORDER BY tag_name ASC");
                         while ($row = mysqli_fetch_assoc($sql_contact_tags)) {
 
                             $contact_tag_id = intval($row['tag_id']);

agent/credentials.php

@@ -90,7 +90,7 @@ $sql = mysqli_query(
     $tag_query
     AND (c.credential_name LIKE '%$q%' OR c.credential_description LIKE '%$q%' OR c.credential_uri LIKE '%$q%' OR tag_name LIKE '%$q%' OR client_name LIKE '%$q%')
     $location_query
-    $access_permission_query
+    " . clientScopeSql('credential_client_id') . "
     $client_query
     GROUP BY c.credential_id
     ORDER BY c.credential_favorite DESC, $sort $order LIMIT $record_from, $record_to"
@@ -179,7 +179,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                             <option value="">- All Asset Locations -</option>
 
                             <?php
-                            $sql_locations_filter = mysqli_query($mysqli, "SELECT * FROM locations WHERE location_client_id = $client_id AND location_archived_at IS NULL ORDER BY location_name ASC");
+                            $sql_locations_filter = mysqli_query($mysqli, "SELECT location_id, location_name FROM locations WHERE location_client_id = $client_id AND location_archived_at IS NULL ORDER BY location_name ASC");
                             while ($row = mysqli_fetch_assoc($sql_locations_filter)) {
                                 $location_id = intval($row['location_id']);
                                 $location_name = escapeHtml($row['location_name']);
@@ -204,7 +204,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                                 FROM clients
                                 JOIN credentials ON credential_client_id = client_id
                                 WHERE $archive_query
-                                $access_permission_query
+                                " . clientScopeSql('clients.client_id') . "
                                 ORDER BY client_name ASC
                             ");
                             while ($row = mysqli_fetch_assoc($sql_clients_filter)) {
@@ -349,7 +349,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                             // Tags
                             $credential_tag_name_display_array = array();
                             $credential_tag_id_array = array();
-                            $sql_credential_tags = mysqli_query($mysqli, "SELECT * FROM credential_tags LEFT JOIN tags ON credential_tags.tag_id = tags.tag_id WHERE credential_id = $credential_id ORDER BY tag_name ASC");
+                            $sql_credential_tags = mysqli_query($mysqli, "SELECT tag_color, tag_icon, credential_tags.tag_id, tag_name FROM credential_tags LEFT JOIN tags ON credential_tags.tag_id = tags.tag_id WHERE credential_id = $credential_id ORDER BY tag_name ASC");
                             while ($row = mysqli_fetch_assoc($sql_credential_tags)) {
 
                                 $credential_tag_id = intval($row['tag_id']);
@@ -389,7 +389,8 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                             // Check if shared
                             $sql_shared = mysqli_query(
                                 $mysqli,
-                                "SELECT * FROM shared_items
+                                "SELECT item_active, item_created_at, item_expire_at, item_id, item_key, item_note, item_recipient,
+                                    item_related_id, item_type, item_view_limit, item_views FROM shared_items
                                 WHERE item_client_id = $client_id
                                 AND item_active = 1
                                 AND (COALESCE(item_view_limit, 0) = 0 OR item_views < item_view_limit)

agent/dashboard.php

@@ -16,7 +16,7 @@ if (isset($_GET['enable_technical'])) {
 }
 
 // Fetch User Dashboard Settings
-$sql_user_dashboard_settings = mysqli_query($mysqli, "SELECT * FROM user_settings WHERE user_id = $session_user_id");
+$sql_user_dashboard_settings = mysqli_query($mysqli, "SELECT user_config_dashboard_financial_enable, user_config_dashboard_technical_enable FROM user_settings WHERE user_id = $session_user_id");
 $row = mysqli_fetch_assoc($sql_user_dashboard_settings);
 $user_config_dashboard_financial_enable = intval($row['user_config_dashboard_financial_enable']);
 $user_config_dashboard_technical_enable = intval($row['user_config_dashboard_technical_enable']);
@@ -117,17 +117,17 @@ if ($user_config_dashboard_financial_enable == 1) {
 
     $profit = $total_income - $total_expenses;
 
-    $sql_accounts = mysqli_query($mysqli, "SELECT * FROM accounts WHERE account_archived_at IS NULL ORDER BY account_name ASC");
+    $sql_accounts = mysqli_query($mysqli, "SELECT account_id, account_name, opening_balance FROM accounts WHERE account_archived_at IS NULL ORDER BY account_name ASC");
 
     $sql_latest_invoice_payments = mysqli_query($mysqli, "
-        SELECT * FROM payments
+        SELECT client_name, invoice_number, invoice_prefix, payment_amount, payment_date FROM payments
         JOIN invoices ON payment_invoice_id = invoice_id
         JOIN clients ON invoice_client_id = client_id
         ORDER BY payment_id DESC LIMIT 5
     ");
 
     $sql_latest_expenses = mysqli_query($mysqli, "
-        SELECT * FROM expenses
+        SELECT category_name, expense_amount, expense_date, vendor_name FROM expenses
         JOIN vendors ON expense_vendor_id = vendor_id
         JOIN categories ON expense_category_id = category_id
         ORDER BY expense_id DESC LIMIT 5
@@ -599,7 +599,9 @@ if ($user_config_dashboard_technical_enable == 1) {
     $expiring_asset_warranties = $sql_asset_warranty_expiring['expiring_asset_warranties'];
 
     $sql_your_tickets = mysqli_query($mysqli, "
-        SELECT * FROM tickets
+        SELECT client_name, contact_name, ticket_client_id, ticket_contact_id, ticket_created_at,
+            ticket_id, ticket_number, ticket_prefix, ticket_priority, ticket_status,
+            ticket_status_color, ticket_status_name, ticket_subject, ticket_updated_at FROM tickets
         LEFT JOIN ticket_statuses ON ticket_status = ticket_status_id
         LEFT JOIN clients ON ticket_client_id = client_id
         LEFT JOIN contacts ON ticket_contact_id = contact_id

agent/document.php

@@ -17,7 +17,9 @@ if (isset($_GET['document_id'])) {
 
 $folder_location = 0;
 
-$sql_document = mysqli_query($mysqli, "SELECT * FROM documents
+$sql_document = mysqli_query($mysqli, "SELECT document_archived_at, document_client_visible, document_content, document_created_at,
+    document_created_by, document_description, document_folder_id, document_name,
+    document_updated_at, folder_name, user_name FROM documents
     LEFT JOIN folders ON document_folder_id = folder_id
     LEFT JOIN users ON document_created_by = user_id
     WHERE document_client_id = $client_id AND document_id = $document_id
@@ -142,7 +144,8 @@ $page_title = $row['document_name'];
                     </thead>
                     <tbody>
                         <?php
-                        $sql_document_versions = mysqli_query($mysqli, "SELECT * FROM document_versions
+                        $sql_document_versions = mysqli_query($mysqli, "SELECT document_version_created_at, document_version_description, document_version_id,
+                            document_version_name, user_name FROM document_versions
                             LEFT JOIN users ON document_version_created_by = user_id
                             WHERE document_version_document_id = $document_id
                             ORDER BY document_version_created_at ASC"
@@ -208,7 +211,7 @@ $page_title = $row['document_name'];
                 </button>
             </h6>
             <?php
-            $sql_files = mysqli_query($mysqli, "SELECT * FROM files, document_files
+            $sql_files = mysqli_query($mysqli, "SELECT file_folder_id, files.file_id, file_name FROM files, document_files
                 WHERE document_files.file_id = files.file_id
                 AND document_files.document_id = $document_id
                 ORDER BY file_name ASC"
@@ -394,7 +397,8 @@ $page_title = $row['document_name'];
             <h6><i class="fas fa-history mr-2"></i>Revisions</h6>
             <?php
 
