diff --git a/admin/api_keys.php b/admin/api_keys.php index 1d6173b81..c0ed6cae9 100644 --- a/admin/api_keys.php +++ b/admin/api_keys.php @@ -8,7 +8,7 @@ require_once "includes/inc_all_admin.php"; $sql = mysqli_query( $mysqli, - "SELECT SQL_CALC_FOUND_ROWS * FROM api_keys + "SELECT SQL_CALC_FOUND_ROWS api_key_created_at, api_key_expire, api_key_id, api_key_name, api_key_secret, user_name FROM api_keys LEFT JOIN users on api_key_user_id = user_id WHERE (api_key_name LIKE '%$q%') ORDER BY $sort $order LIMIT $record_from, $record_to" diff --git a/admin/app_logs.php b/admin/app_logs.php index cf95b9478..2a1f7dce6 100644 --- a/admin/app_logs.php +++ b/admin/app_logs.php @@ -28,7 +28,7 @@ if (isset($_GET['category']) & !empty($_GET['catergory'])) { $sql = mysqli_query( $mysqli, - "SELECT SQL_CALC_FOUND_ROWS * FROM app_logs + "SELECT SQL_CALC_FOUND_ROWS app_log_category, app_log_created_at, app_log_details, app_log_id, app_log_type FROM app_logs WHERE (app_log_type LIKE '%$q%' OR app_log_category LIKE '%$q%' OR app_log_details LIKE '%$q%') AND DATE(app_log_created_at) BETWEEN '$dtf' AND '$dtt' $log_type_query diff --git a/admin/audit_logs.php b/admin/audit_logs.php index 440907e9a..0ce0d9709 100644 --- a/admin/audit_logs.php +++ b/admin/audit_logs.php @@ -108,7 +108,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));

Nothing to see here

Go Back"; diff --git a/admin/modals/ai/ai_model_add.php b/admin/modals/ai/ai_model_add.php index 13ea0cf95..1fe4a274b 100644 --- a/admin/modals/ai/ai_model_add.php +++ b/admin/modals/ai/ai_model_add.php @@ -26,7 +26,7 @@ ob_start(); diff --git a/agent/modals/client/client_edit.php b/agent/modals/client/client_edit.php index 175c2a56e..8336e6684 100644 --- a/agent/modals/client/client_edit.php +++ b/agent/modals/client/client_edit.php @@ -8,7 +8,9 @@ $client_id = intval($_GET['id']); enforceClientAccess(); -$sql = mysqli_query($mysqli, "SELECT * FROM clients WHERE client_id = $client_id LIMIT 1"); +$sql = mysqli_query($mysqli, "SELECT client_abbreviation, client_archived_at, client_created_at, client_lead, client_name, + client_net_terms, client_notes, client_rate, client_referral, client_tax_id_number, + client_type, client_website FROM clients WHERE client_id = $client_id LIMIT 1"); $row = mysqli_fetch_assoc($sql); $client_name = escapeHtml($row['client_name']); @@ -132,7 +134,7 @@ ob_start(); '$client_created_at' OR category_archived_at IS NULL) ORDER BY category_name ASC"); + $referral_sql = mysqli_query($mysqli, "SELECT category_name FROM categories WHERE category_type = 'Referral' AND (category_archived_at > '$client_created_at' OR category_archived_at IS NULL) ORDER BY category_name ASC"); while ($row = mysqli_fetch_assoc($referral_sql)) { $referral = escapeHtml($row['category_name']); ?> @@ -175,7 +177,7 @@ ob_start(); '$item_created_at' OR tax_archived_at IS NULL) ORDER BY tax_name ASC"); + $taxes_sql = mysqli_query($mysqli, "SELECT tax_id, tax_name, tax_percent FROM taxes WHERE (tax_archived_at > '$item_created_at' OR tax_archived_at IS NULL) ORDER BY tax_name ASC"); while ($row = mysqli_fetch_assoc($taxes_sql)) { $tax_id_select = intval($row['tax_id']); $tax_name = escapeHtml($row['tax_name']); diff --git a/agent/modals/invoice/invoice_payments.php b/agent/modals/invoice/invoice_payments.php index 1cf98eae9..db3a4f34a 100644 --- a/agent/modals/invoice/invoice_payments.php +++ b/agent/modals/invoice/invoice_payments.php @@ -6,7 +6,8 @@ enforceUserPermission('module_sales'); $invoice_id = intval($_GET['invoice_id']); -$sql = mysqli_query($mysqli, "SELECT * FROM invoices WHERE invoice_id = $invoice_id LIMIT 1"); +$sql = mysqli_query($mysqli, "SELECT invoice_amount, invoice_client_id, invoice_currency_code, invoice_number, invoice_prefix, + invoice_status FROM invoices WHERE invoice_id = $invoice_id LIMIT 1"); $row = mysqli_fetch_assoc($sql); $invoice_prefix = escapeHtml($row['invoice_prefix']); $invoice_number = escapeHtml($row['invoice_number']); diff --git a/agent/modals/invoice/invoice_recurring_add.php b/agent/modals/invoice/invoice_recurring_add.php index 13cd43da2..edfc1bf85 100644 --- a/agent/modals/invoice/invoice_recurring_add.php +++ b/agent/modals/invoice/invoice_recurring_add.php @@ -4,7 +4,7 @@ require_once '../../../includes/modal_header.php'; $invoice_id = intval($_GET['invoice_id']); -$sql = mysqli_query($mysqli, "SELECT * FROM invoices WHERE invoice_id = $invoice_id LIMIT 1"); +$sql = mysqli_query($mysqli, "SELECT invoice_client_id, invoice_number, invoice_prefix FROM invoices WHERE invoice_id = $invoice_id LIMIT 1"); $row = mysqli_fetch_assoc($sql); $invoice_prefix = escapeHtml($row['invoice_prefix']); diff --git a/agent/modals/location/location_add.php b/agent/modals/location/location_add.php index d56ac6583..2f4dd74c3 100644 --- a/agent/modals/location/location_add.php +++ b/agent/modals/location/location_add.php @@ -246,7 +246,7 @@ ob_start(); '$item_created_at' OR tax_archived_at IS NULL) ORDER BY tax_name ASC"); + $taxes_sql = mysqli_query($mysqli, "SELECT tax_id, tax_name, tax_percent FROM taxes WHERE (tax_archived_at > '$item_created_at' OR tax_archived_at IS NULL) ORDER BY tax_name ASC"); while ($row = mysqli_fetch_assoc($taxes_sql)) { $tax_id_select = intval($row['tax_id']); $tax_name = escapeHtml($row['tax_name']); diff --git a/agent/modals/quote/quote_to_invoice.php b/agent/modals/quote/quote_to_invoice.php index 21d6a1412..6aed5fa3c 100644 --- a/agent/modals/quote/quote_to_invoice.php +++ b/agent/modals/quote/quote_to_invoice.php @@ -6,7 +6,7 @@ enforceUserPermission('module_sales', 2); $quote_id = intval($_GET['quote_id']); -$sql = mysqli_query($mysqli, "SELECT * FROM quotes WHERE quote_id = $quote_id LIMIT 1"); +$sql = mysqli_query($mysqli, "SELECT quote_client_id, quote_number, quote_prefix FROM quotes WHERE quote_id = $quote_id LIMIT 1"); $row = mysqli_fetch_assoc($sql); $quote_prefix = escapeHtml($row['quote_prefix']); diff --git a/agent/modals/rack/rack_device_add.php b/agent/modals/rack/rack_device_add.php index 860a6b0e2..0ef99ad86 100644 --- a/agent/modals/rack/rack_device_add.php +++ b/agent/modals/rack/rack_device_add.php @@ -4,7 +4,7 @@ require_once '../../../includes/modal_header.php'; $rack_id = intval($_GET['id']); -$sql = mysqli_query($mysqli, "SELECT * FROM racks WHERE rack_id = $rack_id LIMIT 1"); +$sql = mysqli_query($mysqli, "SELECT rack_client_id, rack_name FROM racks WHERE rack_id = $rack_id LIMIT 1"); $row = mysqli_fetch_assoc($sql); $rack_name = escapeHtml($row['rack_name']); diff --git a/agent/modals/rack/rack_edit.php b/agent/modals/rack/rack_edit.php index 1cf1732b7..f0cf435ed 100644 --- a/agent/modals/rack/rack_edit.php +++ b/agent/modals/rack/rack_edit.php @@ -6,7 +6,9 @@ enforceUserPermission('module_support', 2); $rack_id = intval($_GET['id']); -$sql = mysqli_query($mysqli, "SELECT * FROM racks WHERE rack_id = $rack_id LIMIT 1"); +$sql = mysqli_query($mysqli, "SELECT rack_client_id, rack_created_at, rack_depth, rack_description, rack_location_id, + rack_model, rack_name, rack_notes, rack_photo, rack_physical_location, rack_type, + rack_units FROM racks WHERE rack_id = $rack_id LIMIT 1"); $row = mysqli_fetch_assoc($sql); $rack_name = escapeHtml($row['rack_name']); diff --git a/agent/modals/recurring_expense/recurring_expense_edit.php b/agent/modals/recurring_expense/recurring_expense_edit.php index 9ffc7c441..92033284d 100644 --- a/agent/modals/recurring_expense/recurring_expense_edit.php +++ b/agent/modals/recurring_expense/recurring_expense_edit.php @@ -6,7 +6,12 @@ enforceUserPermission('module_financial', 2); $recurring_expense_id = intval($_GET['id']); -$sql = mysqli_query($mysqli, "SELECT * FROM recurring_expenses WHERE recurring_expense_id = $recurring_expense_id LIMIT 1"); +$sql = mysqli_query($mysqli, "SELECT recurring_expense_account_id, recurring_expense_amount, recurring_expense_category_id, + recurring_expense_client_id, recurring_expense_created_at, recurring_expense_currency_code, + recurring_expense_day, recurring_expense_description, recurring_expense_frequency, + recurring_expense_last_sent, recurring_expense_month, recurring_expense_next_date, + recurring_expense_payment_method, recurring_expense_reference, recurring_expense_status, + recurring_expense_vendor_id FROM recurring_expenses WHERE recurring_expense_id = $recurring_expense_id LIMIT 1"); $row = mysqli_fetch_assoc($sql); $recurring_expense_frequency = intval($row['recurring_expense_frequency']); diff --git a/agent/modals/recurring_invoice/recurring_invoice_add.php b/agent/modals/recurring_invoice/recurring_invoice_add.php index 0099a9a7c..54e4ffb38 100644 --- a/agent/modals/recurring_invoice/recurring_invoice_add.php +++ b/agent/modals/recurring_invoice/recurring_invoice_add.php @@ -92,7 +92,7 @@ ob_start(); - Category - '$recurring_invoice_created_at' OR category_archived_at IS NULL) ORDER BY category_name ASC"); + $sql_income_category = mysqli_query($mysqli, "SELECT category_id, category_name FROM categories WHERE category_type = 'Income' AND (category_archived_at > '$recurring_invoice_created_at' OR category_archived_at IS NULL) ORDER BY category_name ASC"); while ($row = mysqli_fetch_assoc($sql_income_category)) { $category_id_select = intval($row['category_id']); $category_name_select = escapeHtml($row['category_name']); diff --git a/agent/modals/recurring_invoice/recurring_invoice_item_edit.php b/agent/modals/recurring_invoice/recurring_invoice_item_edit.php index 756598c51..98165ce05 100644 --- a/agent/modals/recurring_invoice/recurring_invoice_item_edit.php +++ b/agent/modals/recurring_invoice/recurring_invoice_item_edit.php @@ -6,7 +6,8 @@ enforceUserPermission('module_sales', 2); $item_id = intval($_GET['id']); -$sql = mysqli_query($mysqli, "SELECT * FROM recurring_invoice_items LEFT JOIN recurring_invoices ON recurring_invoice_id = item_recurring_invoice_id WHERE item_id = $item_id LIMIT 1"); +$sql = mysqli_query($mysqli, "SELECT item_created_at, item_description, item_name, item_price, item_product_id, item_quantity, + item_tax_id, recurring_invoice_client_id FROM recurring_invoice_items LEFT JOIN recurring_invoices ON recurring_invoice_id = item_recurring_invoice_id WHERE item_id = $item_id LIMIT 1"); $row = mysqli_fetch_assoc($sql); $item_name = escapeHtml($row['item_name']); $item_description = escapeHtml($row['item_description']); @@ -87,7 +88,7 @@ ob_start(); - diff --git a/agent/modals/ticket/ticket_change_client.php b/agent/modals/ticket/ticket_change_client.php index 1e7a7141e..2d570be0c 100644 --- a/agent/modals/ticket/ticket_change_client.php +++ b/agent/modals/ticket/ticket_change_client.php @@ -6,7 +6,7 @@ enforceUserPermission('module_support', 2); $ticket_id = intval($_GET['ticket_id']); -$sql = mysqli_query($mysqli, "SELECT * FROM tickets WHERE ticket_id = $ticket_id LIMIT 1"); +$sql = mysqli_query($mysqli, "SELECT ticket_client_id, ticket_number, ticket_prefix FROM tickets WHERE ticket_id = $ticket_id LIMIT 1"); $row = mysqli_fetch_assoc($sql); $ticket_prefix = escapeHtml($row['ticket_prefix']); diff --git a/agent/modals/ticket/ticket_contact.php b/agent/modals/ticket/ticket_contact.php index ff1a94a26..e72ccc797 100644 --- a/agent/modals/ticket/ticket_contact.php +++ b/agent/modals/ticket/ticket_contact.php @@ -6,7 +6,7 @@ enforceUserPermission('module_support', 2); $ticket_id = intval($_GET['id']); -$sql = mysqli_query($mysqli, "SELECT * FROM tickets +$sql = mysqli_query($mysqli, "SELECT client_name, ticket_client_id, ticket_contact_id, ticket_number, ticket_prefix FROM tickets LEFT JOIN clients ON client_id = ticket_client_id WHERE ticket_id = $ticket_id LIMIT 1" diff --git a/agent/modals/ticket/ticket_edit.php b/agent/modals/ticket/ticket_edit.php index fa0535755..5a3b6b042 100644 --- a/agent/modals/ticket/ticket_edit.php +++ b/agent/modals/ticket/ticket_edit.php @@ -9,7 +9,10 @@ $access_permission_query_overide = clientScopeSql('ticket_client_id'); $ticket_id = intval($_GET['id']); -$sql = mysqli_query($mysqli, "SELECT * FROM tickets LEFT JOIN clients ON client_id = ticket_client_id WHERE ticket_id = $ticket_id $access_permission_query_overide LIMIT 1"); +$sql = mysqli_query($mysqli, "SELECT client_id, client_name, ticket_asset_id, ticket_assigned_to, ticket_billable, + ticket_category, ticket_contact_id, ticket_created_at, ticket_details, ticket_due_at, + ticket_location_id, ticket_number, ticket_prefix, ticket_priority, ticket_project_id, + ticket_subject, ticket_vendor_id, ticket_vendor_ticket_number FROM tickets LEFT JOIN clients ON client_id = ticket_client_id WHERE ticket_id = $ticket_id $access_permission_query_overide LIMIT 1"); $row = mysqli_fetch_assoc($sql); $client_id = intval($row['client_id']); diff --git a/agent/modals/ticket/ticket_edit_asset.php b/agent/modals/ticket/ticket_edit_asset.php index d9c75caa8..3644db2da 100644 --- a/agent/modals/ticket/ticket_edit_asset.php +++ b/agent/modals/ticket/ticket_edit_asset.php @@ -6,7 +6,7 @@ enforceUserPermission('module_support', 2); $ticket_id = intval($_GET['id']); -$sql = mysqli_query($mysqli, "SELECT * FROM tickets LEFT JOIN clients ON client_id = ticket_client_id WHERE ticket_id = $ticket_id LIMIT 1"); +$sql = mysqli_query($mysqli, "SELECT client_name, ticket_asset_id, ticket_client_id, ticket_number, ticket_prefix FROM tickets LEFT JOIN clients ON client_id = ticket_client_id WHERE ticket_id = $ticket_id LIMIT 1"); $row = mysqli_fetch_assoc($sql); $client_name = escapeHtml($row['client_name']); diff --git a/agent/modals/ticket/ticket_edit_project.php b/agent/modals/ticket/ticket_edit_project.php index d3880e04d..0fcc89c75 100644 --- a/agent/modals/ticket/ticket_edit_project.php +++ b/agent/modals/ticket/ticket_edit_project.php @@ -6,7 +6,7 @@ enforceUserPermission('module_support', 2); $ticket_id = intval($_GET['id']); -$sql = mysqli_query($mysqli, "SELECT * FROM tickets LEFT JOIN clients ON client_id = ticket_client_id WHERE ticket_id = $ticket_id LIMIT 1"); +$sql = mysqli_query($mysqli, "SELECT client_name, ticket_client_id, ticket_number, ticket_prefix, ticket_project_id FROM tickets LEFT JOIN clients ON client_id = ticket_client_id WHERE ticket_id = $ticket_id LIMIT 1"); $row = mysqli_fetch_assoc($sql); $client_name = escapeHtml($row['client_name']); diff --git a/agent/modals/ticket/ticket_edit_schedule.php b/agent/modals/ticket/ticket_edit_schedule.php index 579001886..ebb7d6cb1 100644 --- a/agent/modals/ticket/ticket_edit_schedule.php +++ b/agent/modals/ticket/ticket_edit_schedule.php @@ -6,7 +6,8 @@ enforceUserPermission('module_support', 2); $ticket_id = intval($_GET['ticket_id']); -$sql = mysqli_query($mysqli, "SELECT * FROM tickets +$sql = mysqli_query($mysqli, "SELECT client_name, ticket_client_id, ticket_number, ticket_onsite, ticket_prefix, + ticket_schedule FROM tickets LEFT JOIN clients ON client_id = ticket_client_id WHERE ticket_id = $ticket_id LIMIT 1" diff --git a/agent/modals/ticket/ticket_edit_vendor.php b/agent/modals/ticket/ticket_edit_vendor.php index f9bbc0e1a..33ce877e0 100644 --- a/agent/modals/ticket/ticket_edit_vendor.php +++ b/agent/modals/ticket/ticket_edit_vendor.php @@ -6,7 +6,7 @@ enforceUserPermission('module_support', 2); $ticket_id = intval($_GET['ticket_id']); -$sql = mysqli_query($mysqli, "SELECT * FROM tickets WHERE ticket_id = $ticket_id LIMIT 1"); +$sql = mysqli_query($mysqli, "SELECT ticket_client_id, ticket_number, ticket_prefix, ticket_vendor_id FROM tickets WHERE ticket_id = $ticket_id LIMIT 1"); $row = mysqli_fetch_assoc($sql); $ticket_prefix = escapeHtml($row['ticket_prefix']); diff --git a/agent/modals/ticket/ticket_invoice_add.php b/agent/modals/ticket/ticket_invoice_add.php index ae15e8174..f8118cebd 100644 --- a/agent/modals/ticket/ticket_invoice_add.php +++ b/agent/modals/ticket/ticket_invoice_add.php @@ -6,7 +6,12 @@ $ticket_id = intval($_GET['ticket_id']); $ticket_sql = mysqli_query( $mysqli, - "SELECT * FROM tickets + "SELECT asset_id, asset_name, asset_type, category_name, client_id, client_rate, contact_id, + contact_name, location_address, location_city, location_id, location_name, location_phone, + location_state, location_zip, ticket_assigned_to, ticket_billable, ticket_category, + ticket_created_at, ticket_created_by, ticket_first_response_at, ticket_number, + ticket_onsite, ticket_prefix, ticket_priority, ticket_quote_id, ticket_resolved_at, + ticket_subject, user_name FROM tickets LEFT JOIN clients ON ticket_client_id = client_id LEFT JOIN contacts ON ticket_contact_id = contact_id LEFT JOIN users ON ticket_assigned_to = user_id @@ -184,7 +189,7 @@ ob_start(); None - Method of Transfer - diff --git a/agent/modals/transfer/transfer_edit.php b/agent/modals/transfer/transfer_edit.php index 4a525f07d..c1f948de1 100644 --- a/agent/modals/transfer/transfer_edit.php +++ b/agent/modals/transfer/transfer_edit.php @@ -169,7 +169,7 @@ ob_start(); diff --git a/agent/modals/trip/trip_copy.php b/agent/modals/trip/trip_copy.php index 082629296..2a25b36e7 100644 --- a/agent/modals/trip/trip_copy.php +++ b/agent/modals/trip/trip_copy.php @@ -6,7 +6,8 @@ enforceUserPermission('module_financial', 2); $trip_id = intval($_GET['id']); -$sql = mysqli_query($mysqli, "SELECT * FROM trips WHERE trip_id = $trip_id LIMIT 1"); +$sql = mysqli_query($mysqli, "SELECT round_trip, trip_archived_at, trip_client_id, trip_created_at, trip_date, trip_destination, + trip_miles, trip_purpose, trip_source, trip_user_id FROM trips WHERE trip_id = $trip_id LIMIT 1"); $row = mysqli_fetch_assoc($sql); $trip_date = escapeHtml($row['trip_date']); diff --git a/agent/modals/trip/trip_edit.php b/agent/modals/trip/trip_edit.php index 51c97f80e..53275cf7b 100644 --- a/agent/modals/trip/trip_edit.php +++ b/agent/modals/trip/trip_edit.php @@ -6,7 +6,8 @@ enforceUserPermission('module_financial', 2); $trip_id = intval($_GET['id']); -$sql = mysqli_query($mysqli, "SELECT * FROM trips WHERE trip_id = $trip_id LIMIT 1"); +$sql = mysqli_query($mysqli, "SELECT round_trip, trip_archived_at, trip_client_id, trip_created_at, trip_date, trip_destination, + trip_miles, trip_purpose, trip_source, trip_user_id FROM trips WHERE trip_id = $trip_id LIMIT 1"); $row = mysqli_fetch_assoc($sql); $trip_date = escapeHtml($row['trip_date']); diff --git a/agent/modals/vendor/vendor.php b/agent/modals/vendor/vendor.php index c4a7f98ae..79039f7c7 100644 --- a/agent/modals/vendor/vendor.php +++ b/agent/modals/vendor/vendor.php @@ -6,7 +6,9 @@ enforceUserPermission('module_client'); $vendor_id = intval($_GET['id']); -$sql = mysqli_query($mysqli, "SELECT * FROM vendors WHERE vendor_id = $vendor_id LIMIT 1"); +$sql = mysqli_query($mysqli, "SELECT vendor_account_number, vendor_client_id, vendor_code, vendor_contact_name, + vendor_description, vendor_email, vendor_extension, vendor_hours, vendor_name, + vendor_notes, vendor_phone, vendor_sla, vendor_website FROM vendors WHERE vendor_id = $vendor_id LIMIT 1"); $row = mysqli_fetch_assoc($sql); $name = escapeHtml($row['vendor_name']); diff --git a/agent/modals/vendor/vendor_edit.php b/agent/modals/vendor/vendor_edit.php index 823116600..e79768fd1 100644 --- a/agent/modals/vendor/vendor_edit.php +++ b/agent/modals/vendor/vendor_edit.php @@ -6,7 +6,10 @@ enforceUserPermission('module_client', 2); $vendor_id = intval($_GET['id']); -$sql = mysqli_query($mysqli, "SELECT * FROM vendors WHERE vendor_id = $vendor_id LIMIT 1"); +$sql = mysqli_query($mysqli, "SELECT vendor_account_number, vendor_client_id, vendor_code, vendor_contact_name, + vendor_description, vendor_email, vendor_extension, vendor_hours, vendor_name, + vendor_notes, vendor_phone, vendor_phone_country_code, vendor_sla, vendor_template_id, + vendor_website FROM vendors WHERE vendor_id = $vendor_id LIMIT 1"); $row = mysqli_fetch_assoc($sql); $vendor_name = escapeHtml($row['vendor_name']); diff --git a/agent/post/asset.php b/agent/post/asset.php index 075ce5409..73d0919e6 100644 --- a/agent/post/asset.php +++ b/agent/post/asset.php @@ -387,7 +387,7 @@ if (isset($_POST['bulk_assign_asset_tags'])) { foreach($_POST['tags'] as $tag) { $tag = intval($tag); - $sql = mysqli_query($mysqli,"SELECT * FROM asset_tags WHERE asset_tag_asset_id = $asset_id AND asset_tag_tag_id = $tag"); + $sql = mysqli_query($mysqli,"SELECT 1 FROM asset_tags WHERE asset_tag_asset_id = $asset_id AND asset_tag_tag_id = $tag"); if (mysqli_num_rows($sql) == 0) { mysqli_query($mysqli, "INSERT INTO asset_tags SET asset_tag_asset_id = $asset_id, asset_tag_tag_id = $tag"); } @@ -1224,7 +1224,7 @@ if (isset($_POST["import_assets_csv"])) { if (!empty($column[8])) { $contact = escapeSql($column[8]); if ($contact) { - $sql_contact = mysqli_query($mysqli,"SELECT * FROM contacts WHERE contact_name = '$contact' AND contact_client_id = $client_id"); + $sql_contact = mysqli_query($mysqli,"SELECT contact_id FROM contacts WHERE contact_name = '$contact' AND contact_client_id = $client_id"); $row = mysqli_fetch_assoc($sql_contact); $contact_id = intval($row['contact_id']); } @@ -1234,7 +1234,7 @@ if (isset($_POST["import_assets_csv"])) { if (!empty($column[9])) { $location = escapeSql($column[9]); if ($location) { - $sql_location = mysqli_query($mysqli,"SELECT * FROM locations WHERE location_name = '$location' AND location_client_id = $client_id"); + $sql_location = mysqli_query($mysqli,"SELECT location_id FROM locations WHERE location_name = '$location' AND location_client_id = $client_id"); $row = mysqli_fetch_assoc($sql_location); $location_id = intval($row['location_id']); } @@ -1911,7 +1911,7 @@ if (isset($_POST["import_client_asset_interfaces_csv"])) { $file_name = $_FILES["file"]["tmp_name"]; // Get Asset Details for logging - $sql_asset = mysqli_query($mysqli,"SELECT * FROM assets WHERE asset_id = $asset_id"); + $sql_asset = mysqli_query($mysqli,"SELECT asset_client_id, asset_name FROM assets WHERE asset_id = $asset_id"); $row = mysqli_fetch_assoc($sql_asset); $client_id = intval($row['asset_client_id']); $asset_name = escapeSql($row['asset_name']); @@ -1989,7 +1989,7 @@ if (isset($_POST["import_client_asset_interfaces_csv"])) { if (!empty($column[7])) { $network = escapeSql($column[7]); if ($network) { - $sql_network = mysqli_query($mysqli,"SELECT * FROM networks WHERE network_name = '$network' AND network_archived_at IS NULL AND network_client_id = $client_id"); + $sql_network = mysqli_query($mysqli,"SELECT network_id FROM networks WHERE network_name = '$network' AND network_archived_at IS NULL AND network_client_id = $client_id"); $row = mysqli_fetch_assoc($sql_network); $network_id = intval($row['network_id']); } diff --git a/agent/post/client.php b/agent/post/client.php index 31ae1fc77..bff9b2dee 100644 --- a/agent/post/client.php +++ b/agent/post/client.php @@ -741,7 +741,7 @@ if (isset($_POST['bulk_add_client_ticket'])) { // Check to see if adding a ticket by template if($ticket_template_id) { - $sql = mysqli_query($mysqli, "SELECT * FROM ticket_templates WHERE ticket_template_id = $ticket_template_id"); + $sql = mysqli_query($mysqli, "SELECT ticket_template_details, ticket_template_subject FROM ticket_templates WHERE ticket_template_id = $ticket_template_id"); $row = mysqli_fetch_assoc($sql); // Override Template Subject @@ -751,7 +751,7 @@ if (isset($_POST['bulk_add_client_ticket'])) { $details = mysqli_escape_string($mysqli, $row['ticket_template_details']); // Get Associated Tasks from the ticket template - $sql_task_templates = mysqli_query($mysqli, "SELECT * FROM task_templates WHERE task_template_ticket_template_id = $ticket_template_id"); + $sql_task_templates = mysqli_query($mysqli, "SELECT task_template_name, task_template_order FROM task_templates WHERE task_template_ticket_template_id = $ticket_template_id"); } @@ -764,7 +764,7 @@ if (isset($_POST['bulk_add_client_ticket'])) { foreach ($_POST['client_ids'] as $client_id) { $client_id = intval($client_id); - $sql = mysqli_query($mysqli, "SELECT * FROM clients WHERE client_id = $client_id"); + $sql = mysqli_query($mysqli, "SELECT client_name FROM clients WHERE client_id = $client_id"); $row = mysqli_fetch_assoc($sql); $client_name = escapeSql($row['client_name']); @@ -992,7 +992,7 @@ if (isset($_POST['bulk_assign_client_tags'])) { foreach($_POST['bulk_tags'] as $tag) { $tag = intval($tag); - $sql = mysqli_query($mysqli,"SELECT * FROM client_tags WHERE client_id = $client_id AND tag_id = $tag"); + $sql = mysqli_query($mysqli,"SELECT 1 FROM client_tags WHERE client_id = $client_id AND tag_id = $tag"); if (mysqli_num_rows($sql) == 0) { mysqli_query($mysqli, "INSERT INTO client_tags SET client_id = $client_id, tag_id = $tag"); } @@ -1181,7 +1181,8 @@ if (isset($_POST["export_client_pdf"])) { enforceUserPermission("module_sales", 1); enforceUserPermission("module_financial", 1); - $sql = mysqli_query($mysqli, "SELECT * FROM companies, settings WHERE companies.company_id = settings.company_id AND companies.company_id = 1"); + $sql = mysqli_query($mysqli, "SELECT company_email, company_logo, company_name, company_phone, company_phone_country_code, + company_website FROM companies, settings WHERE companies.company_id = settings.company_id AND companies.company_id = 1"); $row = mysqli_fetch_assoc($sql); $company_name = escapeHtml($row['company_name']); $company_phone_country_code = escapeHtml($row['company_phone_country_code']); diff --git a/agent/post/contact.php b/agent/post/contact.php index 23cff00e9..ad1ff20cb 100644 --- a/agent/post/contact.php +++ b/agent/post/contact.php @@ -544,7 +544,7 @@ if (isset($_POST['bulk_assign_contact_tags'])) { foreach($_POST['bulk_tags'] as $tag) { $tag = intval($tag); - $sql = mysqli_query($mysqli,"SELECT * FROM contact_tags WHERE contact_id = $contact_id AND tag_id = $tag"); + $sql = mysqli_query($mysqli,"SELECT 1 FROM contact_tags WHERE contact_id = $contact_id AND tag_id = $tag"); if (mysqli_num_rows($sql) == 0) { mysqli_query($mysqli, "INSERT INTO contact_tags SET contact_id = $contact_id, tag_id = $tag"); } @@ -584,7 +584,7 @@ if (isset($_POST['send_bulk_mail_now'])) { foreach($_POST['contact_ids'] as $contact_id) { $contact_id = intval($contact_id); - $sql = mysqli_query($mysqli,"SELECT * FROM contacts WHERE contact_id = $contact_id"); + $sql = mysqli_query($mysqli,"SELECT contact_client_id, contact_email, contact_name FROM contacts WHERE contact_id = $contact_id"); $row = mysqli_fetch_assoc($sql); $contact_name = escapeSql($row['contact_name']); $contact_email = escapeSql($row['contact_email']); @@ -808,7 +808,7 @@ if (isset($_GET['anonymize_contact'])) { // Redact audit logs - $log_sql = mysqli_query($mysqli, "SELECT * FROM logs WHERE log_client_id = $client_id"); + $log_sql = mysqli_query($mysqli, "SELECT log_description, log_id FROM logs WHERE log_client_id = $client_id"); while ($log = mysqli_fetch_assoc($log_sql)) { $log_id = intval($log['log_id']); $description = $log['log_description']; @@ -1452,7 +1452,7 @@ if (isset($_POST["import_contacts_csv"])) { } if (isset($column[7])) { $location = escapeSql($column[7]); - $sql_location = mysqli_query($mysqli,"SELECT * FROM locations WHERE location_name = '$location' AND location_client_id = $client_id"); + $sql_location = mysqli_query($mysqli,"SELECT location_id FROM locations WHERE location_name = '$location' AND location_client_id = $client_id"); $row = mysqli_fetch_assoc($sql_location); $location_id = intval($row['location_id']); } diff --git a/agent/post/credential.php b/agent/post/credential.php index 22bfa502e..024d62a9d 100644 --- a/agent/post/credential.php +++ b/agent/post/credential.php @@ -194,7 +194,7 @@ if (isset($_POST['bulk_assign_credential_tags'])) { foreach($_POST['bulk_tags'] as $tag) { $tag = intval($tag); - $sql = mysqli_query($mysqli,"SELECT * FROM credential_tags WHERE credential_id = $credential_id AND tag_id = $tag"); + $sql = mysqli_query($mysqli,"SELECT 1 FROM credential_tags WHERE credential_id = $credential_id AND tag_id = $tag"); if (mysqli_num_rows($sql) == 0) { mysqli_query($mysqli, "INSERT INTO credential_tags SET credential_id = $credential_id, tag_id = $tag"); } diff --git a/agent/post/document.php b/agent/post/document.php index de29e063a..4d039bc16 100644 --- a/agent/post/document.php +++ b/agent/post/document.php @@ -70,7 +70,7 @@ if (isset($_POST['add_document_from_template'])) { // Get template $sql_document = mysqli_query( $mysqli, - "SELECT * FROM document_templates + "SELECT document_template_content, document_template_name FROM document_templates WHERE document_template_id = $document_template_id" ); @@ -154,7 +154,8 @@ if (isset($_POST['edit_document'])) { // 1) Load the current document to create a version $sql_original_document = mysqli_query( $mysqli, - "SELECT * FROM documents + "SELECT document_content, document_created_at, document_created_by, document_description, + document_name, document_updated_at, document_updated_by FROM documents WHERE document_client_id = $client_id AND document_id = $document_id" ); diff --git a/agent/post/domain.php b/agent/post/domain.php index 782674ecb..60adc8a43 100644 --- a/agent/post/domain.php +++ b/agent/post/domain.php @@ -207,7 +207,7 @@ if (isset($_GET['archive_domain'])) { $domain_id = intval($_GET['archive_domain']); //Get domain Name - $sql = mysqli_query($mysqli,"SELECT * FROM domains WHERE domain_id = $domain_id"); + $sql = mysqli_query($mysqli,"SELECT domain_client_id, domain_name FROM domains WHERE domain_id = $domain_id"); $row = mysqli_fetch_assoc($sql); $domain_name = escapeSql($row['domain_name']); $client_id = intval($row['domain_client_id']); diff --git a/agent/post/event.php b/agent/post/event.php index 449de8673..e1b9044f4 100644 --- a/agent/post/event.php +++ b/agent/post/event.php @@ -50,7 +50,7 @@ if (isset($_GET['delete_calendar'])) { $calendar_id = intval($_GET['delete_calendar']); // Get Calendar Name - $sql = mysqli_query($mysqli,"SELECT * FROM calendars WHERE calendar_id = $calendar_id"); + $sql = mysqli_query($mysqli,"SELECT calendar_name FROM calendars WHERE calendar_id = $calendar_id"); $row = mysqli_fetch_assoc($sql); $calendar_name = escapeSql($row['calendar_name']); @@ -192,7 +192,8 @@ if (isset($_POST['add_event'])) { $contact_name = escapeSql($row['contact_name']); $contact_email = escapeSql($row['contact_email']); - $sql_company = mysqli_query($mysqli,"SELECT * FROM companies WHERE company_id = 1"); + $sql_company = mysqli_query($mysqli,"SELECT company_address, company_city, company_country, company_email, company_logo, company_name, + company_phone, company_state, company_website, company_zip FROM companies WHERE company_id = 1"); $row = mysqli_fetch_assoc($sql_company); $company_name = escapeSql($row['company_name']); $company_country = escapeSql($row['company_country']); @@ -266,7 +267,8 @@ if (isset($_POST['edit_event'])) { $contact_name = escapeSql($row['contact_name']); $contact_email = escapeSql($row['contact_email']); - $sql_company = mysqli_query($mysqli,"SELECT * FROM companies WHERE company_id = 1"); + $sql_company = mysqli_query($mysqli,"SELECT company_address, company_city, company_country, company_email, company_logo, company_name, + company_phone, company_state, company_website, company_zip FROM companies WHERE company_id = 1"); $row = mysqli_fetch_assoc($sql_company); $company_name = escapeSql($row['company_name']); $company_country = escapeSql($row['company_country']); @@ -323,7 +325,7 @@ if (isset($_GET['delete_event'])) { $event_id = intval($_GET['delete_event']); // Get Event Title - $sql = mysqli_query($mysqli,"SELECT * FROM calendar_events WHERE event_id = $event_id"); + $sql = mysqli_query($mysqli,"SELECT event_client_id, event_title FROM calendar_events WHERE event_id = $event_id"); $row = mysqli_fetch_assoc($sql); $event_title = escapeSql($row['event_title']); $client_id = intval($row['event_client_id']); diff --git a/agent/post/expense.php b/agent/post/expense.php index a547dffcc..ce269108e 100644 --- a/agent/post/expense.php +++ b/agent/post/expense.php @@ -104,7 +104,7 @@ if (isset($_GET['delete_expense'])) { $expense_id = intval($_GET['delete_expense']); - $sql = mysqli_query($mysqli,"SELECT * FROM expenses WHERE expense_id = $expense_id"); + $sql = mysqli_query($mysqli,"SELECT expense_client_id, expense_description, expense_receipt FROM expenses WHERE expense_id = $expense_id"); $row = mysqli_fetch_assoc($sql); $expense_receipt = escapeSql($row['expense_receipt']); $expense_description = escapeSql($row['expense_description']); @@ -270,7 +270,7 @@ if (isset($_POST['bulk_delete_expenses'])) { $expense_id = intval($expense_id); - $sql = mysqli_query($mysqli,"SELECT * FROM expenses WHERE expense_id = $expense_id"); + $sql = mysqli_query($mysqli,"SELECT expense_client_id, expense_description, expense_receipt FROM expenses WHERE expense_id = $expense_id"); $row = mysqli_fetch_assoc($sql); $expense_description = escapeSql($row['expense_description']); $expense_receipt = escapeSql($row['expense_receipt']); diff --git a/agent/post/file.php b/agent/post/file.php index 5005f274c..f2d656e34 100644 --- a/agent/post/file.php +++ b/agent/post/file.php @@ -267,7 +267,7 @@ if (isset($_POST['bulk_archive_files'])) { $file_id = intval($file_id); - $sql_file = mysqli_query($mysqli,"SELECT * FROM files WHERE file_id = $file_id"); + $sql_file = mysqli_query($mysqli,"SELECT file_client_id, file_name FROM files WHERE file_id = $file_id"); $row = mysqli_fetch_assoc($sql_file); $client_id = intval($row['file_client_id']); $file_name = escapeSql($row['file_name']); @@ -411,7 +411,7 @@ if (isset($_POST['bulk_restore_files'])) { $file_id = intval($file_id); - $sql_file = mysqli_query($mysqli,"SELECT * FROM files WHERE file_id = $file_id"); + $sql_file = mysqli_query($mysqli,"SELECT file_client_id, file_name FROM files WHERE file_id = $file_id"); $row = mysqli_fetch_assoc($sql_file); $client_id = intval($row['file_client_id']); $file_name = escapeSql($row['file_name']); diff --git a/agent/post/invoice.php b/agent/post/invoice.php index c3d0b468e..3c5975966 100644 --- a/agent/post/invoice.php +++ b/agent/post/invoice.php @@ -103,7 +103,9 @@ if (isset($_POST['add_invoice_copy'])) { $date = escapeSql($_POST['date']); //Get Net Terms - $sql = mysqli_query($mysqli,"SELECT * FROM clients, invoices WHERE client_id = invoice_client_id AND invoice_id = $invoice_id"); + $sql = mysqli_query($mysqli,"SELECT client_net_terms, invoice_amount, invoice_category_id, invoice_client_id, + invoice_currency_code, invoice_discount_amount, invoice_note, invoice_number, + invoice_prefix, invoice_scope FROM clients, invoices WHERE client_id = invoice_client_id AND invoice_id = $invoice_id"); $row = mysqli_fetch_assoc($sql); $client_net_terms = intval($row['client_net_terms']); $invoice_scope = escapeSql($row['invoice_scope']); @@ -279,14 +281,14 @@ if (isset($_GET['delete_invoice'])) { } //Delete History Associated with the Invoice - $sql = mysqli_query($mysqli,"SELECT * FROM history WHERE history_invoice_id = $invoice_id"); + $sql = mysqli_query($mysqli,"SELECT history_id FROM history WHERE history_invoice_id = $invoice_id"); while($row = mysqli_fetch_assoc($sql)) { $history_id = intval($row['history_id']); mysqli_query($mysqli,"DELETE FROM history WHERE history_id = $history_id"); } //Delete Payments Associated with the Invoice - $sql = mysqli_query($mysqli,"SELECT * FROM payments WHERE payment_invoice_id = $invoice_id"); + $sql = mysqli_query($mysqli,"SELECT payment_id FROM payments WHERE payment_invoice_id = $invoice_id"); while($row = mysqli_fetch_assoc($sql)) { $payment_id = intval($row['payment_id']); mysqli_query($mysqli,"DELETE FROM payments WHERE payment_id = $payment_id"); @@ -353,7 +355,7 @@ if (isset($_POST['add_invoice_item'])) { // Tax if ($tax_id > 0) { - $sql = mysqli_query($mysqli,"SELECT * FROM taxes WHERE tax_id = $tax_id"); + $sql = mysqli_query($mysqli,"SELECT tax_percent FROM taxes WHERE tax_id = $tax_id"); $row = mysqli_fetch_assoc($sql); $tax_percent = floatval($row['tax_percent']); $tax_amount = $subtotal * $tax_percent / 100; @@ -366,7 +368,7 @@ if (isset($_POST['add_invoice_item'])) { mysqli_query($mysqli,"INSERT INTO invoice_items SET item_name = '$name', item_description = '$description', item_quantity = $qty, item_price = $price, item_subtotal = $subtotal, item_tax = $tax_amount, item_total = $total, item_order = $item_order, item_tax_id = $tax_id, item_product_id = $product_id, item_invoice_id = $invoice_id"); // Get Discount and Invoice Details - $sql = mysqli_query($mysqli,"SELECT * FROM invoices WHERE invoice_id = $invoice_id"); + $sql = mysqli_query($mysqli,"SELECT invoice_discount_amount, invoice_number, invoice_prefix FROM invoices WHERE invoice_id = $invoice_id"); $row = mysqli_fetch_assoc($sql); $invoice_prefix = escapeSql($row['invoice_prefix']); $invoice_number = intval($row['invoice_number']); @@ -401,7 +403,7 @@ if (isset($_POST['invoice_note'])) { $note = escapeSql($_POST['note']); // Get Invoice Details for logging - $sql = mysqli_query($mysqli,"SELECT * FROM invoices WHERE invoice_id = $invoice_id"); + $sql = mysqli_query($mysqli,"SELECT invoice_client_id, invoice_number, invoice_prefix FROM invoices WHERE invoice_id = $invoice_id"); $row = mysqli_fetch_assoc($sql); $invoice_prefix = escapeSql($row['invoice_prefix']); $invoice_number = intval($row['invoice_number']); @@ -436,7 +438,7 @@ if (isset($_POST['edit_invoice_item'])) { $subtotal = $price * $qty; if ($tax_id > 0) { - $sql = mysqli_query($mysqli,"SELECT * FROM taxes WHERE tax_id = $tax_id"); + $sql = mysqli_query($mysqli,"SELECT tax_percent FROM taxes WHERE tax_id = $tax_id"); $row = mysqli_fetch_assoc($sql); $tax_percent = floatval($row['tax_percent']); $tax_amount = $subtotal * $tax_percent / 100; @@ -452,7 +454,7 @@ if (isset($_POST['edit_invoice_item'])) { $invoice_id = intval($row['item_invoice_id']); //Get Discount Amount - $sql = mysqli_query($mysqli,"SELECT * FROM invoices WHERE invoice_id = $invoice_id"); + $sql = mysqli_query($mysqli,"SELECT invoice_client_id, invoice_discount_amount, invoice_number, invoice_prefix FROM invoices WHERE invoice_id = $invoice_id"); $row = mysqli_fetch_assoc($sql); $invoice_prefix = escapeSql($row['invoice_prefix']); $invoice_number = intval($row['invoice_number']); @@ -486,7 +488,8 @@ if (isset($_GET['delete_invoice_item'])) { $item_id = intval($_GET['delete_invoice_item']); - $sql = mysqli_query($mysqli,"SELECT * FROM invoice_items WHERE item_id = $item_id"); + $sql = mysqli_query($mysqli,"SELECT item_invoice_id, item_name, item_product_id, item_quantity, item_subtotal, item_tax, + item_total FROM invoice_items WHERE item_id = $item_id"); $row = mysqli_fetch_assoc($sql); $invoice_id = intval($row['item_invoice_id']); $item_name = escapeSql($row['item_name']); @@ -496,7 +499,7 @@ if (isset($_GET['delete_invoice_item'])) { $item_tax = floatval($row['item_tax']); $item_total = floatval($row['item_total']); - $sql = mysqli_query($mysqli,"SELECT * FROM invoices WHERE invoice_id = $invoice_id"); + $sql = mysqli_query($mysqli,"SELECT invoice_amount, invoice_client_id, invoice_number, invoice_prefix FROM invoices WHERE invoice_id = $invoice_id"); $row = mysqli_fetch_assoc($sql); $invoice_prefix = escapeSql($row['invoice_prefix']); $invoice_number = intval($row['invoice_number']); @@ -531,7 +534,9 @@ if (isset($_GET['email_invoice'])) { $invoice_id = intval($_GET['email_invoice']); - $sql = mysqli_query($mysqli,"SELECT * FROM invoices + $sql = mysqli_query($mysqli,"SELECT client_id, client_name, contact_email, contact_name, invoice_amount, invoice_currency_code, + invoice_date, invoice_due, invoice_id, invoice_number, invoice_prefix, invoice_scope, + invoice_status, invoice_url_key FROM invoices LEFT JOIN clients ON invoice_client_id = client_id LEFT JOIN contacts ON clients.client_id = contacts.contact_client_id AND contact_primary = 1 WHERE invoice_id = $invoice_id" @@ -555,7 +560,8 @@ if (isset($_GET['email_invoice'])) { enforceClientAccess(); - $sql = mysqli_query($mysqli,"SELECT * FROM companies WHERE company_id = 1"); + $sql = mysqli_query($mysqli,"SELECT company_address, company_city, company_country, company_email, company_logo, company_name, + company_phone, company_phone_country_code, company_state, company_website, company_zip FROM companies WHERE company_id = 1"); $row = mysqli_fetch_assoc($sql); $company_name = escapeSql($row['company_name']); @@ -819,7 +825,13 @@ if (isset($_GET['export_invoice_pdf'])) { $sql = mysqli_query( $mysqli, - "SELECT * FROM invoices + "SELECT client_currency_code, client_id, client_name, client_net_terms, client_website, + contact_email, contact_extension, contact_mobile, contact_mobile_country_code, + contact_phone, contact_phone_country_code, invoice_amount, invoice_category_id, + invoice_created_at, invoice_currency_code, invoice_date, invoice_discount_amount, + invoice_due, invoice_id, invoice_note, invoice_number, invoice_prefix, invoice_scope, + invoice_status, invoice_url_key, location_address, location_city, location_country, + location_state, location_zip FROM invoices LEFT JOIN clients ON invoice_client_id = client_id LEFT JOIN contacts ON clients.client_id = contacts.contact_client_id AND contact_primary = 1 LEFT JOIN locations ON clients.client_id = locations.location_client_id AND location_primary = 1 @@ -865,7 +877,9 @@ if (isset($_GET['export_invoice_pdf'])) { enforceClientAccess(); - $sql = mysqli_query($mysqli, "SELECT * FROM companies WHERE company_id = 1"); + $sql = mysqli_query($mysqli, "SELECT company_address, company_city, company_country, company_email, company_id, company_logo, + company_name, company_phone, company_phone_country_code, company_state, company_tax_id, + company_website, company_zip FROM companies WHERE company_id = 1"); $row = mysqli_fetch_assoc($sql); $company_id = intval($row['company_id']); $company_name = escapeHtml($row['company_name']); @@ -1048,7 +1062,9 @@ if (isset($_GET['export_invoice_packing_slip'])) { $sql = mysqli_query( $mysqli, - "SELECT * FROM invoices + "SELECT client_id, client_name, contact_email, contact_extension, contact_phone, + contact_phone_country_code, invoice_date, invoice_id, invoice_number, invoice_prefix, + location_address, location_city, location_country, location_state, location_zip FROM invoices LEFT JOIN clients ON invoice_client_id = client_id LEFT JOIN contacts ON clients.client_id = contacts.contact_client_id AND contact_primary = 1 LEFT JOIN locations ON clients.client_id = locations.location_client_id AND location_primary = 1 @@ -1076,7 +1092,9 @@ if (isset($_GET['export_invoice_packing_slip'])) { enforceClientAccess(); - $sql = mysqli_query($mysqli, "SELECT * FROM companies WHERE company_id = 1"); + $sql = mysqli_query($mysqli, "SELECT company_address, company_city, company_country, company_email, company_id, company_logo, + company_name, company_phone, company_phone_country_code, company_state, company_website, + company_zip FROM companies WHERE company_id = 1"); $row = mysqli_fetch_assoc($sql); $company_id = intval($row['company_id']); $company_name = escapeHtml($row['company_name']); @@ -1206,7 +1224,7 @@ if (isset($_POST['bulk_edit_invoice_category'])) { $invoice_id = intval($invoice_id); // Get Invoice Details for Logging - $sql = mysqli_query($mysqli,"SELECT * FROM invoices WHERE invoice_id = $invoice_id"); + $sql = mysqli_query($mysqli,"SELECT invoice_client_id, invoice_number, invoice_prefix, invoice_scope FROM invoices WHERE invoice_id = $invoice_id"); $row = mysqli_fetch_assoc($sql); $invoice_prefix = escapeSql($row['invoice_prefix']); $invoice_number = intval($row['invoice_number']); diff --git a/agent/post/location.php b/agent/post/location.php index 47773a8ba..6f4cb07cc 100644 --- a/agent/post/location.php +++ b/agent/post/location.php @@ -242,7 +242,7 @@ if (isset($_POST['bulk_assign_location_tags'])) { foreach($_POST['bulk_tags'] as $tag) { $tag = intval($tag); - $sql = mysqli_query($mysqli,"SELECT * FROM location_tags WHERE location_id = $location_id AND tag_id = $tag"); + $sql = mysqli_query($mysqli,"SELECT 1 FROM location_tags WHERE location_id = $location_id AND tag_id = $tag"); if (mysqli_num_rows($sql) == 0) { mysqli_query($mysqli, "INSERT INTO location_tags SET location_id = $location_id, tag_id = $tag"); } diff --git a/agent/post/payment.php b/agent/post/payment.php index 4c4a79647..83c2c2996 100644 --- a/agent/post/payment.php +++ b/agent/post/payment.php @@ -43,7 +43,9 @@ if (isset($_POST['add_payment'])) { $total_payments_amount = floatval($row['payments_amount']); //Get the invoice total - $sql = mysqli_query($mysqli,"SELECT * FROM invoices + $sql = mysqli_query($mysqli,"SELECT client_name, contact_email, contact_extension, contact_mobile, contact_mobile_country_code, + contact_name, contact_phone, contact_phone_country_code, invoice_amount, + invoice_currency_code, invoice_number, invoice_prefix, invoice_url_key FROM invoices LEFT JOIN clients ON invoice_client_id = client_id LEFT JOIN contacts ON clients.client_id = contacts.contact_client_id AND contact_primary = 1 WHERE invoice_id = $invoice_id" @@ -62,7 +64,8 @@ if (isset($_POST['add_payment'])) { $contact_extension = preg_replace("/[^0-9]/", '',$row['contact_extension']); $contact_mobile = escapeSql(formatPhoneNumber($row['contact_mobile'], $row['contact_mobile_country_code'])); - $sql = mysqli_query($mysqli,"SELECT * FROM companies WHERE company_id = 1"); + $sql = mysqli_query($mysqli,"SELECT company_address, company_city, company_country, company_email, company_logo, company_name, + company_phone, company_phone_country_code, company_state, company_website, company_zip FROM companies WHERE company_id = 1"); $row = mysqli_fetch_assoc($sql); $company_name = escapeSql($row['company_name']); @@ -218,7 +221,7 @@ if (isset($_POST['apply_credit'])) { $invoice_id = intval($_POST['invoice_id']); $credit_amount_applied = floatval($_POST['credit_amount_applied']); - $sql = mysqli_query($mysqli, "SELECT * FROM invoices LEFT JOIN clients ON invoice_client_id = client_id WHERE invoice_id = $invoice_id"); + $sql = mysqli_query($mysqli, "SELECT invoice_client_id, invoice_credit_amount, invoice_number, invoice_prefix, invoice_status FROM invoices LEFT JOIN clients ON invoice_client_id = client_id WHERE invoice_id = $invoice_id"); $row = mysqli_fetch_assoc($sql); $invoice_prefix = escapeSql($row['invoice_prefix']); @@ -329,7 +332,10 @@ if (isset($_POST['add_payment_stripe'])) { $saved_payment_id = intval($_POST['saved_payment_id']); // Get invoice details - $sql = mysqli_query($mysqli,"SELECT * FROM invoices + $sql = mysqli_query($mysqli,"SELECT client_id, client_name, contact_email, contact_extension, contact_mobile, + contact_mobile_country_code, contact_name, contact_phone, contact_phone_country_code, + invoice_amount, invoice_currency_code, invoice_number, invoice_prefix, invoice_status, + invoice_url_key FROM invoices LEFT JOIN clients ON invoice_client_id = client_id LEFT JOIN contacts ON client_id = contact_client_id AND contact_primary = 1 WHERE invoice_id = $invoice_id" @@ -353,7 +359,8 @@ if (isset($_POST['add_payment_stripe'])) { enforceClientAccess(); // Get ITFlow company details - $sql = mysqli_query($mysqli,"SELECT * FROM companies WHERE company_id = 1"); + $sql = mysqli_query($mysqli,"SELECT company_address, company_city, company_country, company_email, company_name, company_phone, + company_phone_country_code, company_state, company_website, company_zip FROM companies WHERE company_id = 1"); $row = mysqli_fetch_assoc($sql); $company_name = escapeSql($row['company_name']); $company_country = escapeSql($row['company_country']); @@ -370,7 +377,8 @@ if (isset($_POST['add_payment_stripe'])) { $config_invoice_from_email = escapeSql($config_invoice_from_email); // Get Client Payment Details - $sql = mysqli_query($mysqli, "SELECT * FROM client_saved_payment_methods LEFT JOIN payment_providers ON saved_payment_provider_id = payment_provider_id LEFT JOIN client_payment_provider ON saved_payment_client_id = client_id WHERE saved_payment_id = $saved_payment_id LIMIT 1"); + $sql = mysqli_query($mysqli, "SELECT payment_provider_account, payment_provider_client, payment_provider_private_key, + payment_provider_public_key, saved_payment_description, saved_payment_provider_method FROM client_saved_payment_methods LEFT JOIN payment_providers ON saved_payment_provider_id = payment_provider_id LEFT JOIN client_payment_provider ON saved_payment_client_id = client_id WHERE saved_payment_id = $saved_payment_id LIMIT 1"); $row = mysqli_fetch_assoc($sql); $public_key = escapeSql($row['payment_provider_public_key']); @@ -651,7 +659,7 @@ if (isset($_GET['delete_payment'])) { $payment_id = intval($_GET['delete_payment']); // payments has no client column - the client comes from the invoice the payment sits on - $sql = mysqli_query($mysqli,"SELECT * FROM payments + $sql = mysqli_query($mysqli,"SELECT invoice_client_id, invoice_number, invoice_prefix, payment_invoice_id FROM payments LEFT JOIN invoices ON payment_invoice_id = invoice_id WHERE payment_id = $payment_id LIMIT 1" diff --git a/agent/post/project.php b/agent/post/project.php index d55843961..66c7beec3 100644 --- a/agent/post/project.php +++ b/agent/post/project.php @@ -74,7 +74,7 @@ if (isset($_POST['add_project'])) { // Task Templates for Ticket template and add the to the ticket $sql_task_templates = mysqli_query($mysqli, - "SELECT * FROM task_templates WHERE task_template_ticket_template_id = $ticket_template_id"); + "SELECT task_template_id, task_template_name, task_template_order FROM task_templates WHERE task_template_ticket_template_id = $ticket_template_id"); $task_template_count = mysqli_num_rows($sql_task_templates); while ($row = mysqli_fetch_assoc($sql_task_templates)) { diff --git a/agent/post/quote.php b/agent/post/quote.php index ef0750221..b299160ea 100644 --- a/agent/post/quote.php +++ b/agent/post/quote.php @@ -79,7 +79,8 @@ if (isset($_POST['add_quote_copy'])) { $quote_number = mysqli_insert_id($mysqli); - $sql = mysqli_query($mysqli,"SELECT * FROM quotes WHERE quote_id = $quote_id"); + $sql = mysqli_query($mysqli,"SELECT quote_amount, quote_category_id, quote_currency_code, quote_discount_amount, quote_note, + quote_number, quote_prefix, quote_scope FROM quotes WHERE quote_id = $quote_id"); $row = mysqli_fetch_assoc($sql); $original_quote_prefix = escapeSql($row['quote_prefix']); $original_quote_number = escapeSql($row['quote_number']); @@ -135,7 +136,8 @@ if (isset($_POST['add_quote_to_invoice'])) { $quote_id = intval($_POST['quote_id']); $date = escapeSql($_POST['date']); - $sql = mysqli_query($mysqli,"SELECT * FROM clients, quotes WHERE client_id = quote_client_id AND quote_id = $quote_id"); + $sql = mysqli_query($mysqli,"SELECT client_net_terms, quote_amount, quote_category_id, quote_client_id, quote_currency_code, + quote_discount_amount, quote_note, quote_number, quote_prefix, quote_scope FROM clients, quotes WHERE client_id = quote_client_id AND quote_id = $quote_id"); $row = mysqli_fetch_assoc($sql); $client_net_terms = intval($row['client_net_terms']); $quote_prefix = escapeSql($row['quote_prefix']); @@ -241,7 +243,7 @@ if (isset($_POST['add_quote_item'])) { $subtotal = $price * $qty; if ($tax_id > 0) { - $sql = mysqli_query($mysqli,"SELECT * FROM taxes WHERE tax_id = $tax_id"); + $sql = mysqli_query($mysqli,"SELECT tax_percent FROM taxes WHERE tax_id = $tax_id"); $row = mysqli_fetch_assoc($sql); $tax_percent = floatval($row['tax_percent']); $tax_amount = $subtotal * $tax_percent / 100; @@ -254,7 +256,7 @@ if (isset($_POST['add_quote_item'])) { mysqli_query($mysqli,"INSERT INTO quote_items SET item_name = '$name', item_description = '$description', item_quantity = $qty, item_price = $price, item_subtotal = $subtotal, item_tax = $tax_amount, item_total = $total, item_tax_id = $tax_id, item_order = $item_order, item_quote_id = $quote_id"); // Get Quote Details - $sql = mysqli_query($mysqli,"SELECT * FROM quotes WHERE quote_id = $quote_id"); + $sql = mysqli_query($mysqli,"SELECT quote_client_id, quote_discount_amount, quote_number, quote_prefix FROM quotes WHERE quote_id = $quote_id"); $row = mysqli_fetch_assoc($sql); $quote_prefix = escapeSql($row['quote_prefix']); $quote_number = escapeSql($row['quote_number']); @@ -297,7 +299,7 @@ if (isset($_POST['edit_quote_item'])) { $subtotal = $price * $qty; if ($tax_id > 0) { - $sql = mysqli_query($mysqli,"SELECT * FROM taxes WHERE tax_id = $tax_id"); + $sql = mysqli_query($mysqli,"SELECT tax_percent FROM taxes WHERE tax_id = $tax_id"); $row = mysqli_fetch_assoc($sql); $tax_percent = floatval($row['tax_percent']); $tax_amount = $subtotal * $tax_percent / 100; @@ -313,7 +315,7 @@ if (isset($_POST['edit_quote_item'])) { $quote_id = intval($row['item_quote_id']); //Get Discount Amount - $sql = mysqli_query($mysqli,"SELECT * FROM quotes WHERE quote_id = $quote_id"); + $sql = mysqli_query($mysqli,"SELECT quote_client_id, quote_discount_amount, quote_number, quote_prefix FROM quotes WHERE quote_id = $quote_id"); $row = mysqli_fetch_assoc($sql); $quote_prefix = escapeSql($row['quote_prefix']); $quote_number = intval($row['quote_number']); @@ -349,7 +351,7 @@ if (isset($_POST['quote_note'])) { $note = escapeSql($_POST['note']); // Get Quote Details - $sql = mysqli_query($mysqli,"SELECT * FROM quotes WHERE quote_id = $quote_id"); + $sql = mysqli_query($mysqli,"SELECT quote_client_id, quote_number, quote_prefix FROM quotes WHERE quote_id = $quote_id"); $row = mysqli_fetch_assoc($sql); $quote_prefix = escapeSql($row['quote_prefix']); $quote_number = escapeSql($row['quote_number']); @@ -378,7 +380,7 @@ if (isset($_POST['edit_quote'])) { $quote_id = intval($_POST['quote_id']); // Get Quote Details for logging - $sql = mysqli_query($mysqli,"SELECT * FROM quotes WHERE quote_id = $quote_id"); + $sql = mysqli_query($mysqli,"SELECT quote_client_id, quote_number, quote_prefix FROM quotes WHERE quote_id = $quote_id"); $row = mysqli_fetch_assoc($sql); $quote_prefix = escapeSql($row['quote_prefix']); $quote_number = escapeSql($row['quote_number']); @@ -414,7 +416,7 @@ if (isset($_GET['delete_quote'])) { $quote_id = intval($_GET['delete_quote']); // Get Quote Details for logging - $sql = mysqli_query($mysqli,"SELECT * FROM quotes WHERE quote_id = $quote_id"); + $sql = mysqli_query($mysqli,"SELECT quote_client_id, quote_number, quote_prefix FROM quotes WHERE quote_id = $quote_id"); $row = mysqli_fetch_assoc($sql); $quote_prefix = escapeSql($row['quote_prefix']); $quote_number = escapeSql($row['quote_number']); @@ -432,7 +434,7 @@ if (isset($_GET['delete_quote'])) { } //Delete History Associated with the Quote - $sql = mysqli_query($mysqli,"SELECT * FROM history WHERE history_quote_id = $quote_id"); + $sql = mysqli_query($mysqli,"SELECT history_id FROM history WHERE history_quote_id = $quote_id"); while($row = mysqli_fetch_assoc($sql)) {; $history_id = intval($row['history_id']); mysqli_query($mysqli,"DELETE FROM history WHERE history_id = $history_id"); @@ -459,7 +461,7 @@ if (isset($_GET['delete_quote_item'])) { $item_id = intval($_GET['delete_quote_item']); - $sql = mysqli_query($mysqli,"SELECT * FROM quote_items WHERE item_id = $item_id"); + $sql = mysqli_query($mysqli,"SELECT item_name, item_quote_id, item_subtotal, item_tax, item_total FROM quote_items WHERE item_id = $item_id"); $row = mysqli_fetch_assoc($sql); $item_name = escapeSql($row['item_name']); $quote_id = intval($row['item_quote_id']); @@ -467,7 +469,7 @@ if (isset($_GET['delete_quote_item'])) { $item_tax = floatval($row['item_tax']); $item_total = floatval($row['item_total']); - $sql = mysqli_query($mysqli,"SELECT * FROM quotes WHERE quote_id = $quote_id"); + $sql = mysqli_query($mysqli,"SELECT quote_amount, quote_client_id, quote_number, quote_prefix FROM quotes WHERE quote_id = $quote_id"); $row = mysqli_fetch_assoc($sql); $quote_prefix = escapeSql($row['quote_prefix']); $quote_number = escapeSql($row['quote_number']); @@ -497,7 +499,7 @@ if (isset($_GET['mark_quote_sent'])) { $quote_id = intval($_GET['mark_quote_sent']); - $sql = mysqli_query($mysqli,"SELECT * FROM quotes WHERE quote_id = $quote_id"); + $sql = mysqli_query($mysqli,"SELECT quote_client_id, quote_number, quote_prefix FROM quotes WHERE quote_id = $quote_id"); $row = mysqli_fetch_assoc($sql); $quote_prefix = escapeSql($row['quote_prefix']); $quote_number = escapeSql($row['quote_number']); @@ -525,7 +527,7 @@ if (isset($_GET['accept_quote'])) { $quote_id = intval($_GET['accept_quote']); - $sql = mysqli_query($mysqli,"SELECT * FROM quotes WHERE quote_id = $quote_id"); + $sql = mysqli_query($mysqli,"SELECT quote_client_id, quote_number, quote_prefix FROM quotes WHERE quote_id = $quote_id"); $row = mysqli_fetch_assoc($sql); $quote_prefix = escapeSql($row['quote_prefix']); $quote_number = escapeSql($row['quote_number']); @@ -555,7 +557,7 @@ if (isset($_GET['decline_quote'])) { $quote_id = intval($_GET['decline_quote']); - $sql = mysqli_query($mysqli,"SELECT * FROM quotes WHERE quote_id = $quote_id"); + $sql = mysqli_query($mysqli,"SELECT quote_client_id, quote_number, quote_prefix FROM quotes WHERE quote_id = $quote_id"); $row = mysqli_fetch_assoc($sql); $quote_prefix = escapeSql($row['quote_prefix']); $quote_number = escapeSql($row['quote_number']); @@ -585,7 +587,9 @@ if (isset($_GET['email_quote'])) { $quote_id = intval($_GET['email_quote']); - $sql = mysqli_query($mysqli,"SELECT * FROM quotes + $sql = mysqli_query($mysqli,"SELECT client_id, client_name, contact_email, contact_name, quote_amount, quote_currency_code, + quote_date, quote_expire, quote_number, quote_prefix, quote_scope, quote_status, + quote_url_key FROM quotes LEFT JOIN clients ON quote_client_id = client_id LEFT JOIN contacts ON clients.client_id = contacts.contact_client_id AND contact_primary = 1 WHERE quote_id = $quote_id" @@ -608,7 +612,8 @@ if (isset($_GET['email_quote'])) { enforceClientAccess(); - $sql = mysqli_query($mysqli,"SELECT * FROM companies WHERE company_id = 1"); + $sql = mysqli_query($mysqli,"SELECT company_address, company_city, company_country, company_email, company_logo, company_name, + company_phone, company_phone_country_code, company_state, company_website, company_zip FROM companies WHERE company_id = 1"); $row = mysqli_fetch_assoc($sql); $company_name = escapeSql($row['company_name']); @@ -667,7 +672,7 @@ if (isset($_GET['mark_quote_invoiced'])) { $quote_id = intval($_GET['mark_quote_invoiced']); - $sql = mysqli_query($mysqli,"SELECT * FROM quotes WHERE quote_id = $quote_id"); + $sql = mysqli_query($mysqli,"SELECT quote_client_id, quote_number, quote_prefix FROM quotes WHERE quote_id = $quote_id"); $row = mysqli_fetch_assoc($sql); $quote_prefix = escapeSql($row['quote_prefix']); $quote_number = escapeSql($row['quote_number']); @@ -771,7 +776,12 @@ if (isset($_GET['export_quote_pdf'])) { $sql = mysqli_query( $mysqli, - "SELECT * FROM quotes + "SELECT client_currency_code, client_id, client_name, client_net_terms, client_website, + contact_email, contact_extension, contact_mobile, contact_mobile_country_code, + contact_phone, contact_phone_country_code, location_address, location_city, + location_country, location_state, location_zip, quote_amount, quote_category_id, + quote_created_at, quote_currency_code, quote_date, quote_discount_amount, quote_expire, + quote_id, quote_note, quote_number, quote_prefix, quote_scope, quote_status, quote_url_key FROM quotes LEFT JOIN clients ON quote_client_id = client_id LEFT JOIN contacts ON clients.client_id = contacts.contact_client_id AND contact_primary = 1 LEFT JOIN locations ON clients.client_id = locations.location_client_id AND location_primary = 1 @@ -817,7 +827,9 @@ if (isset($_GET['export_quote_pdf'])) { enforceClientAccess(); - $sql = mysqli_query($mysqli, "SELECT * FROM companies, settings WHERE companies.company_id = settings.company_id AND companies.company_id = 1"); + $sql = mysqli_query($mysqli, "SELECT company_address, company_city, company_country, company_email, settings.company_id, + company_logo, company_name, company_phone, company_phone_country_code, company_state, + company_website, company_zip FROM companies, settings WHERE companies.company_id = settings.company_id AND companies.company_id = 1"); $row = mysqli_fetch_assoc($sql); $company_id = intval($row['company_id']); diff --git a/agent/post/recurring_invoice.php b/agent/post/recurring_invoice.php index 0f9b182fe..e67b1aad5 100644 --- a/agent/post/recurring_invoice.php +++ b/agent/post/recurring_invoice.php @@ -15,7 +15,8 @@ if (isset($_POST['add_invoice_recurring'])) { $invoice_id = intval($_POST['invoice_id']); $recurring_invoice_frequency = validateRecurringFrequency($_POST['frequency']); - $sql = mysqli_query($mysqli,"SELECT * FROM invoices WHERE invoice_id = $invoice_id"); + $sql = mysqli_query($mysqli,"SELECT invoice_amount, invoice_category_id, invoice_client_id, invoice_currency_code, + invoice_date, invoice_note, invoice_number, invoice_prefix, invoice_scope FROM invoices WHERE invoice_id = $invoice_id"); $row = mysqli_fetch_assoc($sql); $invoice_prefix = escapeSql($row['invoice_prefix']); $invoice_number = intval($row['invoice_number']); @@ -182,7 +183,7 @@ if (isset($_GET['delete_recurring_invoice'])) { } //Delete History Associated with the Invoice - $sql = mysqli_query($mysqli,"SELECT * FROM history WHERE history_recurring_invoice_id = $recurring_invoice_id"); + $sql = mysqli_query($mysqli,"SELECT history_id FROM history WHERE history_recurring_invoice_id = $recurring_invoice_id"); while($row = mysqli_fetch_assoc($sql)) { $history_id = intval($row['history_id']); mysqli_query($mysqli,"DELETE FROM history WHERE history_id = $history_id"); @@ -217,7 +218,7 @@ if (isset($_POST['add_recurring_invoice_item'])) { $subtotal = $price * $qty; if ($tax_id > 0) { - $sql = mysqli_query($mysqli,"SELECT * FROM taxes WHERE tax_id = $tax_id"); + $sql = mysqli_query($mysqli,"SELECT tax_percent FROM taxes WHERE tax_id = $tax_id"); $row = mysqli_fetch_assoc($sql); $tax_percent = floatval($row['tax_percent']); $tax_amount = $subtotal * $tax_percent / 100; @@ -230,7 +231,8 @@ if (isset($_POST['add_recurring_invoice_item'])) { mysqli_query($mysqli,"INSERT INTO recurring_invoice_items SET item_name = '$name', item_description = '$description', item_quantity = $qty, item_price = $price, item_subtotal = $subtotal, item_tax = $tax_amount, item_total = $total, item_tax_id = $tax_id, item_order = $item_order, item_recurring_invoice_id = $recurring_invoice_id"); - $sql = mysqli_query($mysqli,"SELECT * FROM recurring_invoices WHERE recurring_invoice_id = $recurring_invoice_id"); + $sql = mysqli_query($mysqli,"SELECT recurring_invoice_client_id, recurring_invoice_discount_amount, recurring_invoice_number, + recurring_invoice_prefix FROM recurring_invoices WHERE recurring_invoice_id = $recurring_invoice_id"); $row = mysqli_fetch_assoc($sql); $recurring_invoice_discount = floatval($row['recurring_invoice_discount_amount']); $recurring_invoice_prefix = escapeSql($row['recurring_invoice_prefix']); @@ -273,7 +275,7 @@ if (isset($_POST['edit_recurring_invoice_item'])) { $subtotal = $price * $qty; if ($tax_id > 0) { - $sql = mysqli_query($mysqli,"SELECT * FROM taxes WHERE tax_id = $tax_id"); + $sql = mysqli_query($mysqli,"SELECT tax_percent FROM taxes WHERE tax_id = $tax_id"); $row = mysqli_fetch_assoc($sql); $tax_percent = floatval($row['tax_percent']); $tax_amount = $subtotal * $tax_percent / 100; @@ -289,7 +291,8 @@ if (isset($_POST['edit_recurring_invoice_item'])) { $recurring_invoice_id = intval($row['item_recurring_invoice_id']); //Get Discount Amount - $sql = mysqli_query($mysqli,"SELECT * FROM recurring_invoices WHERE recurring_invoice_id = $recurring_invoice_id"); + $sql = mysqli_query($mysqli,"SELECT recurring_invoice_client_id, recurring_invoice_discount_amount, recurring_invoice_number, + recurring_invoice_prefix FROM recurring_invoices WHERE recurring_invoice_id = $recurring_invoice_id"); $row = mysqli_fetch_assoc($sql); $recurring_invoice_prefix = escapeSql($row['recurring_invoice_prefix']); $recurring_invoice_number = intval($row['recurring_invoice_number']); @@ -352,7 +355,7 @@ if (isset($_GET['delete_recurring_invoice_item'])) { $item_id = intval($_GET['delete_recurring_invoice_item']); - $sql = mysqli_query($mysqli,"SELECT * FROM recurring_invoice_items WHERE item_id = $item_id"); + $sql = mysqli_query($mysqli,"SELECT item_name, item_recurring_invoice_id, item_subtotal, item_tax, item_total FROM recurring_invoice_items WHERE item_id = $item_id"); $row = mysqli_fetch_assoc($sql); $recurring_invoice_id = intval($row['item_recurring_invoice_id']); $item_name = escapeSql($row['item_name']); @@ -360,7 +363,8 @@ if (isset($_GET['delete_recurring_invoice_item'])) { $item_tax = floatval($row['item_tax']); $item_total = floatval($row['item_total']); - $sql = mysqli_query($mysqli,"SELECT * FROM recurring_invoices WHERE recurring_invoice_id = $recurring_invoice_id"); + $sql = mysqli_query($mysqli,"SELECT recurring_invoice_amount, recurring_invoice_client_id, recurring_invoice_number, + recurring_invoice_prefix FROM recurring_invoices WHERE recurring_invoice_id = $recurring_invoice_id"); $row = mysqli_fetch_assoc($sql); $recurring_invoice_prefix = escapeSql($row['recurring_invoice_prefix']); $recurring_invoice_number = intval($row['recurring_invoice_number']); @@ -390,7 +394,11 @@ if (isset($_GET['force_recurring'])) { $recurring_invoice_id = intval($_GET['force_recurring']); - $sql_recurring_invoices = mysqli_query($mysqli,"SELECT * FROM recurring_invoices, clients WHERE client_id = recurring_invoice_client_id AND recurring_invoice_id = $recurring_invoice_id"); + $sql_recurring_invoices = mysqli_query($mysqli,"SELECT client_net_terms, recurring_invoice_amount, recurring_invoice_category_id, + recurring_invoice_client_id, recurring_invoice_currency_code, + recurring_invoice_discount_amount, recurring_invoice_frequency, recurring_invoice_id, + recurring_invoice_last_sent, recurring_invoice_next_date, recurring_invoice_note, + recurring_invoice_scope, recurring_invoice_status FROM recurring_invoices, clients WHERE client_id = recurring_invoice_client_id AND recurring_invoice_id = $recurring_invoice_id"); $row = mysqli_fetch_assoc($sql_recurring_invoices); $recurring_invoice_id = intval($row['recurring_invoice_id']); @@ -442,7 +450,7 @@ if (isset($_GET['force_recurring'])) { //Recalculate Item Tax since Tax percents can change. if ($tax_id > 0) { - $sql = mysqli_query($mysqli,"SELECT * FROM taxes WHERE tax_id = $tax_id"); + $sql = mysqli_query($mysqli,"SELECT tax_percent FROM taxes WHERE tax_id = $tax_id"); $row = mysqli_fetch_assoc($sql); $tax_percent = floatval($row['tax_percent']); $item_tax_amount = $item_subtotal * $tax_percent / 100; @@ -493,7 +501,7 @@ if (isset($_GET['force_recurring'])) { $contact_extension = intval($row['contact_extension']); $contact_mobile = escapeSql(formatPhoneNumber($row['contact_mobile'], $row['contact_mobile_country_code'])); - $sql = mysqli_query($mysqli,"SELECT * FROM companies WHERE company_id = 1"); + $sql = mysqli_query($mysqli,"SELECT company_email, company_name, company_phone, company_phone_country_code, company_website FROM companies WHERE company_id = 1"); $row = mysqli_fetch_assoc($sql); $company_name = escapeSql($row['company_name']); $company_phone = escapeSql(formatPhoneNumber($row['company_phone'], $row['company_phone_country_code'])); @@ -559,7 +567,8 @@ if (isset($_POST['set_recurring_payment'])) { $saved_payment_id = intval($_POST['saved_payment_id']); // Get Recurring Invoice Info for logging and alerting - $sql = mysqli_query($mysqli, "SELECT * FROM recurring_invoices WHERE recurring_invoice_id = $recurring_invoice_id"); + $sql = mysqli_query($mysqli, "SELECT recurring_invoice_amount, recurring_invoice_client_id, recurring_invoice_currency_code, + recurring_invoice_number, recurring_invoice_prefix FROM recurring_invoices WHERE recurring_invoice_id = $recurring_invoice_id"); $row = mysqli_fetch_assoc($sql); $client_id = intval($row['recurring_invoice_client_id']); $recurring_invoice_prefix = escapeSql($row['recurring_invoice_prefix']); @@ -573,7 +582,8 @@ if (isset($_POST['set_recurring_payment'])) { // Get Payment provider and method $sql = mysqli_query($mysqli, " - SELECT * FROM payment_providers + SELECT payment_provider_account, payment_provider_id, payment_provider_name, + saved_payment_description FROM payment_providers LEFT JOIN client_saved_payment_methods ON saved_payment_provider_id = payment_provider_id WHERE saved_payment_id = $saved_payment_id "); @@ -703,7 +713,7 @@ if (isset($_GET['recurring_invoice_email_notify'])) { $recurring_invoice_email_notify = intval($_GET['recurring_invoice_email_notify']); $recurring_invoice_id = intval($_GET['recurring_invoice_id']); - $sql = mysqli_query($mysqli,"SELECT * FROM recurring_invoices WHERE recurring_invoice_id = $recurring_invoice_id"); + $sql = mysqli_query($mysqli,"SELECT recurring_invoice_client_id, recurring_invoice_number, recurring_invoice_prefix FROM recurring_invoices WHERE recurring_invoice_id = $recurring_invoice_id"); $row = mysqli_fetch_assoc($sql); $recurring_invoice_prefix = escapeSql($row['recurring_invoice_prefix']); $recurring_invoice_number = intval($row['recurring_invoice_number']); diff --git a/agent/post/recurring_ticket.php b/agent/post/recurring_ticket.php index b65081ea1..a77e90d11 100644 --- a/agent/post/recurring_ticket.php +++ b/agent/post/recurring_ticket.php @@ -100,7 +100,10 @@ if (isset($_POST['bulk_force_recurring_tickets'])) { foreach ($_POST['recurring_ticket_ids'] as $recurring_ticket_id) { $recurring_ticket_id = intval($recurring_ticket_id); - $sql = mysqli_query($mysqli, "SELECT * FROM recurring_tickets WHERE recurring_ticket_id = $recurring_ticket_id"); + $sql = mysqli_query($mysqli, "SELECT recurring_ticket_asset_id, recurring_ticket_assigned_to, recurring_ticket_billable, + recurring_ticket_category, recurring_ticket_client_id, recurring_ticket_contact_id, + recurring_ticket_created_by, recurring_ticket_details, recurring_ticket_frequency, + recurring_ticket_next_run, recurring_ticket_priority, recurring_ticket_subject FROM recurring_tickets WHERE recurring_ticket_id = $recurring_ticket_id"); if (mysqli_num_rows($sql) > 0) { $row = mysqli_fetch_assoc($sql); @@ -244,7 +247,10 @@ if (isset($_GET['force_recurring_ticket'])) { $recurring_ticket_id = intval($_GET['force_recurring_ticket']); - $sql = mysqli_query($mysqli, "SELECT * FROM recurring_tickets WHERE recurring_ticket_id = $recurring_ticket_id"); + $sql = mysqli_query($mysqli, "SELECT recurring_ticket_asset_id, recurring_ticket_assigned_to, recurring_ticket_billable, + recurring_ticket_category, recurring_ticket_client_id, recurring_ticket_contact_id, + recurring_ticket_created_by, recurring_ticket_details, recurring_ticket_frequency, + recurring_ticket_next_run, recurring_ticket_priority, recurring_ticket_subject FROM recurring_tickets WHERE recurring_ticket_id = $recurring_ticket_id"); if (mysqli_num_rows($sql) > 0) { $row = mysqli_fetch_assoc($sql); @@ -389,7 +395,7 @@ if (isset($_GET['delete_recurring_ticket'])) { $recurring_ticket_id = intval($_GET['delete_recurring_ticket']); // Get Scheduled Ticket Subject Ticket Prefix, Number and Client ID for logging and alert message - $sql = mysqli_query($mysqli, "SELECT * FROM recurring_tickets WHERE recurring_ticket_id = $recurring_ticket_id"); + $sql = mysqli_query($mysqli, "SELECT recurring_ticket_client_id, recurring_ticket_frequency, recurring_ticket_subject FROM recurring_tickets WHERE recurring_ticket_id = $recurring_ticket_id"); $row = mysqli_fetch_assoc($sql); $subject = escapeSql($row['recurring_ticket_subject']); $frequency = escapeSql($row['recurring_ticket_frequency']); @@ -424,7 +430,7 @@ if (isset($_POST['bulk_delete_recurring_tickets'])) { $recurring_ticket_id = intval($recurring_ticket_id); // Get Scheduled Ticket Subject Ticket Prefix, Number and Client ID for logging and alert message - $sql = mysqli_query($mysqli, "SELECT * FROM recurring_tickets WHERE recurring_ticket_id = $recurring_ticket_id"); + $sql = mysqli_query($mysqli, "SELECT recurring_ticket_client_id, recurring_ticket_frequency, recurring_ticket_subject FROM recurring_tickets WHERE recurring_ticket_id = $recurring_ticket_id"); $row = mysqli_fetch_assoc($sql); $subject = escapeSql($row['recurring_ticket_subject']); $frequency = escapeSql($row['recurring_ticket_frequency']); diff --git a/agent/post/software.php b/agent/post/software.php index f3d952527..cf75fcda3 100644 --- a/agent/post/software.php +++ b/agent/post/software.php @@ -19,7 +19,8 @@ if (isset($_POST['add_software_from_template'])) { enforceClientAccess(); // GET Software Template Info - $sql_software_templates = mysqli_query($mysqli,"SELECT * FROM software_templates WHERE software_template_id = $software_template_id"); + $sql_software_templates = mysqli_query($mysqli,"SELECT software_template_description, software_template_license_type, software_template_name, + software_template_notes, software_template_type, software_template_version FROM software_templates WHERE software_template_id = $software_template_id"); $row = mysqli_fetch_assoc($sql_software_templates); $name = escapeSql($row['software_template_name']); $version = escapeSql($row['software_template_version']); diff --git a/agent/post/task.php b/agent/post/task.php index 914839afa..cb49fac26 100644 --- a/agent/post/task.php +++ b/agent/post/task.php @@ -43,7 +43,7 @@ if (isset($_POST['edit_ticket_task'])) { $task_completion_estimate = intval($_POST['completion_estimate']); // Get Client ID - $sql = mysqli_query($mysqli, "SELECT * FROM tasks LEFT JOIN tickets ON ticket_id = task_ticket_id WHERE task_id = $task_id"); + $sql = mysqli_query($mysqli, "SELECT ticket_client_id FROM tasks LEFT JOIN tickets ON ticket_id = task_ticket_id WHERE task_id = $task_id"); $row = mysqli_fetch_assoc($sql); $client_id = intval($row['ticket_client_id']); enforceClientAccess(); @@ -88,7 +88,7 @@ if (isset($_GET['delete_task'])) { $task_id = intval($_GET['delete_task']); // Get Client ID, task name from tasks and tickets using the task_id - $sql = mysqli_query($mysqli, "SELECT * FROM tasks LEFT JOIN tickets ON ticket_id = task_ticket_id WHERE task_id = $task_id"); + $sql = mysqli_query($mysqli, "SELECT task_name, ticket_client_id FROM tasks LEFT JOIN tickets ON ticket_id = task_ticket_id WHERE task_id = $task_id"); $row = mysqli_fetch_assoc($sql); $client_id = intval($row['ticket_client_id']); enforceClientAccess(); @@ -113,7 +113,7 @@ if (isset($_GET['complete_task'])) { $task_id = intval($_GET['complete_task']); // Get Client ID - $sql = mysqli_query($mysqli, "SELECT * FROM tasks LEFT JOIN tickets ON ticket_id = task_ticket_id WHERE task_id = $task_id"); + $sql = mysqli_query($mysqli, "SELECT task_completion_estimate, task_name, ticket_client_id, ticket_id FROM tasks LEFT JOIN tickets ON ticket_id = task_ticket_id WHERE task_id = $task_id"); $row = mysqli_fetch_assoc($sql); $client_id = intval($row['ticket_client_id']); enforceClientAccess(); @@ -148,7 +148,7 @@ if (isset($_GET['undo_complete_task'])) { $task_id = intval($_GET['undo_complete_task']); // Get Client ID - $sql = mysqli_query($mysqli, "SELECT * FROM tasks LEFT JOIN tickets ON ticket_id = task_ticket_id WHERE task_id = $task_id"); + $sql = mysqli_query($mysqli, "SELECT task_name, ticket_client_id, ticket_id FROM tasks LEFT JOIN tickets ON ticket_id = task_ticket_id WHERE task_id = $task_id"); $row = mysqli_fetch_assoc($sql); $client_id = intval($row['ticket_client_id']); enforceClientAccess(); @@ -192,7 +192,8 @@ if (isset($_POST['add_ticket_task_approver'])) { // Task/Ticket Info $tt_row = mysqli_fetch_assoc(mysqli_query($mysqli, " - SELECT * FROM tasks + SELECT task_name, task_ticket_id, ticket_client_id, ticket_contact_id, ticket_number, + ticket_prefix, ticket_status_name, ticket_subject, ticket_url_key FROM tasks LEFT JOIN tickets ON ticket_id = task_ticket_id LEFT JOIN ticket_statuses ON ticket_status = ticket_status_id WHERE task_id = $task_id LIMIT 1 @@ -354,7 +355,8 @@ if (isset($_GET['approve_ticket_task'])) { $task_id = intval($_GET['approve_ticket_task']); $approval_id = intval($_GET['approval_id']); - $approval_row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT * FROM task_approvals LEFT JOIN tasks on task_id = approval_task_id WHERE approval_id = $approval_id AND approval_task_id = $task_id AND approval_scope = 'internal'")); + $approval_row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT approval_created_by, approval_required_user_id, approval_scope, approval_type, task_name, + task_ticket_id FROM task_approvals LEFT JOIN tasks on task_id = approval_task_id WHERE approval_id = $approval_id AND approval_task_id = $task_id AND approval_scope = 'internal'")); $task_name = escapeHtml($approval_row['task_name']); $scope = escapeHtml($approval_row['approval_scope']); diff --git a/agent/post/ticket.php b/agent/post/ticket.php index b1da09085..eb3bd0570 100644 --- a/agent/post/ticket.php +++ b/agent/post/ticket.php @@ -1171,7 +1171,7 @@ if (isset($_POST['bulk_edit_ticket_priority'])) { foreach ($_POST['ticket_ids'] as $ticket_id) { $ticket_id = intval($ticket_id); - $sql = mysqli_query($mysqli, "SELECT * FROM tickets WHERE ticket_id = $ticket_id"); + $sql = mysqli_query($mysqli, "SELECT ticket_client_id, ticket_number, ticket_prefix, ticket_priority, ticket_subject FROM tickets WHERE ticket_id = $ticket_id"); $row = mysqli_fetch_assoc($sql); $ticket_prefix = escapeSql($row['ticket_prefix']); @@ -1287,7 +1287,8 @@ if (isset($_POST['bulk_merge_tickets'])) { if ($ticket_id !