-            $sql_document_versions = mysqli_query($mysqli, "SELECT * FROM document_versions
+            $sql_document_versions = mysqli_query($mysqli, "SELECT document_version_created_at, document_version_description, document_version_id,
+                document_version_name, user_name FROM document_versions
                 LEFT JOIN users ON document_version_created_by = user_id
                 WHERE document_version_document_id = $document_id
                 ORDER BY document_version_created_at DESC"

agent/domains.php

@@ -78,7 +78,7 @@ $sql = mysqli_query($mysqli, "SELECT SQL_CALC_FOUND_ROWS domains.*, clients.*,
     LEFT JOIN vendors AS webhost ON domains.domain_webhost = webhost.vendor_id
     WHERE (domains.domain_name LIKE '%$q%' OR domains.domain_description LIKE '%$q%' OR registrar.vendor_name LIKE '%$q%' OR dnshost.vendor_name LIKE '%$q%' OR mailhost.vendor_name LIKE '%$q%' OR webhost.vendor_name LIKE '%$q%' OR client_name LIKE '%$q%')
     AND $archive_query
-    $access_permission_query
+    " . clientScopeSql('domain_client_id') . "
     $client_query
     $expire_query
     ORDER BY $sort $order LIMIT $record_from, $record_to");
@@ -134,7 +134,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                                 FROM clients
                                 JOIN domains ON domain_client_id = client_id
                                 WHERE $archive_query
-                                $access_permission_query
+                                " . clientScopeSql('clients.client_id') . "
                                 ORDER BY client_name ASC
                             ");
                             while ($row = mysqli_fetch_assoc($sql_clients_filter)) {

agent/expenses.php

@@ -41,7 +41,10 @@ if (isset($_GET['category']) & !empty($_GET['category'])) {
 
 $sql = mysqli_query(
     $mysqli,
-    "SELECT SQL_CALC_FOUND_ROWS * FROM expenses
+    "SELECT SQL_CALC_FOUND_ROWS account_name, category_name, client_name, expense_account_id, expense_amount,
+        expense_category_id, expense_client_id, expense_created_at, expense_currency_code,
+        expense_date, expense_description, expense_id, expense_receipt, expense_reference,
+        expense_vendor_id, vendor_name FROM expenses
     LEFT JOIN categories ON expense_category_id = category_id
     LEFT JOIN vendors ON expense_vendor_id = vendor_id
     LEFT JOIN accounts ON expense_account_id = account_id
@@ -52,7 +55,7 @@ $sql = mysqli_query(
     $category_query
     AND (vendor_name LIKE '%$q%' OR client_name LIKE '%$q%' OR category_name LIKE '%$q%' OR account_name LIKE '%$q%' OR expense_description LIKE '%$q%' OR expense_amount LIKE '%$q%')
     $account_query
-    $access_permission_query
+    " . clientScopeSql('expense_client_id') . "
     ORDER BY $sort $order LIMIT $record_from, $record_to"
 );
 

agent/files.php

@@ -99,7 +99,7 @@ function displayFolders($parent_folder_id, $client_id, $indent = 0, $render_root
 
     $sql_folders = mysqli_query(
         $mysqli,
-        "SELECT * FROM folders
+        "SELECT folder_id, folder_name FROM folders
          WHERE parent_folder = $parent_folder_id
          AND folder_client_id = $client_id
          ORDER BY folder_name ASC"
@@ -731,7 +731,7 @@ $num_root_items = intval($row_root_files['num']) + intval($row_root_docs['num'])
                                         // Shared?
                                         $sql_shared = mysqli_query(
                                             $mysqli,
-                                            "SELECT * FROM shared_items
+                                            "SELECT item_expire_at, item_recipient FROM shared_items
                                              WHERE item_client_id = $client_id
                                              AND item_active = 1
                                              AND (COALESCE(item_view_limit, 0) = 0 OR item_views < item_view_limit)
@@ -843,7 +843,7 @@ $num_root_items = intval($row_root_files['num']) + intval($row_root_docs['num'])
 
                                         $sql_shared = mysqli_query(
                                             $mysqli,
-                                            "SELECT * FROM shared_items
+                                            "SELECT item_expire_at, item_recipient FROM shared_items
                                              WHERE item_client_id = $client_id
                                              AND item_active = 1
                                              AND (COALESCE(item_view_limit, 0) = 0 OR item_views < item_view_limit)

agent/global_search.php

@@ -28,15 +28,19 @@ if (isset($_GET['query'])) {
     $can_sales      = lookupUserPermission('module_sales')      >= 1;
     $can_credential = lookupUserPermission('module_credential') >= 1;
 
-    $sql_clients = !$can_client ? false : mysqli_query($mysqli, "SELECT * FROM clients
+    $sql_clients = !$can_client ? false : mysqli_query($mysqli, "SELECT client_id, client_name, client_website, location_phone, location_phone_country_code
+        FROM clients
         LEFT JOIN locations ON clients.client_id = locations.location_client_id AND location_primary = 1
         WHERE client_archived_at IS NULL
             AND (client_name LIKE '%$query%' OR client_abbreviation LIKE '%$query%')
-            $access_permission_query
+            " . clientScopeSql('clients.client_id') . "
         ORDER BY client_id DESC LIMIT 5"
     );
 
-    $sql_contacts = !$can_client ? false : mysqli_query($mysqli, "SELECT * FROM contacts
+    $sql_contacts = !$can_client ? false : mysqli_query($mysqli, "SELECT client_id, client_name, contact_department, contact_email, contact_extension, contact_id,
+        contact_mobile, contact_mobile_country_code, contact_name, contact_phone,
+        contact_phone_country_code, contact_title
+        FROM contacts
         LEFT JOIN clients ON client_id = contact_client_id
         WHERE contact_archived_at IS NULL
             AND (contact_name LIKE '%$query%'
@@ -44,51 +48,59 @@ if (isset($_GET['query'])) {
             OR contact_email LIKE '%$query%'
             OR contact_phone LIKE '%$phone_query%'
             OR contact_mobile LIKE '%$phone_query%')
-            $access_permission_query
+            " . clientScopeSql('contact_client_id') . "
         ORDER BY contact_id DESC LIMIT 5"
     );
 
-    $sql_vendors = !$can_client ? false : mysqli_query($mysqli, "SELECT * FROM vendors
+    $sql_vendors = !$can_client ? false : mysqli_query($mysqli, "SELECT client_id, client_name, vendor_description, vendor_name, vendor_phone,
+        vendor_phone_country_code
+        FROM vendors
         LEFT JOIN clients ON vendor_client_id = client_id
         WHERE vendor_archived_at IS NULL
             AND (vendor_name LIKE '%$query%' OR vendor_phone LIKE '%$phone_query%')
-            $access_permission_query
+            " . clientScopeSql('vendor_client_id') . "
         ORDER BY vendor_id DESC LIMIT 5"
     );
 
-    $sql_domains = !$can_support ? false : mysqli_query($mysqli, "SELECT * FROM domains
+    $sql_domains = !$can_support ? false : mysqli_query($mysqli, "SELECT client_id, client_name, domain_expire, domain_id, domain_name
+        FROM domains
         LEFT JOIN clients ON domain_client_id = client_id
         WHERE domain_archived_at IS NULL
             AND domain_name LIKE '%$query%'
-            $access_permission_query
+            " . clientScopeSql('domain_client_id') . "
         ORDER BY domain_id DESC LIMIT 5"
     );
 
-    $sql_products = !$can_sales ? false : mysqli_query($mysqli, "SELECT * FROM products
+    $sql_products = !$can_sales ? false : mysqli_query($mysqli, "SELECT product_description, product_name
+        FROM products
         WHERE product_archived_at IS NULL
             AND product_name LIKE '%$query%'
         ORDER BY product_id DESC LIMIT 5"
     );
 
-    $sql_documents = !$can_support ? false : mysqli_query($mysqli, "SELECT * FROM documents
+    $sql_documents = !$can_support ? false : mysqli_query($mysqli, "SELECT client_name, document_client_id, document_id, document_name
+        FROM documents
         LEFT JOIN clients on document_client_id = clients.client_id
         WHERE document_archived_at IS NULL
             AND MATCH(document_content_raw) AGAINST ('$query')
-            $access_permission_query
+            " . clientScopeSql('document_client_id') . "
         ORDER BY document_id DESC LIMIT 5"
     );
 
-    $sql_files = !$can_support ? false : mysqli_query($mysqli, "SELECT * FROM files
+    $sql_files = !$can_support ? false : mysqli_query($mysqli, "SELECT client_name, file_client_id, file_description, file_id, file_name, folder_id, folder_name
+        FROM files
         LEFT JOIN clients ON file_client_id = client_id
         LEFT JOIN folders ON folder_id = file_folder_id
         WHERE file_archived_at IS NULL
             AND (file_name LIKE '%$query%'
             OR file_description LIKE '%$query%')
-            $access_permission_query
+            " . clientScopeSql('file_client_id') . "
         ORDER BY file_id DESC LIMIT 5"
     );
 
-    $sql_tickets = !$can_support ? false : mysqli_query($mysqli, "SELECT * FROM tickets
+    $sql_tickets = !$can_support ? false : mysqli_query($mysqli, "SELECT client_name, ticket_client_id, ticket_id, ticket_number, ticket_prefix, ticket_status_name,
+        ticket_subject
+        FROM tickets
         LEFT JOIN clients on tickets.ticket_client_id = clients.client_id
         LEFT JOIN ticket_statuses ON ticket_status = ticket_status_id
         WHERE ticket_archived_at IS NULL
@@ -96,62 +108,75 @@ if (isset($_GET['query'])) {
             OR ticket_details LIKE '%$query%'
             OR CONCAT(ticket_prefix,ticket_number) LIKE '%$query%'
             OR ticket_number = '$ticket_num_query')
-            $access_permission_query
+            " . clientScopeSql('tickets.ticket_client_id') . "
         ORDER BY ticket_id DESC LIMIT 5"
     );
 
-    $sql_recurring_tickets = !$can_support ? false : mysqli_query($mysqli, "SELECT * FROM recurring_tickets
+    $sql_recurring_tickets = !$can_support ? false : mysqli_query($mysqli, "SELECT client_id, client_name, recurring_ticket_frequency, recurring_ticket_id,
+        recurring_ticket_next_run, recurring_ticket_subject
+        FROM recurring_tickets
         LEFT JOIN clients ON recurring_ticket_client_id = client_id
         WHERE (recurring_ticket_subject LIKE '%$query%'
             OR recurring_ticket_details LIKE '%$query%')
-            $access_permission_query
+            " . clientScopeSql('recurring_ticket_client_id') . "
         ORDER BY recurring_ticket_id DESC LIMIT 5"
     );
 
-    $sql_credentials = !$can_credential ? false : mysqli_query($mysqli, "SELECT * FROM credentials
+    $sql_credentials = !$can_credential ? false : mysqli_query($mysqli, "SELECT client_id, client_name, credential_client_id, credential_description, credential_name,
+        credential_password, credential_username
+        FROM credentials
         LEFT JOIN contacts ON credential_contact_id = contact_id
         LEFT JOIN clients ON credential_client_id = client_id
         WHERE credential_archived_at IS NULL
             AND (credential_name LIKE '%$query%' OR credential_description LIKE '%$query%')
-            $access_permission_query
+            " . clientScopeSql('credential_client_id') . "
         ORDER BY credential_id DESC LIMIT 5"
     );
 
-    $sql_quotes = !$can_sales ? false : mysqli_query($mysqli, "SELECT * FROM quotes
+    $sql_quotes = !$can_sales ? false : mysqli_query($mysqli, "SELECT client_id, client_name, quote_amount, quote_currency_code, quote_id, quote_number,
+        quote_prefix, quote_status
+        FROM quotes
         LEFT JOIN clients ON quote_client_id = client_id
         LEFT JOIN categories ON quote_category_id = category_id
         WHERE quote_archived_at IS NULL
             AND (CONCAT(quote_prefix,quote_number) LIKE '%$query%' OR quote_number LIKE '%$query%' OR quote_scope LIKE '%$query%')
-            $access_permission_query
+            " . clientScopeSql('quote_client_id') . "
         ORDER BY quote_number DESC LIMIT 5"
     );
 
-    $sql_invoices = !$can_sales ? false : mysqli_query($mysqli, "SELECT * FROM invoices
+    $sql_invoices = !$can_sales ? false : mysqli_query($mysqli, "SELECT client_id, client_name, invoice_amount, invoice_currency_code, invoice_id, invoice_number,
+        invoice_prefix, invoice_status
+        FROM invoices
         LEFT JOIN clients ON invoice_client_id = client_id
         LEFT JOIN categories ON invoice_category_id = category_id
         WHERE invoice_archived_at IS NULL
             AND (CONCAT(invoice_prefix,invoice_number) LIKE '%$query%' OR invoice_number LIKE '%$query%' OR invoice_scope LIKE '%$query%')
-            $access_permission_query
+            " . clientScopeSql('invoice_client_id') . "
         ORDER BY invoice_number DESC LIMIT 5"
     );
 
-    $sql_assets = !$can_support ? false : mysqli_query($mysqli,"SELECT * FROM assets
+    $sql_assets = !$can_support ? false : mysqli_query($mysqli,"SELECT asset_client_id, asset_contact_id, asset_created_at, asset_description, asset_id,
+        asset_location_id, asset_make, asset_model, asset_name, asset_serial, asset_status, asset_type,
+        asset_uri, client_name, contact_archived_at, contact_id, contact_name
+        FROM assets
         LEFT JOIN contacts ON asset_contact_id = contact_id
         LEFT JOIN locations ON asset_location_id = location_id
         LEFT JOIN clients ON asset_client_id = client_id
         LEFT JOIN asset_interfaces ON interface_asset_id = asset_id AND interface_primary = 1
         WHERE asset_archived_at IS NULL
             AND (asset_name LIKE '%$query%' OR asset_description LIKE '%$query%' OR asset_type LIKE '%$query%' OR asset_make LIKE '%$query%' OR asset_model LIKE '%$query%' OR asset_serial LIKE '%$query%' OR asset_os LIKE '%$query%' OR interface_ip LIKE '%$query%' OR interface_nat_ip LIKE '%$query%' OR interface_mac LIKE '%$query%' OR asset_status LIKE '%$query%')
-            $access_permission_query
+            " . clientScopeSql('asset_client_id') . "
         ORDER BY asset_name DESC LIMIT 5"
     );
 
-    $sql_ticket_replies = !$can_support ? false : mysqli_query($mysqli,"SELECT * FROM ticket_replies
+    $sql_ticket_replies = !$can_support ? false : mysqli_query($mysqli,"SELECT client_name, ticket_client_id, ticket_id, ticket_number, ticket_prefix, ticket_reply,
+        ticket_subject
+        FROM ticket_replies
         LEFT JOIN tickets ON ticket_reply_ticket_id = ticket_id
         LEFT JOIN clients ON ticket_client_id = client_id
         WHERE ticket_reply_archived_at IS NULL
             AND (ticket_reply LIKE '%$query%')
-            $access_permission_query
+            " . clientScopeSql('ticket_client_id') . "
         ORDER BY ticket_id DESC, ticket_reply_id ASC LIMIT 20"
     );
 

agent/includes/client_overview_side_nav.php

@@ -1,31 +1,31 @@
 <?php
 // Badge Counts
 
-$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('contact_id') AS num FROM contacts LEFT JOIN clients ON contact_client_id = client_id WHERE contact_archived_at IS NULL AND client_archived_at IS NULL $access_permission_query"));
+$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('contact_id') AS num FROM contacts LEFT JOIN clients ON contact_client_id = client_id WHERE contact_archived_at IS NULL AND client_archived_at IS NULL " . clientScopeSql('contact_client_id') . ""));
 $num_contacts = $row['num'];
 
-$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('location_id') AS num FROM locations LEFT JOIN clients ON location_client_id = client_id WHERE location_archived_at IS NULL AND client_archived_at IS NULL $access_permission_query"));
+$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('location_id') AS num FROM locations LEFT JOIN clients ON location_client_id = client_id WHERE location_archived_at IS NULL AND client_archived_at IS NULL " . clientScopeSql('location_client_id') . ""));
 $num_locations = $row['num'];
 
-$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('asset_id') AS num FROM assets LEFT JOIN clients ON asset_client_id = client_id WHERE asset_archived_at IS NULL AND client_archived_at IS NULL $access_permission_query"));
+$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('asset_id') AS num FROM assets LEFT JOIN clients ON asset_client_id = client_id WHERE asset_archived_at IS NULL AND client_archived_at IS NULL " . clientScopeSql('asset_client_id') . ""));
 $num_assets = $row['num'];
 
-$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('service_id') AS num FROM services LEFT JOIN clients ON service_client_id = client_id WHERE client_archived_at IS NULL $access_permission_query"));
+$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('service_id') AS num FROM services LEFT JOIN clients ON service_client_id = client_id WHERE client_archived_at IS NULL " . clientScopeSql('service_client_id') . ""));
 $num_services = $row['num'];
 
-$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('credential_id') AS num FROM credentials LEFT JOIN clients ON credential_client_id = client_id WHERE credential_archived_at IS NULL AND client_archived_at IS NULL $access_permission_query"));
+$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('credential_id') AS num FROM credentials LEFT JOIN clients ON credential_client_id = client_id WHERE credential_archived_at IS NULL AND client_archived_at IS NULL " . clientScopeSql('credential_client_id') . ""));
 $num_credentials = $row['num'];
 
-$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('network_id') AS num FROM networks LEFT JOIN clients ON network_client_id = client_id WHERE network_archived_at IS NULL AND client_archived_at IS NULL $access_permission_query"));
+$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('network_id') AS num FROM networks LEFT JOIN clients ON network_client_id = client_id WHERE network_archived_at IS NULL AND client_archived_at IS NULL " . clientScopeSql('network_client_id') . ""));
 $num_networks = $row['num'];
 
-$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('domain_id') AS num FROM domains LEFT JOIN clients ON domain_client_id = client_id WHERE domain_archived_at IS NULL AND client_archived_at IS NULL $access_permission_query"));
+$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('domain_id') AS num FROM domains LEFT JOIN clients ON domain_client_id = client_id WHERE domain_archived_at IS NULL AND client_archived_at IS NULL " . clientScopeSql('domain_client_id') . ""));
 $num_domains = $row['num'];
 
-$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('certificate_id') AS num FROM certificates LEFT JOIN clients ON certificate_client_id = client_id WHERE certificate_archived_at IS NULL AND client_archived_at IS NULL $access_permission_query"));
+$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('certificate_id') AS num FROM certificates LEFT JOIN clients ON certificate_client_id = client_id WHERE certificate_archived_at IS NULL AND client_archived_at IS NULL " . clientScopeSql('certificate_client_id') . ""));
 $num_certificates = $row['num'];
 