== $merge_into_ticket_id) { - $sql = mysqli_query($mysqli, "SELECT * FROM tickets WHERE ticket_id = $ticket_id"); + $sql = mysqli_query($mysqli, "SELECT ticket_client_id, ticket_details, ticket_first_response_at, ticket_number, ticket_prefix, + ticket_priority, ticket_subject FROM tickets WHERE ticket_id = $ticket_id"); $row = mysqli_fetch_assoc($sql); $ticket_prefix = escapeSql($row['ticket_prefix']); @@ -1369,7 +1370,8 @@ if (isset($_POST['bulk_resolve_tickets'])) { // Count the Ticket Loop $ticket_count++; - $sql = mysqli_query($mysqli, "SELECT * FROM tickets WHERE ticket_id = $ticket_id"); + $sql = mysqli_query($mysqli, "SELECT ticket_client_id, ticket_first_response_at, ticket_number, ticket_prefix, ticket_priority, + ticket_subject, ticket_url_key FROM tickets WHERE ticket_id = $ticket_id"); $row = mysqli_fetch_assoc($sql); $ticket_prefix = escapeSql($row['ticket_prefix']); @@ -1509,7 +1511,8 @@ if (isset($_POST['bulk_ticket_reply'])) { foreach ($_POST['ticket_ids'] as $ticket_id) { $ticket_id = intval($ticket_id); - $sql = mysqli_query($mysqli, "SELECT * FROM tickets WHERE ticket_id = $ticket_id"); + $sql = mysqli_query($mysqli, "SELECT ticket_client_id, ticket_first_response_at, ticket_number, ticket_prefix, ticket_priority, + ticket_subject, ticket_url_key FROM tickets WHERE ticket_id = $ticket_id"); $row = mysqli_fetch_assoc($sql); $ticket_prefix = escapeSql($row['ticket_prefix']); @@ -1684,7 +1687,7 @@ if (isset($_POST['bulk_add_ticket_project'])) { foreach ($_POST['ticket_ids'] as $ticket_id) { $ticket_id = intval($ticket_id); - $sql = mysqli_query($mysqli, "SELECT * FROM tickets WHERE ticket_id = $ticket_id"); + $sql = mysqli_query($mysqli, "SELECT ticket_client_id, ticket_number, ticket_prefix, ticket_priority, ticket_subject FROM tickets WHERE ticket_id = $ticket_id"); $row = mysqli_fetch_assoc($sql); $ticket_prefix = escapeSql($row['ticket_prefix']); @@ -1737,7 +1740,7 @@ if (isset($_POST['bulk_add_asset_ticket'])) { // Check to see if adding a ticket by template if($ticket_template_id) { - $sql = mysqli_query($mysqli, "SELECT * FROM ticket_templates WHERE ticket_template_id = $ticket_template_id"); + $sql = mysqli_query($mysqli, "SELECT ticket_template_details, ticket_template_subject FROM ticket_templates WHERE ticket_template_id = $ticket_template_id"); $row = mysqli_fetch_assoc($sql); // Override Template Subject @@ -1756,7 +1759,7 @@ if (isset($_POST['bulk_add_asset_ticket'])) { foreach ($_POST['asset_ids'] as $asset_id) { $asset_id = intval($asset_id); - $sql = mysqli_query($mysqli, "SELECT * FROM assets WHERE asset_id = $asset_id"); + $sql = mysqli_query($mysqli, "SELECT asset_client_id, asset_name FROM assets WHERE asset_id = $asset_id"); $row = mysqli_fetch_assoc($sql); $asset_name = escapeSql($row['asset_name']); @@ -2301,7 +2304,7 @@ if (isset($_GET['resolve_ticket'])) { $ticket_id = intval($_GET['resolve_ticket']); - $sql = mysqli_query($mysqli, "SELECT * FROM tickets WHERE ticket_id = $ticket_id"); + $sql = mysqli_query($mysqli, "SELECT ticket_client_id, ticket_first_response_at, ticket_number, ticket_prefix FROM tickets WHERE ticket_id = $ticket_id"); $row = mysqli_fetch_assoc($sql); $ticket_prefix = escapeSql($row['ticket_prefix']); $ticket_number = intval($row['ticket_number']); @@ -2556,7 +2559,9 @@ if (isset($_POST['add_invoice_from_ticket'])) { $sql = mysqli_query( $mysqli, - "SELECT * FROM tickets + "SELECT asset_id, client_id, client_net_terms, contact_email, contact_id, contact_name, + location_name, ticket_category, ticket_closed_at, ticket_created_at, ticket_number, + ticket_prefix, ticket_subject, ticket_updated_at FROM tickets LEFT JOIN clients ON ticket_client_id = client_id LEFT JOIN contacts ON ticket_contact_id = contact_id LEFT JOIN assets ON ticket_asset_id = asset_id @@ -2626,7 +2631,7 @@ if (isset($_POST['add_invoice_from_ticket'])) { $subtotal = $price * $qty; if ($tax_id > 0) { - $sql = mysqli_query($mysqli, "SELECT * FROM taxes WHERE tax_id = $tax_id"); + $sql = mysqli_query($mysqli, "SELECT tax_percent FROM taxes WHERE tax_id = $tax_id"); $row = mysqli_fetch_assoc($sql); $tax_percent = floatval($row['tax_percent']); $tax_amount = $subtotal * $tax_percent / 100; @@ -2640,7 +2645,7 @@ if (isset($_POST['add_invoice_from_ticket'])) { //Update Invoice Balances - $sql = mysqli_query($mysqli, "SELECT * FROM invoices WHERE invoice_id = $invoice_id"); + $sql = mysqli_query($mysqli, "SELECT invoice_amount FROM invoices WHERE invoice_id = $invoice_id"); $row = mysqli_fetch_assoc($sql); $new_invoice_amount = floatval($row['invoice_amount']) + $total; @@ -2682,7 +2687,7 @@ if (isset($_POST['add_quote_from_ticket'])) { $subtotal = $price * $qty; $tax_amount = 0; if ($tax_id > 0) { - $sql = mysqli_query($mysqli, "SELECT * FROM taxes WHERE tax_id = $tax_id"); + $sql = mysqli_query($mysqli, "SELECT tax_percent FROM taxes WHERE tax_id = $tax_id"); $row = mysqli_fetch_assoc($sql); $tax_percent = floatval($row['tax_percent']); $tax_amount = $subtotal * $tax_percent / 100; @@ -3187,7 +3192,8 @@ if (isset($_GET['cancel_ticket_schedule'])) { //Send emails - $sql = mysqli_query($mysqli, "SELECT * FROM tickets + $sql = mysqli_query($mysqli, "SELECT client_name, contact_email, contact_name, ticket_client_id, ticket_details, ticket_number, + ticket_prefix, ticket_subject, user_email, user_name FROM tickets LEFT JOIN clients ON ticket_client_id = client_id LEFT JOIN contacts ON ticket_contact_id = contact_id LEFT JOIN locations on contact_location_id = location_id diff --git a/agent/post/transaction.php b/agent/post/transaction.php index 672094d5b..0cdd368c7 100644 --- a/agent/post/transaction.php +++ b/agent/post/transaction.php @@ -103,7 +103,7 @@ if (isset($_POST['export_transactions'])) { if ($account) { // Account details for the running balance and file name - $row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT * FROM accounts WHERE account_id = $account LIMIT 1")); + $row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT account_name, opening_balance FROM accounts WHERE account_id = $account LIMIT 1")); $account_name = $row['account_name']; $account_opening_balance = floatval($row['opening_balance']); diff --git a/agent/post/transfer.php b/agent/post/transfer.php index a67c6eb64..2b427bc60 100644 --- a/agent/post/transfer.php +++ b/agent/post/transfer.php @@ -78,7 +78,7 @@ if (isset($_GET['delete_transfer'])) { $transfer_id = intval($_GET['delete_transfer']); // Query the transfer ID to get the Payment and Expense IDs, so we can delete those as well - $row = mysqli_fetch_assoc(mysqli_query($mysqli,"SELECT * FROM transfers WHERE transfer_id = $transfer_id")); + $row = mysqli_fetch_assoc(mysqli_query($mysqli,"SELECT transfer_expense_id, transfer_revenue_id FROM transfers WHERE transfer_id = $transfer_id")); $expense_id = intval($row['transfer_expense_id']); $revenue_id = intval($row['transfer_revenue_id']); diff --git a/agent/post/trip.php b/agent/post/trip.php index 096a89938..86c6ec71a 100644 --- a/agent/post/trip.php +++ b/agent/post/trip.php @@ -65,7 +65,7 @@ if (isset($_GET['delete_trip'])) { $trip_id = intval($_GET['delete_trip']); // Get Trip Info and Client ID for logging - $row = mysqli_fetch_assoc(mysqli_query($mysqli,"SELECT * FROM trips WHERE trip_id = $trip_id")); + $row = mysqli_fetch_assoc(mysqli_query($mysqli,"SELECT trip_client_id, trip_destination, trip_source FROM trips WHERE trip_id = $trip_id")); $client_id = intval($row['trip_client_id']); $trip_source = escapeSql($row['trip_source']); $trip_destination = escapeSql($row['trip_destination']); diff --git a/agent/post/vendor.php b/agent/post/vendor.php index 6eadbf2b3..d263a7bb1 100644 --- a/agent/post/vendor.php +++ b/agent/post/vendor.php @@ -26,7 +26,10 @@ if (isset($_POST['add_vendor_from_template'])) { $vendor_template_id = intval($_POST['vendor_template_id']); //GET Vendor Info - $sql_vendor_templates = mysqli_query($mysqli,"SELECT * FROM vendor_templates WHERE vendor_template_id = $vendor_template_id"); + $sql_vendor_templates = mysqli_query($mysqli,"SELECT vendor_template_account_number, vendor_template_code, vendor_template_contact_name, + vendor_template_description, vendor_template_email, vendor_template_extension, + vendor_template_hours, vendor_template_name, vendor_template_notes, vendor_template_phone, + vendor_template_phone_country_code, vendor_template_sla, vendor_template_website FROM vendor_templates WHERE vendor_template_id = $vendor_template_id"); $row = mysqli_fetch_assoc($sql_vendor_templates); @@ -124,7 +127,7 @@ if (isset($_GET['archive_vendor'])) { $vendor_id = intval($_GET['archive_vendor']); //Get Vendor Name - $sql = mysqli_query($mysqli,"SELECT * FROM vendors WHERE vendor_id = $vendor_id"); + $sql = mysqli_query($mysqli,"SELECT vendor_client_id, vendor_name FROM vendors WHERE vendor_id = $vendor_id"); $row = mysqli_fetch_assoc($sql); $vendor_name = escapeSql($row['vendor_name']); $client_id = intval($row['vendor_client_id']); @@ -184,7 +187,7 @@ if (isset($_GET['delete_vendor'])) { $vendor_id = intval($_GET['delete_vendor']); //Get Vendor Name - $sql = mysqli_query($mysqli,"SELECT * FROM vendors WHERE vendor_id = $vendor_id"); + $sql = mysqli_query($mysqli,"SELECT vendor_client_id, vendor_name, vendor_template_id FROM vendors WHERE vendor_id = $vendor_id"); $row = mysqli_fetch_assoc($sql); $vendor_name = escapeSql($row['vendor_name']); $client_id = intval($row['vendor_client_id']); diff --git a/agent/project.php b/agent/project.php index 7a5d625c9..85e1b4531 100644 --- a/agent/project.php +++ b/agent/project.php @@ -26,7 +26,9 @@ if (isset($_GET['project_id'])) { $sql_project = mysqli_query( $mysqli, - "SELECT * FROM projects + "SELECT client_id, client_name, project_archived_at, project_completed_at, project_created_at, + project_description, project_due, project_id, project_name, project_number, project_prefix, + project_updated_at, user_id, user_name FROM projects LEFT JOIN clients ON project_client_id = client_id LEFT JOIN users ON project_manager = user_id WHERE project_id = $project_id diff --git a/agent/quote.php b/agent/quote.php index a5fa73a87..b9b8837de 100644 --- a/agent/quote.php +++ b/agent/quote.php @@ -16,7 +16,12 @@ if (isset($_GET['quote_id'])) { $sql = mysqli_query( $mysqli, - "SELECT * FROM quotes + "SELECT client_currency_code, client_id, client_name, client_net_terms, client_website, + contact_email, contact_extension, contact_mobile, contact_mobile_country_code, + contact_phone, contact_phone_country_code, location_address, location_city, + location_country, location_state, location_zip, quote_amount, quote_category_id, + quote_created_at, quote_currency_code, quote_date, quote_discount_amount, quote_expire, + quote_id, quote_note, quote_number, quote_prefix, quote_scope, quote_status, quote_url_key FROM quotes LEFT JOIN clients ON quote_client_id = client_id LEFT JOIN contacts ON clients.client_id = contacts.contact_client_id AND contact_primary = 1 LEFT JOIN locations ON clients.client_id = locations.location_client_id AND location_primary = 1 @@ -76,7 +81,9 @@ if (isset($_GET['quote_id'])) { $tab_title = $row['client_name']; $page_title = "{$row['quote_prefix']}{$row['quote_number']}"; - $sql = mysqli_query($mysqli, "SELECT * FROM companies, settings WHERE companies.company_id = settings.company_id AND companies.company_id = 1"); + $sql = mysqli_query($mysqli, "SELECT company_address, company_city, company_country, company_email, settings.company_id, + company_logo, company_name, company_phone, company_phone_country_code, company_state, + company_website, company_zip FROM companies, settings WHERE companies.company_id = settings.company_id AND companies.company_id = 1"); $row = mysqli_fetch_assoc($sql); $company_id = intval($row['company_id']); @@ -92,7 +99,7 @@ if (isset($_GET['quote_id'])) { $company_website = escapeHtml($row['company_website']); $company_logo = escapeHtml($row['company_logo']); - $sql_history = mysqli_query($mysqli, "SELECT * FROM history WHERE history_quote_id = $quote_id ORDER BY history_id DESC"); + $sql_history = mysqli_query($mysqli, "SELECT history_created_at, history_description, history_status FROM history WHERE history_quote_id = $quote_id ORDER BY history_id DESC"); //Set Badge color based off of quote status if ($quote_status == "Sent") { diff --git a/agent/recurring_invoice.php b/agent/recurring_invoice.php index 02028422a..a1fef0f17 100644 --- a/agent/recurring_invoice.php +++ b/agent/recurring_invoice.php @@ -15,7 +15,17 @@ if (isset($_GET['recurring_invoice_id'])) { $sql = mysqli_query( $mysqli, - "SELECT * FROM recurring_invoices + "SELECT client_currency_code, client_id, client_name, client_net_terms, client_website, + contact_email, contact_extension, contact_mobile, contact_mobile_country_code, + contact_phone, contact_phone_country_code, location_address, location_city, + location_country, location_state, location_zip, recurring_invoice_amount, + recurring_invoice_category_id, recurring_invoice_created_at, + recurring_invoice_currency_code, recurring_invoice_discount_amount, + recurring_invoice_email_notify, recurring_invoice_frequency, recurring_invoice_last_sent, + recurring_invoice_next_date, recurring_invoice_note, recurring_invoice_number, + recurring_invoice_prefix, recurring_invoice_scope, recurring_invoice_status, + recurring_payment_id, recurring_payment_method, recurring_payment_recurring_invoice_id, + recurring_payment_saved_payment_id FROM recurring_invoices LEFT JOIN clients ON recurring_invoice_client_id = client_id LEFT JOIN contacts ON clients.client_id = contacts.contact_client_id AND contact_primary = 1 LEFT JOIN locations ON clients.client_id = locations.location_client_id AND location_primary = 1 @@ -86,7 +96,9 @@ if (isset($_GET['recurring_invoice_id'])) { $tab_title = $row['client_name']; $page_title = "{$row['recurring_invoice_prefix']}{$row['recurring_invoice_number']}"; - $sql = mysqli_query($mysqli, "SELECT * FROM companies WHERE company_id = 1"); + $sql = mysqli_query($mysqli, "SELECT company_address, company_city, company_country, company_email, company_id, company_logo, + company_name, company_phone, company_phone_country_code, company_state, company_website, + company_zip FROM companies WHERE company_id = 1"); $row = mysqli_fetch_assoc($sql); $company_id = intval($row['company_id']); @@ -102,7 +114,7 @@ if (isset($_GET['recurring_invoice_id'])) { $company_website = escapeHtml($row['company_website']); $company_logo = escapeHtml($row['company_logo']); - $sql_history = mysqli_query($mysqli, "SELECT * FROM history WHERE history_recurring_invoice_id = $recurring_invoice_id ORDER BY history_id DESC"); + $sql_history = mysqli_query($mysqli, "SELECT history_created_at, history_description, history_status FROM history WHERE history_recurring_invoice_id = $recurring_invoice_id ORDER BY history_id DESC"); //Product autocomplete $products_sql = mysqli_query($mysqli, "SELECT product_name AS label, product_description AS description, product_price AS price, product_tax_id AS tax FROM products WHERE product_archived_at IS NULL"); @@ -150,7 +162,7 @@ if (isset($_GET['recurring_invoice_id'])) {