-$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('software_id') AS num FROM software LEFT JOIN clients ON software_client_id = client_id WHERE software_archived_at IS NULL AND client_archived_at IS NULL $access_permission_query"));
+$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('software_id') AS num FROM software LEFT JOIN clients ON software_client_id = client_id WHERE software_archived_at IS NULL AND client_archived_at IS NULL " . clientScopeSql('software_client_id') . ""));
 $num_software = $row['num'];
 
 ?>

agent/includes/get_side_nav_counts.php

@@ -2,31 +2,31 @@
 // Get Main Side Bar Badge Counts
 
 // Active Clients Count
-$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('client_id') AS num FROM clients WHERE client_archived_at IS NULL $access_permission_query"));
+$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('client_id') AS num FROM clients WHERE client_archived_at IS NULL " . clientScopeSql('clients.client_id') . ""));
 $num_active_clients = $row['num'];
 
 // Active Ticket Count
-$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('ticket_id') AS num FROM tickets LEFT JOIN clients ON client_id = ticket_client_id WHERE ticket_archived_at IS NULL AND ticket_closed_at IS NULL AND ticket_status != 4 $access_permission_query"));
+$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('ticket_id') AS num FROM tickets WHERE ticket_archived_at IS NULL AND ticket_closed_at IS NULL AND ticket_status != 4 " . clientScopeSql('ticket_client_id') . ""));
 $num_active_tickets = $row['num'];
 
 // Recurring Ticket Count
-$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('recurring_ticket_id') AS num FROM recurring_tickets LEFT JOIN clients ON client_id = recurring_ticket_client_id WHERE 1 = 1 $access_permission_query"));
+$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('recurring_ticket_id') AS num FROM recurring_tickets WHERE 1 = 1 " . clientScopeSql('recurring_ticket_client_id') . ""));
 $num_recurring_tickets = $row['num'];
 
 // Active Project Count
-$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('project_id') AS num FROM projects LEFT JOIN clients ON project_client_id = client_id WHERE project_archived_at IS NULL AND project_completed_at IS NULL $access_permission_query"));
+$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('project_id') AS num FROM projects WHERE project_archived_at IS NULL AND project_completed_at IS NULL " . clientScopeSql('project_client_id') . ""));
 $num_active_projects = $row['num'];
 
 // Open Invoices Count
-$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('invoice_id') AS num FROM invoices LEFT JOIN clients ON invoice_client_id = client_id WHERE (invoice_status = 'Sent' OR invoice_status = 'Viewed' OR invoice_status = 'Partial' OR invoice_status = 'Draft') AND invoice_archived_at IS NULL $access_permission_query"));
+$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('invoice_id') AS num FROM invoices WHERE (invoice_status = 'Sent' OR invoice_status = 'Viewed' OR invoice_status = 'Partial' OR invoice_status = 'Draft') AND invoice_archived_at IS NULL " . clientScopeSql('invoice_client_id') . ""));
 $num_open_invoices = $row['num'];
 
 // Recurring Invoice Count
-$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('recurring_invoice_id') AS num FROM recurring_invoices LEFT JOIN clients ON recurring_invoice_client_id = client_id WHERE recurring_invoice_archived_at IS NULL $access_permission_query"));
+$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('recurring_invoice_id') AS num FROM recurring_invoices WHERE recurring_invoice_archived_at IS NULL " . clientScopeSql('recurring_invoice_client_id') . ""));
 $num_recurring_invoices = $row['num'];
 
 // Open Quotes Count
-$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('quote_id') AS num FROM quotes LEFT JOIN clients ON quote_client_id = client_id WHERE (quote_status = 'Sent' OR quote_status = 'Viewed') AND quote_archived_at IS NULL $access_permission_query"));
+$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('quote_id') AS num FROM quotes WHERE (quote_status = 'Sent' OR quote_status = 'Viewed') AND quote_archived_at IS NULL " . clientScopeSql('quote_client_id') . ""));
 $num_open_quotes = $row['num'];
 
 // Recurring Expenses Count

agent/includes/inc_all_client.php

@@ -18,7 +18,13 @@ if (isset($_GET['client_id'])) {
 
     $sql = mysqli_query(
         $mysqli,
-        "SELECT * FROM clients
+        "SELECT client_abbreviation, client_archived_at, client_created_at, client_currency_code,
+            client_lead, client_name, client_net_terms, client_notes, client_rate, client_referral,
+            client_tax_id_number, client_type, client_website, contact_email, contact_extension,
+            contact_id, contact_mobile, contact_mobile_country_code, contact_name, contact_phone,
+            contact_phone_country_code, contact_primary, contact_title, location_address,
+            location_city, location_country, location_id, location_name, location_phone,
+            location_phone_country_code, location_primary, location_state, location_zip FROM clients
         LEFT JOIN locations ON client_id = location_client_id AND location_primary = 1
         LEFT JOIN contacts ON client_id = contact_client_id AND contact_primary = 1
         WHERE client_id = $client_id"
@@ -75,7 +81,7 @@ if (isset($_GET['client_id'])) {
 
         $client_tag_name_display_array = array();
         $client_tag_id_array = array();
-        $sql_client_tags = mysqli_query($mysqli, "SELECT * FROM client_tags LEFT JOIN tags ON client_tags.tag_id = tags.tag_id WHERE client_id = $client_id ORDER BY tag_name ASC");
+        $sql_client_tags = mysqli_query($mysqli, "SELECT tag_color, tag_icon, client_tags.tag_id, tag_name FROM client_tags LEFT JOIN tags ON client_tags.tag_id = tags.tag_id WHERE client_id = $client_id ORDER BY tag_name ASC");
         while ($row = mysqli_fetch_assoc($sql_client_tags)) {
 
             $client_tag_id = intval($row['tag_id']);

agent/includes/inc_client_top_head.php

@@ -31,7 +31,7 @@
                         </a>
                         <?php } ?>
                     <?php } ?>
-                    <?php if (lookupUserPermission("module_client") >= 3) { ?>
+                    <?php if (lookupUserPermission("module_client") >= 1) { ?>
                         <div class="dropdown-divider"></div>
                         <a class="dropdown-item" href="#" data-toggle="modal" data-target="#exportClientPDFModal">
                             <i class="fas fa-fw fa-file-pdf mr-2"></i>Export Data

agent/includes/side_nav.php

@@ -200,7 +200,7 @@
                 <?php } ?>
 
                 <?php
-                $sql_custom_links = mysqli_query($mysqli, "SELECT * FROM custom_links WHERE custom_link_location = 1 AND custom_link_archived_at IS NULL
+                $sql_custom_links = mysqli_query($mysqli, "SELECT custom_link_icon, custom_link_name, custom_link_new_tab, custom_link_uri FROM custom_links WHERE custom_link_location = 1 AND custom_link_archived_at IS NULL
                     ORDER BY custom_link_order ASC, custom_link_name ASC"
                 );
 

agent/income.php

@@ -91,7 +91,7 @@ $income_query =
     LEFT JOIN categories ON invoice_category_id = category_id
     WHERE payment_archived_at IS NULL
     $payment_client_query
-    $access_permission_query
+    " . clientScopeSql('invoice_client_id') . "
 
     UNION ALL
 
@@ -120,7 +120,8 @@ $income_query =
     LEFT JOIN transfers ON transfer_revenue_id = revenue_id
     WHERE revenue_archived_at IS NULL
     AND transfer_id IS NULL
-    $revenue_client_query";
+    $revenue_client_query
+    " . clientScopeSql('revenue_client_id') . "";
 
 $income_filter_query =
     "WHERE DATE(income_date) BETWEEN '$dtf' AND '$dtt'

agent/invoice.php

@@ -16,12 +16,18 @@ if (isset($_GET['invoice_id'])) {
 
     $sql = mysqli_query(
         $mysqli,
-        "SELECT * FROM invoices
+        "SELECT client_currency_code, client_id, client_name, client_net_terms, client_website,
+            contact_email, contact_extension, contact_mobile, contact_mobile_country_code,
+            contact_phone, contact_phone_country_code, invoice_amount, invoice_category_id,
+            invoice_created_at, invoice_credit_amount, invoice_currency_code, invoice_date,
+            invoice_discount_amount, invoice_due, invoice_id, invoice_note, invoice_number,
+            invoice_prefix, invoice_scope, invoice_status, invoice_url_key, location_address,
+            location_city, location_country, location_state, location_zip FROM invoices
         LEFT JOIN clients ON invoice_client_id = client_id
         LEFT JOIN contacts ON client_id = contact_client_id AND contact_primary = 1
         LEFT JOIN locations ON client_id = location_client_id AND location_primary = 1
         WHERE invoice_id = $invoice_id
-        $access_permission_query
+        " . clientScopeSql('invoice_client_id') . "
         LIMIT 1"
     );
 
@@ -77,7 +83,9 @@ if (isset($_GET['invoice_id'])) {
     $tab_title = $row['client_name'];
     $page_title = "{$row['invoice_prefix']}{$row['invoice_number']}";
 
-    $sql = mysqli_query($mysqli, "SELECT * FROM companies WHERE company_id = 1");
+    $sql = mysqli_query($mysqli, "SELECT company_address, company_city, company_country, company_email, company_id, company_logo,
+        company_name, company_phone, company_phone_country_code, company_state, company_tax_id,
+        company_website, company_zip FROM companies WHERE company_id = 1");
     $row = mysqli_fetch_assoc($sql);
     $company_id = intval($row['company_id']);
     $company_name = escapeHtml($row['company_name']);
@@ -98,9 +106,10 @@ if (isset($_GET['invoice_id'])) {
     }
     $company_logo = escapeHtml($row['company_logo']);
 
-    $sql_history = mysqli_query($mysqli, "SELECT * FROM history WHERE history_invoice_id = $invoice_id ORDER BY history_id DESC");
+    $sql_history = mysqli_query($mysqli, "SELECT history_created_at, history_description, history_status FROM history WHERE history_invoice_id = $invoice_id ORDER BY history_id DESC");
 
-    $sql_payments = mysqli_query($mysqli, "SELECT * FROM payments, accounts WHERE payment_account_id = account_id AND payment_invoice_id = $invoice_id ORDER BY payments.payment_id DESC");
+    $sql_payments = mysqli_query($mysqli, "SELECT account_name, payment_amount, payment_currency_code, payment_date, payment_id,
+        payment_reference FROM payments, accounts WHERE payment_account_id = account_id AND payment_invoice_id = $invoice_id ORDER BY payments.payment_id DESC");
 
     $sql_tickets = mysqli_query($mysqli, "
         SELECT
@@ -121,8 +130,7 @@ if (isset($_GET['invoice_id'])) {
     //Get billable, and unbilled tickets to add to invoice
     $sql_tickets_billable = mysqli_query(
         $mysqli, "
-        SELECT
+        SELECT 1
-            *
         FROM
             tickets
         WHERE
@@ -190,7 +198,7 @@ if (isset($_GET['invoice_id'])) {
 
     // Saved Payment Methods
     $sql_saved_payment_methods = mysqli_query($mysqli, "
-        SELECT * FROM client_saved_payment_methods
+        SELECT 1 FROM client_saved_payment_methods
         LEFT JOIN payment_providers
             ON client_saved_payment_methods.saved_payment_provider_id = payment_providers.payment_provider_id
         WHERE saved_payment_client_id = $client_id
@@ -372,7 +380,8 @@ if (isset($_GET['invoice_id'])) {
                 </div>
             </div>
 
-            <?php $sql_invoice_items = mysqli_query($mysqli, "SELECT * FROM invoice_items WHERE item_invoice_id = $invoice_id ORDER BY item_order ASC"); ?>
+            <?php $sql_invoice_items = mysqli_query($mysqli, "SELECT item_created_at, item_description, item_id, item_name, item_price, item_product_id,
+                item_quantity, item_tax, item_tax_id, item_total FROM invoice_items WHERE item_invoice_id = $invoice_id ORDER BY item_order ASC"); ?>
 
             <div class="row mb-3">
                 <div class="col-md-12">
@@ -469,7 +478,7 @@ if (isset($_GET['invoice_id'])) {
                                             <select class="form-control select2" name="tax_id" id="tax" required>
                                                 <option value="0">No Tax</option>
                                                 <?php
-                                                $taxes_sql = mysqli_query($mysqli, "SELECT * FROM taxes WHERE tax_archived_at IS NULL ORDER BY tax_name ASC");
+                                                $taxes_sql = mysqli_query($mysqli, "SELECT tax_id, tax_name, tax_percent FROM taxes WHERE tax_archived_at IS NULL ORDER BY tax_name ASC");
                                                 while ($row = mysqli_fetch_assoc($taxes_sql)) {
                                                     $tax_id = intval($row['tax_id']);
                                                     $tax_name = escapeHtml($row['tax_name']);

agent/invoices.php

@@ -11,57 +11,57 @@ if (isset($_GET['client_id'])) {
     $client_url = "client_id=$client_id&";
 } else {
     require_once "includes/inc_all.php";
-    $client_query = "$access_permission_query";
+    $client_query = clientScopeSql('invoice_client_id');
     $client_url = '';
 }
 
 // Perms
 enforceUserPermission('module_sales');
 
-$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('invoice_id') AS num FROM invoices LEFT JOIN clients ON invoice_client_id = client_id WHERE invoice_status = 'Sent' $client_query"));
+$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('invoice_id') AS num FROM invoices WHERE invoice_status = 'Sent' $client_query"));
 $sent_count = $row['num'];
 
-$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('invoice_id') AS num FROM invoices LEFT JOIN clients ON invoice_client_id = client_id WHERE invoice_status = 'Viewed' $client_query"));
+$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('invoice_id') AS num FROM invoices WHERE invoice_status = 'Viewed' $client_query"));
 $viewed_count = $row['num'];
 
-$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('invoice_id') AS num FROM invoices LEFT JOIN clients ON invoice_client_id = client_id WHERE invoice_status = 'Partial' $client_query"));
+$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('invoice_id') AS num FROM invoices WHERE invoice_status = 'Partial' $client_query"));
 $partial_count = $row['num'];
 
-$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('invoice_id') AS num FROM invoices LEFT JOIN clients ON invoice_client_id = client_id WHERE invoice_status = 'Draft' $client_query"));
+$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('invoice_id') AS num FROM invoices WHERE invoice_status = 'Draft' $client_query"));
 $draft_count = $row['num'];
 
-$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('invoice_id') AS num FROM invoices LEFT JOIN clients ON invoice_client_id = client_id WHERE invoice_status = 'Cancelled' $client_query"));
+$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('invoice_id') AS num FROM invoices WHERE invoice_status = 'Cancelled' $client_query"));
 $cancelled_count = $row['num'];
 
-$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('invoice_id') AS num FROM invoices LEFT JOIN clients ON invoice_client_id = client_id WHERE invoice_status NOT LIKE 'Draft' AND invoice_status NOT LIKE 'Paid' AND invoice_status NOT LIKE 'Cancelled' AND invoice_status NOT LIKE 'Non-Billable' AND invoice_due < CURDATE() $client_query"));
+$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('invoice_id') AS num FROM invoices WHERE invoice_status NOT LIKE 'Draft' AND invoice_status NOT LIKE 'Paid' AND invoice_status NOT LIKE 'Cancelled' AND invoice_status NOT LIKE 'Non-Billable' AND invoice_due < CURDATE() $client_query"));
 $overdue_count = $row['num'];
 
-$sql_total_draft_amount = mysqli_query($mysqli, "SELECT SUM(invoice_amount) AS total_draft_amount FROM invoices LEFT JOIN clients ON invoice_client_id = client_id WHERE invoice_status = 'Draft' $client_query");
+$sql_total_draft_amount = mysqli_query($mysqli, "SELECT SUM(invoice_amount) AS total_draft_amount FROM invoices WHERE invoice_status = 'Draft' $client_query");
 $row = mysqli_fetch_assoc($sql_total_draft_amount);
 $total_draft_amount = floatval($row['total_draft_amount']);
 
-$sql_total_sent_amount = mysqli_query($mysqli, "SELECT SUM(invoice_amount) AS total_sent_amount FROM invoices LEFT JOIN clients ON invoice_client_id = client_id WHERE invoice_status = 'Sent' $client_query");
+$sql_total_sent_amount = mysqli_query($mysqli, "SELECT SUM(invoice_amount) AS total_sent_amount FROM invoices WHERE invoice_status = 'Sent' $client_query");
 $row = mysqli_fetch_assoc($sql_total_sent_amount);
 $total_sent_amount = floatval($row['total_sent_amount']);
 
-$sql_total_viewed_amount = mysqli_query($mysqli, "SELECT SUM(invoice_amount) AS total_viewed_amount FROM invoices LEFT JOIN clients ON invoice_client_id = client_id WHERE invoice_status = 'Viewed' $client_query");
+$sql_total_viewed_amount = mysqli_query($mysqli, "SELECT SUM(invoice_amount) AS total_viewed_amount FROM invoices WHERE invoice_status = 'Viewed' $client_query");
 $row = mysqli_fetch_assoc($sql_total_viewed_amount);
 $total_viewed_amount = floatval($row['total_viewed_amount']);
 
-$sql_total_cancelled_amount = mysqli_query($mysqli, "SELECT SUM(invoice_amount) AS total_cancelled_amount FROM invoices LEFT JOIN clients ON invoice_client_id = client_id WHERE invoice_status = 'Cancelled' $client_query");
+$sql_total_cancelled_amount = mysqli_query($mysqli, "SELECT SUM(invoice_amount) AS total_cancelled_amount FROM invoices WHERE invoice_status = 'Cancelled' $client_query");
 $row = mysqli_fetch_assoc($sql_total_cancelled_amount);
 $total_cancelled_amount = floatval($row['total_cancelled_amount']);
 
-$sql_total_partial_amount = mysqli_query($mysqli, "SELECT SUM(invoice_amount) AS total_partial_amount FROM payments, invoices LEFT JOIN clients ON invoice_client_id = client_id WHERE payment_invoice_id = invoice_id AND invoice_status = 'Partial' $client_query");
+$sql_total_partial_amount = mysqli_query($mysqli, "SELECT SUM(invoice_amount) AS total_partial_amount FROM payments, invoices WHERE payment_invoice_id = invoice_id AND invoice_status = 'Partial' $client_query");
 $row = mysqli_fetch_assoc($sql_total_partial_amount);
 $total_partial_amount = floatval($row['total_partial_amount']);
 $total_partial_count = mysqli_num_rows($sql_total_partial_amount);
 
-$sql_total_overdue_partial_amount = mysqli_query($mysqli, "SELECT SUM(payment_amount) AS total_overdue_partial_amount FROM payments, invoices LEFT JOIN clients ON invoice_client_id = client_id WHERE payment_invoice_id = invoice_id AND invoice_status = 'Partial' AND invoice_due < CURDATE() $client_query");
+$sql_total_overdue_partial_amount = mysqli_query($mysqli, "SELECT SUM(payment_amount) AS total_overdue_partial_amount FROM payments, invoices WHERE payment_invoice_id = invoice_id AND invoice_status = 'Partial' AND invoice_due < CURDATE() $client_query");
 $row = mysqli_fetch_assoc($sql_total_overdue_partial_amount);
 $total_overdue_partial_amount = floatval($row['total_overdue_partial_amount']);
 
-$sql_total_overdue_amount = mysqli_query($mysqli, "SELECT SUM(invoice_amount) AS total_overdue_amount FROM invoices LEFT JOIN clients ON invoice_client_id = client_id WHERE invoice_status != 'Draft' AND invoice_status != 'Paid' AND invoice_status != 'Cancelled' AND invoice_status != 'Non-Billable' AND invoice_due < CURDATE() $client_query");
+$sql_total_overdue_amount = mysqli_query($mysqli, "SELECT SUM(invoice_amount) AS total_overdue_amount FROM invoices WHERE invoice_status != 'Draft' AND invoice_status != 'Paid' AND invoice_status != 'Cancelled' AND invoice_status != 'Non-Billable' AND invoice_due < CURDATE() $client_query");
 $row = mysqli_fetch_assoc($sql_total_overdue_amount);
 $total_overdue_amount = floatval($row['total_overdue_amount']);
 
@@ -94,7 +94,11 @@ if (isset($_GET['category']) & !empty($_GET['category'])) {
 
 $sql = mysqli_query(
     $mysqli,
-    "SELECT SQL_CALC_FOUND_ROWS * FROM invoices
+    "SELECT SQL_CALC_FOUND_ROWS category_id, category_name, client_currency_code, client_id, client_name, client_net_terms,
+        invoice_amount, invoice_created_at, invoice_currency_code, invoice_date,
+        invoice_discount_amount, invoice_due, invoice_id, invoice_number, invoice_prefix,
+        invoice_scope, invoice_status, recurring_invoice_id, recurring_invoice_number,
+        recurring_invoice_prefix FROM invoices
     LEFT JOIN clients ON invoice_client_id = client_id
     LEFT JOIN categories ON invoice_category_id = category_id
     LEFT JOIN recurring_invoices ON invoice_recurring_invoice_id = recurring_invoice_id
@@ -103,7 +107,7 @@ $sql = mysqli_query(
     $category_query
     AND DATE(invoice_date) BETWEEN '$dtf' AND '$dtt'
     AND (CONCAT(invoice_prefix,invoice_number) LIKE '%$q%' OR invoice_scope LIKE '%$q%' OR client_name LIKE '%$q%' OR invoice_status LIKE '%$q%' OR invoice_amount LIKE '%$q%' OR category_name LIKE '%$q%')
-    $access_permission_query
+    " . clientScopeSql('invoice_client_id') . "
     $client_query
     ORDER BY $sort $order LIMIT $record_from, $record_to"
 );
@@ -362,7 +366,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
 
                         // Saved Payment Methods
                         $sql_saved_payment_methods = mysqli_query($mysqli, "
-                            SELECT * FROM client_saved_payment_methods
+                            SELECT 1 FROM client_saved_payment_methods
                             LEFT JOIN payment_providers
                                 ON client_saved_payment_methods.saved_payment_provider_id = payment_providers.payment_provider_id
                             WHERE saved_payment_client_id = $client_id

agent/locations.php

@@ -64,7 +64,7 @@ $sql = mysqli_query(
     WHERE $archive_query
     $tag_query
     AND (location_name LIKE '%$q%' OR location_description LIKE '%$q%' OR location_address LIKE '%$q%' OR location_city LIKE '%$q%' OR location_state LIKE '%$q%' OR location_zip LIKE '%$q%' OR location_country LIKE '%$q%' OR location_phone LIKE '%$phone_query%' OR tag_name LIKE '%$q%' OR client_name LIKE '%$q%')
-    $access_permission_query
+    " . clientScopeSql('location_client_id') . "
     $client_query
     GROUP BY location_id
     ORDER BY location_primary DESC, $sort $order LIMIT $record_from, $record_to"
@@ -154,7 +154,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                                 FROM clients
                                 JOIN locations ON location_client_id = client_id
                                 WHERE $archive_query
-                                $access_permission_query
+                                " . clientScopeSql('clients.client_id') . "
                                 ORDER BY client_name ASC
                             ");
                             while ($row = mysqli_fetch_assoc($sql_clients_filter)) {
@@ -306,7 +306,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
 
                         $location_tag_name_display_array = array();
                         $location_tag_id_array = array();
-                        $sql_location_tags = mysqli_query($mysqli, "SELECT * FROM location_tags LEFT JOIN tags ON location_tags.tag_id = tags.tag_id WHERE location_tags.location_id = $location_id ORDER BY tag_name ASC");
+                        $sql_location_tags = mysqli_query($mysqli, "SELECT tag_color, tag_icon, location_tags.tag_id, tag_name FROM location_tags LEFT JOIN tags ON location_tags.tag_id = tags.tag_id WHERE location_tags.location_id = $location_id ORDER BY tag_name ASC");
                         while ($row = mysqli_fetch_assoc($sql_location_tags)) {
 
                             $location_tag_id = intval($row['tag_id']);

agent/modals/account/account_edit.php

@@ -6,7 +6,7 @@ enforceUserPermission('module_financial', 2);
 
 $account_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM accounts WHERE account_id = $account_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT account_name, account_notes FROM accounts WHERE account_id = $account_id LIMIT 1");
 
 $row = mysqli_fetch_assoc($sql);
 $account_name = escapeHtml($row['account_name']);

agent/modals/asset/asset.php

@@ -6,7 +6,15 @@ enforceUserPermission('module_support');
 
 $asset_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM assets
+$sql = mysqli_query($mysqli, "SELECT asset_contact_id, asset_created_at, asset_description, asset_favorite, asset_id,
+    asset_install_date, asset_location_id, asset_make, asset_model, asset_name, asset_notes,
+    asset_os, asset_photo, asset_physical_location, asset_purchase_date,
+    asset_purchase_reference, asset_serial, asset_status, asset_type, asset_uri, asset_uri_2,
+    asset_uri_client, asset_vendor_id, asset_warranty_expire, client_id, client_name,
+    contact_archived_at, contact_email, contact_extension, contact_mobile,
+    contact_mobile_country_code, contact_name, contact_phone, contact_phone_country_code,
+    interface_ip, interface_ipv6, interface_mac, interface_nat_ip, interface_network_id,
+    location_archived_at, location_name FROM assets
     LEFT JOIN clients ON client_id = asset_client_id
     LEFT JOIN contacts ON asset_contact_id = contact_id
     LEFT JOIN locations ON asset_location_id = location_id
@@ -82,7 +90,7 @@ if ($location_archived_at) {
 // Tags - many to many relationship
 $asset_tag_name_display_array = array();
 $asset_tag_id_array = array();
-$sql_asset_tags = mysqli_query($mysqli, "SELECT * FROM asset_tags LEFT JOIN tags ON asset_tag_tag_id = tag_id WHERE asset_tag_asset_id = $asset_id ORDER BY tag_name ASC");
+$sql_asset_tags = mysqli_query($mysqli, "SELECT tag_color, tag_icon, tag_id, tag_name FROM asset_tags LEFT JOIN tags ON asset_tag_tag_id = tag_id WHERE asset_tag_asset_id = $asset_id ORDER BY tag_name ASC");
 while ($row = mysqli_fetch_assoc($sql_asset_tags)) {
 
     $asset_tag_id = intval($row['tag_id']);
@@ -179,7 +187,8 @@ $sql_related_tickets = mysqli_query($mysqli, "
 $ticket_count = mysqli_num_rows($sql_related_tickets);
 
 // Related Recurring Tickets Query
-$sql_related_recurring_tickets = mysqli_query($mysqli, "SELECT * FROM recurring_tickets
+$sql_related_recurring_tickets = mysqli_query($mysqli, "SELECT recurring_ticket_frequency, recurring_ticket_assets.recurring_ticket_id,
+    recurring_ticket_next_run, recurring_ticket_priority, recurring_ticket_subject FROM recurring_tickets
     LEFT JOIN recurring_ticket_assets ON recurring_tickets.recurring_ticket_id = recurring_ticket_assets.recurring_ticket_id
     WHERE recurring_ticket_asset_id = $asset_id OR recurring_ticket_assets.asset_id = $asset_id
     GROUP BY recurring_tickets.recurring_ticket_id
@@ -188,7 +197,8 @@ $sql_related_recurring_tickets = mysqli_query($mysqli, "SELECT * FROM recurring_
 $recurring_ticket_count = mysqli_num_rows($sql_related_recurring_tickets);
 
 // Related Documents
-$sql_related_documents = mysqli_query($mysqli, "SELECT * FROM asset_documents
+$sql_related_documents = mysqli_query($mysqli, "SELECT document_created_at, document_description, documents.document_id, document_name,
+    document_updated_at, user_name FROM asset_documents
     LEFT JOIN documents ON asset_documents.document_id = documents.document_id
     LEFT JOIN users ON user_id = document_created_by
     WHERE asset_documents.asset_id = $asset_id
@@ -198,7 +208,7 @@ $sql_related_documents = mysqli_query($mysqli, "SELECT * FROM asset_documents
 $document_count = mysqli_num_rows($sql_related_documents);
 
 // Related Files
-$sql_related_files = mysqli_query($mysqli, "SELECT * FROM asset_files
+$sql_related_files = mysqli_query($mysqli, "SELECT file_created_at, file_description, file_ext, files.file_id, file_mime_type, file_name FROM asset_files
     LEFT JOIN files ON asset_files.file_id = files.file_id
     WHERE asset_files.asset_id = $asset_id
     AND file_archived_at IS NULL
@@ -209,7 +219,9 @@ $file_count = mysqli_num_rows($sql_related_files);
 // Related Software Query
 $sql_related_software = mysqli_query(
     $mysqli,
-    "SELECT * FROM software_assets
+    "SELECT software_expire, software_assets.software_id, software_key, software_license_type,
+        software_name, software_notes, software_purchase, software_seats, software_type,
+        software_version FROM software_assets
     LEFT JOIN software ON software_assets.software_id = software.software_id
     WHERE software_assets.asset_id = $asset_id
     AND software_archived_at IS NULL
@@ -219,7 +231,7 @@ $sql_related_software = mysqli_query(
 $software_count = mysqli_num_rows($sql_related_software);
 
 // Related Notes
-$sql_related_notes = mysqli_query($mysqli, "SELECT * FROM asset_notes
+$sql_related_notes = mysqli_query($mysqli, "SELECT asset_note, asset_note_created_at, asset_note_type, user_name FROM asset_notes
     LEFT JOIN users ON asset_note_created_by = user_id
     WHERE asset_note_asset_id = $asset_id
     AND asset_note_archived_at IS NULL
@@ -571,7 +583,7 @@ ob_start();
                         // Tags
                         $credential_tag_name_display_array = array();
                         $credential_tag_id_array = array();
-                        $sql_credential_tags = mysqli_query($mysqli, "SELECT * FROM credential_tags LEFT JOIN tags ON credential_tags.tag_id = tags.tag_id WHERE credential_id = $credential_id ORDER BY tag_name ASC");
+                        $sql_credential_tags = mysqli_query($mysqli, "SELECT tag_color, tag_icon, credential_tags.tag_id, tag_name FROM credential_tags LEFT JOIN tags ON credential_tags.tag_id = tags.tag_id WHERE credential_id = $credential_id ORDER BY tag_name ASC");
                         while ($row = mysqli_fetch_assoc($sql_credential_tags)) {
 
                             $credential_tag_id = intval($row['tag_id']);

agent/modals/asset/asset_add.php

@@ -7,12 +7,12 @@ $contact_id = intval($_GET['contact_id'] ?? 0);
 $type = escapeHtml(ucwords($_GET['type']) ?? '');
 
 if ($client_id) {
-    $sql_network_select = mysqli_query($mysqli, "SELECT * FROM networks WHERE network_archived_at IS NULL AND network_client_id = $client_id ORDER BY network_name ASC");
+    $sql_network_select = mysqli_query($mysqli, "SELECT network, network_id, network_name FROM networks WHERE network_archived_at IS NULL AND network_client_id = $client_id ORDER BY network_name ASC");
-    $sql_vendor_select = mysqli_query($mysqli, "SELECT * FROM vendors WHERE vendor_archived_at IS NULL AND vendor_client_id = $client_id ORDER BY vendor_name ASC");
+    $sql_vendor_select = mysqli_query($mysqli, "SELECT vendor_id, vendor_name FROM vendors WHERE vendor_archived_at IS NULL AND vendor_client_id = $client_id ORDER BY vendor_name ASC");
     $sql_location_select = mysqli_query($mysqli, "SELECT location_id, location_name FROM locations WHERE location_archived_at IS NULL AND location_client_id = $client_id ORDER BY location_name ASC");
-    $sql_contact_select = mysqli_query($mysqli, "SELECT * FROM contacts WHERE contact_archived_at IS NULL AND contact_client_id = $client_id ORDER BY contact_name ASC");
+    $sql_contact_select = mysqli_query($mysqli, "SELECT contact_id, contact_name FROM contacts WHERE contact_archived_at IS NULL AND contact_client_id = $client_id ORDER BY contact_name ASC");
 } else {
-    $sql_client_select = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients WHERE client_archived_at IS NULL $access_permission_query ORDER BY client_name ASC");
+    $sql_client_select = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients WHERE client_archived_at IS NULL " . clientScopeSql('clients.client_id') . " ORDER BY client_name ASC");
 }
 
 // OS typeahead suggestions

agent/modals/asset/asset_bulk_add_ticket.php

@@ -116,7 +116,7 @@ ob_start();
                     <option value="0">- None -</option>
                     <?php
 
-                    $sql_projects = mysqli_query($mysqli, "SELECT * FROM projects WHERE project_completed_at IS NULL AND project_archived_at IS NULL ORDER BY project_name ASC");
+                    $sql_projects = mysqli_query($mysqli, "SELECT project_id, project_name FROM projects WHERE project_completed_at IS NULL AND project_archived_at IS NULL ORDER BY project_name ASC");
                     while ($row = mysqli_fetch_assoc($sql_projects)) {
                         $project_id_select = intval($row['project_id']);
                         $project_name_select = escapeHtml($row['project_name']); ?>

agent/modals/asset/asset_bulk_assign_contact.php

@@ -37,7 +37,7 @@ ob_start();
                     <option value="">- Contact -</option>
                     <?php
 
-                    $sql = mysqli_query($mysqli, "SELECT * FROM contacts WHERE contact_archived_at IS NULL AND contact_client_id = $client_id ORDER BY contact_name ASC");
+                    $sql = mysqli_query($mysqli, "SELECT contact_id, contact_name FROM contacts WHERE contact_archived_at IS NULL AND contact_client_id = $client_id ORDER BY contact_name ASC");
                     while ($row = mysqli_fetch_assoc($sql)) {
                         $contact_id = intval($row['contact_id']);
                         $contact_name = escapeHtml($row['contact_name']);

agent/modals/asset/asset_bulk_assign_tags.php

@@ -37,7 +37,7 @@ ob_start();
                 <select class="form-control select2" name="tags[]" data-placeholder="Add some tags" multiple>
                     <?php
 
-                    $sql_tags_select = mysqli_query($mysqli, "SELECT * FROM tags WHERE tag_type = 5 ORDER BY tag_name ASC");
+                    $sql_tags_select = mysqli_query($mysqli, "SELECT tag_id, tag_name FROM tags WHERE tag_type = 5 ORDER BY tag_name ASC");
                     while ($row = mysqli_fetch_assoc($sql_tags_select)) {
                         $tag_id_select = intval($row['tag_id']);
                         $tag_name_select = escapeHtml($row['tag_name']);

agent/modals/asset/asset_copy.php

@@ -6,7 +6,12 @@ enforceUserPermission('module_support', 2);
 
 $asset_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM assets
+$sql = mysqli_query($mysqli, "SELECT asset_archived_at, asset_client_id, asset_contact_id, asset_created_at, asset_description,
+    asset_id, asset_install_date, asset_location_id, asset_make, asset_model, asset_name,
+    asset_notes, asset_os, asset_photo, asset_physical_location, asset_purchase_date,
+    asset_purchase_reference, asset_serial, asset_status, asset_type, asset_uri, asset_uri_2,
+    asset_vendor_id, asset_warranty_expire, interface_ip, interface_ipv6, interface_mac,
+    interface_nat_ip, interface_network_id FROM assets
     LEFT JOIN asset_interfaces ON interface_asset_id = asset_id AND interface_primary = 1
     WHERE asset_id = $asset_id LIMIT 1"
 );
@@ -181,7 +186,7 @@ ob_start();
                             <option value="">- Select Location -</option>
                             <?php
 
-                            $sql_locations = mysqli_query($mysqli, "SELECT * FROM locations WHERE location_archived_at IS NULL AND location_client_id = $client_id ORDER BY location_name ASC");
+                            $sql_locations = mysqli_query($mysqli, "SELECT location_id, location_name FROM locations WHERE location_archived_at IS NULL AND location_client_id = $client_id ORDER BY location_name ASC");
                             while ($row = mysqli_fetch_assoc($sql_locations)) {
                                 $location_id_select = intval($row['location_id']);
                                 $location_name_select = escapeHtml($row['location_name']);
@@ -213,7 +218,7 @@ ob_start();
                             <option value="">- Select Contact -</option>
                             <?php
 
-                            $sql_contacts = mysqli_query($mysqli, "SELECT * FROM contacts WHERE contact_archived_at IS NULL AND contact_client_id = $client_id ORDER BY contact_name ASC");
+                            $sql_contacts = mysqli_query($mysqli, "SELECT contact_id, contact_name FROM contacts WHERE contact_archived_at IS NULL AND contact_client_id = $client_id ORDER BY contact_name ASC");
                             while ($row = mysqli_fetch_assoc($sql_contacts)) {
                                 $contact_id_select = intval($row['contact_id']);
                                 $contact_name_select = escapeHtml($row['contact_name']);
@@ -265,7 +270,7 @@ ob_start();
                             <option value="">- Select Network -</option>
                             <?php
 
-                            $sql_networks = mysqli_query($mysqli, "SELECT * FROM networks WHERE network_archived_at IS NULL AND network_client_id = $client_id ORDER BY network_name ASC");
+                            $sql_networks = mysqli_query($mysqli, "SELECT network, network_id, network_name FROM networks WHERE network_archived_at IS NULL AND network_client_id = $client_id ORDER BY network_name ASC");
                             while ($row = mysqli_fetch_assoc($sql_networks)) {
                                 $network_id_select = intval($row['network_id']);
                                 $network_name_select = escapeHtml($row['network_name']);
@@ -358,7 +363,7 @@ ob_start();
                             <option value="">- Select Vendor -</option>
                             <?php
 
-                            $sql_vendors = mysqli_query($mysqli, "SELECT * FROM vendors WHERE vendor_archived_at IS NULL AND vendor_client_id = $client_id ORDER BY vendor_name ASC");
+                            $sql_vendors = mysqli_query($mysqli, "SELECT vendor_id, vendor_name FROM vendors WHERE vendor_archived_at IS NULL AND vendor_client_id = $client_id ORDER BY vendor_name ASC");
                             while ($row = mysqli_fetch_assoc($sql_vendors)) {
                                 $vendor_id_select = intval($row['vendor_id']);
                                 $vendor_name_select = escapeHtml($row['vendor_name']);

agent/modals/asset/asset_edit.php

@@ -6,7 +6,12 @@ enforceUserPermission('module_support', 2);
 
 $asset_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM assets
+$sql = mysqli_query($mysqli, "SELECT asset_archived_at, asset_client_id, asset_contact_id, asset_created_at, asset_description,
+    asset_favorite, asset_id, asset_install_date, asset_location_id, asset_make, asset_model,
+    asset_name, asset_notes, asset_os, asset_photo, asset_physical_location,
+    asset_purchase_date, asset_purchase_reference, asset_serial, asset_status, asset_type,
+    asset_uri, asset_uri_2, asset_uri_client, asset_vendor_id, asset_warranty_expire,
+    interface_ip, interface_ipv6, interface_mac, interface_nat_ip, interface_network_id FROM assets
     LEFT JOIN asset_interfaces ON interface_asset_id = asset_id AND interface_primary = 1
     WHERE asset_id = $asset_id LIMIT 1"
 );
@@ -47,7 +52,7 @@ $asset_network_id = intval($row['interface_network_id']);
 $device_icon = getAssetIcon($asset_type);
 
 // Asset History Query
-$sql_asset_history = mysqli_query($mysqli, "SELECT * FROM asset_history
+$sql_asset_history = mysqli_query($mysqli, "SELECT asset_history_created_at, asset_history_description, asset_history_status FROM asset_history
     WHERE asset_history_asset_id = $asset_id
     ORDER BY asset_history_id
     DESC LIMIT 10"
@@ -210,7 +215,7 @@ ob_start();
                             <option value="">- Select Location -</option>
                             <?php
 
-                            $sql_locations = mysqli_query($mysqli, "SELECT * FROM locations WHERE location_id = $asset_location_id OR location_archived_at IS NULL AND location_client_id = $client_id ORDER BY location_name ASC");
+                            $sql_locations = mysqli_query($mysqli, "SELECT location_archived_at, location_id, location_name FROM locations WHERE location_id = $asset_location_id OR location_archived_at IS NULL AND location_client_id = $client_id ORDER BY location_name ASC");
                             while ($row = mysqli_fetch_assoc($sql_locations)) {
                                 $location_id_select = intval($row['location_id']);
                                 $location_name_select = escapeHtml($row['location_name']);
@@ -248,7 +253,7 @@ ob_start();
                             <option value="">- Select Contact -</option>
                             <?php
 
-                            $sql_contacts = mysqli_query($mysqli, "SELECT * FROM contacts WHERE contact_id = $asset_contact_id OR contact_archived_at IS NULL AND contact_client_id = $client_id ORDER BY contact_name ASC");
+                            $sql_contacts = mysqli_query($mysqli, "SELECT contact_archived_at, contact_id, contact_name FROM contacts WHERE contact_id = $asset_contact_id OR contact_archived_at IS NULL AND contact_client_id = $client_id ORDER BY contact_name ASC");
                             while ($row = mysqli_fetch_assoc($sql_contacts)) {
                                 $contact_id_select = intval($row['contact_id']);
                                 $contact_name_select = escapeHtml($row['contact_name']);
@@ -308,7 +313,7 @@ ob_start();
                             <option value="">- Select Network -</option>
                             <?php
 
-                            $sql_networks = mysqli_query($mysqli, "SELECT * FROM networks WHERE network_id = $asset_network_id OR network_archived_at IS NULL AND network_client_id = $client_id ORDER BY network_name ASC");
+                            $sql_networks = mysqli_query($mysqli, "SELECT network, network_archived_at, network_id, network_name FROM networks WHERE network_id = $asset_network_id OR network_archived_at IS NULL AND network_client_id = $client_id ORDER BY network_name ASC");
                             while ($row = mysqli_fetch_assoc($sql_networks)) {
                                 $network_id_select = intval($row['network_id']);
                                 $network_name_select = escapeHtml($row['network_name']);
@@ -416,7 +421,7 @@ ob_start();
                             <option value="">- Select Vendor -</option>
                             <?php
 
-                            $sql_vendors = mysqli_query($mysqli, "SELECT * FROM vendors WHERE vendor_id = $asset_vendor_id OR vendor_archived_at IS NULL AND vendor_client_id = $client_id ORDER BY vendor_name ASC");
+                            $sql_vendors = mysqli_query($mysqli, "SELECT vendor_archived_at, vendor_id, vendor_name FROM vendors WHERE vendor_id = $asset_vendor_id OR vendor_archived_at IS NULL AND vendor_client_id = $client_id ORDER BY vendor_name ASC");
                             while ($row = mysqli_fetch_assoc($sql_vendors)) {
                                 $vendor_id_select = intval($row['vendor_id']);
                                 $vendor_name_select = escapeHtml($row['vendor_name']);
@@ -506,7 +511,7 @@ ob_start();
                         <select class="form-control select2" name="tags[]" data-placeholder="Add some tags" multiple>
                             <?php
 
-                            $sql_tags_select = mysqli_query($mysqli, "SELECT * FROM tags WHERE tag_type = 5 ORDER BY tag_name ASC");
+                            $sql_tags_select = mysqli_query($mysqli, "SELECT tag_id, tag_name FROM tags WHERE tag_type = 5 ORDER BY tag_name ASC");
                             while ($row = mysqli_fetch_assoc($sql_tags_select)) {
                                 $tag_id_select = intval($row['tag_id']);
                                 $tag_name_select = escapeHtml($row['tag_name']);