- 0) { ?>
diff --git a/agent/recurring_invoices.php b/agent/recurring_invoices.php index d68ed4415..9e89482c7 100644 --- a/agent/recurring_invoices.php +++ b/agent/recurring_invoices.php @@ -218,7 +218,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()")); - 0) { ?> diff --git a/agent/reports/expense_summary.php b/agent/reports/expense_summary.php index 698231712..0f4df0927 100644 --- a/agent/reports/expense_summary.php +++ b/agent/reports/expense_summary.php @@ -12,7 +12,7 @@ if (isset($_GET['year'])) { $sql_expense_years = mysqli_query($mysqli, "SELECT DISTINCT YEAR(expense_date) AS expense_year FROM expenses WHERE expense_category_id > 0 ORDER BY expense_year DESC"); -$sql_categories = mysqli_query($mysqli, "SELECT * FROM categories WHERE category_type = 'Expense' ORDER BY category_name ASC"); +$sql_categories = mysqli_query($mysqli, "SELECT category_id, category_name FROM categories WHERE category_type = 'Expense' ORDER BY category_name ASC"); // For chart Y-axis max $largest_expense_month = 0; diff --git a/agent/reports/income_summary.php b/agent/reports/income_summary.php index 0678c563e..642799f63 100644 --- a/agent/reports/income_summary.php +++ b/agent/reports/income_summary.php @@ -14,7 +14,7 @@ $sql_payment_years = mysqli_query($mysqli, "SELECT DISTINCT YEAR(payment_date) A UNION SELECT DISTINCT YEAR(revenue_date) AS payment_year FROM revenues ORDER BY payment_year DESC"); -$sql_categories = mysqli_query($mysqli, "SELECT * FROM categories WHERE category_type = 'Income' ORDER BY category_name ASC"); +$sql_categories = mysqli_query($mysqli, "SELECT category_id, category_name FROM categories WHERE category_type = 'Income' ORDER BY category_name ASC"); // Used for chart y-axis max calculation $largest_income_month = 0; diff --git a/agent/ticket.php b/agent/ticket.php index 41e21e73f..710b66e76 100644 --- a/agent/ticket.php +++ b/agent/ticket.php @@ -295,7 +295,7 @@ if (isset($_GET['ticket_id'])) { } // Get Watchers - $sql_ticket_watchers = mysqli_query($mysqli, "SELECT * FROM ticket_watchers WHERE watcher_ticket_id = $ticket_id ORDER BY watcher_email DESC"); + $sql_ticket_watchers = mysqli_query($mysqli, "SELECT watcher_email, watcher_id FROM ticket_watchers WHERE watcher_ticket_id = $ticket_id ORDER BY watcher_email DESC"); $watcher_count = mysqli_num_rows($sql_ticket_watchers); // Get Additional Assets @@ -306,7 +306,7 @@ if (isset($_GET['ticket_id'])) { ); // Get Tasks - $sql_tasks = mysqli_query($mysqli, "SELECT * FROM tasks WHERE task_ticket_id = $ticket_id ORDER BY task_order ASC, task_id ASC"); + $sql_tasks = mysqli_query($mysqli, "SELECT task_completed_at, task_completion_estimate, task_id, task_name FROM tasks WHERE task_ticket_id = $ticket_id ORDER BY task_order ASC, task_id ASC"); $task_count = mysqli_num_rows($sql_tasks); $completed_task_count = intval(mysqli_fetch_row(mysqli_query( diff --git a/agent/transactions.php b/agent/transactions.php index 8218257fe..f2f12f4bc 100644 --- a/agent/transactions.php +++ b/agent/transactions.php @@ -86,7 +86,7 @@ if ($sort == 'transaction_date') { if ($account_filter) { // Account details - opening balance feeds the running balance, currency feeds the summary - $row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT * FROM accounts WHERE account_id = $account_filter LIMIT 1")); + $row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT account_currency_code, opening_balance FROM accounts WHERE account_id = $account_filter LIMIT 1")); $account_currency_code = escapeHtml($row['account_currency_code']); $account_opening_balance = floatval($row['opening_balance']); diff --git a/agent/transfers.php b/agent/transfers.php index 6df181a35..409c1c88e 100644 --- a/agent/transfers.php +++ b/agent/transfers.php @@ -182,7 +182,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()")); $expense_id = intval($row['transfer_expense_id']); $revenue_id = intval($row['transfer_revenue_id']); - $sql_from = mysqli_query($mysqli, "SELECT * FROM accounts WHERE account_id = $transfer_account_from"); + $sql_from = mysqli_query($mysqli, "SELECT account_archived_at, account_name FROM accounts WHERE account_id = $transfer_account_from"); $row = mysqli_fetch_assoc($sql_from); $account_name_from = escapeHtml($row['account_name']); $account_from_archived_at = escapeHtml($row['account_archived_at']); @@ -192,7 +192,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()")); $account_from_archived_display = "Archived - "; } - $sql_to = mysqli_query($mysqli, "SELECT * FROM accounts WHERE account_id = $transfer_account_to"); + $sql_to = mysqli_query($mysqli, "SELECT account_archived_at, account_name FROM accounts WHERE account_id = $transfer_account_to"); $row = mysqli_fetch_assoc($sql_to); $account_name_to = escapeHtml($row['account_name']); $account_to_archived_at = escapeHtml($row['account_archived_at']); diff --git a/agent/user/user_activity.php b/agent/user/user_activity.php index 642646ab4..0a842e54e 100644 --- a/agent/user/user_activity.php +++ b/agent/user/user_activity.php @@ -2,12 +2,12 @@ require_once "includes/inc_all_user.php"; -$sql_recent_logins = mysqli_query($mysqli, "SELECT * FROM logs +$sql_recent_logins = mysqli_query($mysqli, "SELECT log_created_at, log_id, log_ip, log_user_agent FROM logs WHERE log_type = 'Login' OR log_type = 'Login 2FA' AND log_action = 'Success' AND log_user_id = $session_user_id ORDER BY log_id DESC LIMIT 3" ); -$sql_recent_logs = mysqli_query($mysqli, "SELECT * FROM logs +$sql_recent_logs = mysqli_query($mysqli, "SELECT log_action, log_created_at, log_description, log_id, log_type FROM logs WHERE log_user_id = $session_user_id AND log_type NOT LIKE 'Login' ORDER BY log_id DESC LIMIT 5" ); diff --git a/agent/user/user_security.php b/agent/user/user_security.php index 96193a74f..b2e89bcac 100644 --- a/agent/user/user_security.php +++ b/agent/user/user_security.php @@ -2,7 +2,7 @@ require_once "includes/inc_all_user.php"; // User remember me tokens -$sql_remember_tokens = mysqli_query($mysqli, "SELECT * FROM remember_tokens WHERE remember_token_user_id = $session_user_id"); +$sql_remember_tokens = mysqli_query($mysqli, "SELECT remember_token_created_at, remember_token_id FROM remember_tokens WHERE remember_token_user_id = $session_user_id"); $remember_token_count = mysqli_num_rows($sql_remember_tokens); ?> diff --git a/api/v1/assets/delete.php b/api/v1/assets/delete.php index 871e53c5f..e87e9caf0 100644 --- a/api/v1/assets/delete.php +++ b/api/v1/assets/delete.php @@ -12,7 +12,7 @@ $asset_id = intval($_POST['asset_id']); $delete_count = false; if (!empty($asset_id)) { - $row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT * FROM assets WHERE asset_id = $asset_id AND asset_client_id = $client_id LIMIT 1")); + $row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT asset_name FROM assets WHERE asset_id = $asset_id AND asset_client_id = $client_id LIMIT 1")); $asset_name = $row['asset_name']; $delete_sql = mysqli_query($mysqli, "DELETE FROM assets WHERE asset_id = $asset_id AND asset_client_id = $client_id LIMIT 1"); diff --git a/api/v1/contacts/create.php b/api/v1/contacts/create.php index 3079b7cc0..34b0a6b92 100644 --- a/api/v1/contacts/create.php +++ b/api/v1/contacts/create.php @@ -15,7 +15,7 @@ $insert_id = false; if (!empty($name) && !empty($email) && !empty($client_id)) { // Check contact with $email doesn't already exist - $email_duplication_sql = mysqli_query($mysqli, "SELECT * FROM contacts WHERE contact_email = '$email' AND contact_client_id = '$client_id'"); + $email_duplication_sql = mysqli_query($mysqli, "SELECT 1 FROM contacts WHERE contact_email = '$email' AND contact_client_id = '$client_id'"); if (mysqli_num_rows($email_duplication_sql) == 0) { diff --git a/api/v1/contacts/delete.php b/api/v1/contacts/delete.php index 8066fdd33..3332e2234 100644 --- a/api/v1/contacts/delete.php +++ b/api/v1/contacts/delete.php @@ -12,7 +12,7 @@ $contact_id = intval($_POST['contact_id']); $delete_count = false; if (!empty($contact_id)) { - $row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT * FROM contacts WHERE contact_id = $contact_id AND contact_client_id = $client_id LIMIT 1")); + $row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT contact_name FROM contacts WHERE contact_id = $contact_id AND contact_client_id = $client_id LIMIT 1")); $contact_name = $row['contact_name']; $delete_sql = mysqli_query($mysqli, "DELETE FROM contacts WHERE contact_id = $contact_id AND contact_client_id = $client_id LIMIT 1"); diff --git a/api/v1/documents/update.php b/api/v1/documents/update.php index 166a02128..8c845e8a4 100644 --- a/api/v1/documents/update.php +++ b/api/v1/documents/update.php @@ -14,7 +14,8 @@ if (!empty($document_id)) { // 1) Load the current document (scoped to this client) $sql_original_document = mysqli_query( $mysqli, - "SELECT * FROM documents + "SELECT document_content, document_created_at, document_created_by, document_description, + document_name, document_updated_at, document_updated_by FROM documents WHERE document_client_id = $client_id AND document_id = $document_id LIMIT 1" diff --git a/api/v1/tickets/resolve.php b/api/v1/tickets/resolve.php index 3790f0ec8..31be07310 100644 --- a/api/v1/tickets/resolve.php +++ b/api/v1/tickets/resolve.php @@ -15,7 +15,7 @@ $update_count = false; if (!empty($ticket_id)) { - $ticket_row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT * FROM tickets WHERE ticket_id = '$ticket_id' AND ticket_resolved_at IS NULL AND ticket_client_id = $client_id LIMIT 1")); + $ticket_row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT ticket_first_response_at, ticket_id, ticket_number, ticket_prefix FROM tickets WHERE ticket_id = '$ticket_id' AND ticket_resolved_at IS NULL AND ticket_client_id = $client_id LIMIT 1")); // Grab what we need, not using the model $ticket_id = intval($ticket_row['ticket_id']); // Override so things fail if this is bad diff --git a/api/v1/validate_api_key.php b/api/v1/validate_api_key.php index 2404bc8c5..98084ae88 100644 --- a/api/v1/validate_api_key.php +++ b/api/v1/validate_api_key.php @@ -70,7 +70,7 @@ if (isset($_POST['api_key'])) { if (isset($api_key)) { $api_key = escapeSql($api_key); - $sql = mysqli_query($mysqli, "SELECT * FROM api_keys WHERE api_key_secret = '$api_key' AND api_key_expire > NOW() LIMIT 1"); + $sql = mysqli_query($mysqli, "SELECT api_key_decrypt_hash, api_key_name, api_key_user_id FROM api_keys WHERE api_key_secret = '$api_key' AND api_key_expire > NOW() LIMIT 1"); // Failed if (mysqli_num_rows($sql) !== 1) { diff --git a/client/includes/check_login.php b/client/includes/check_login.php index 25fb5af86..223ab841c 100644 --- a/client/includes/check_login.php +++ b/client/includes/check_login.php @@ -25,7 +25,7 @@ $session_contact_id = intval($_SESSION['contact_id']); $session_user_id = intval($_SESSION['user_id']); // Load user session vars -$sql = mysqli_query($mysqli, "SELECT * FROM users WHERE users.user_id = $session_user_id"); +$sql = mysqli_query($mysqli, "SELECT user_archived_at, user_avatar, user_status, user_type FROM users WHERE users.user_id = $session_user_id"); $row = mysqli_fetch_assoc($sql); @@ -56,7 +56,7 @@ if ($session_user_archived_at !== null) { } // Load company session vars -$sql = mysqli_query($mysqli, "SELECT * FROM companies WHERE company_id = 1"); +$sql = mysqli_query($mysqli, "SELECT company_country, company_currency, company_locale, company_logo, company_name FROM companies WHERE company_id = 1"); $row = mysqli_fetch_assoc($sql); $session_company_name = $row['company_name']; @@ -67,7 +67,8 @@ $currency_format = numfmt_create($session_company_locale, NumberFormatter::CURRE $session_company_logo = $row['company_logo']; // Load contact session vars -$contact_sql = mysqli_query($mysqli, "SELECT * FROM contacts WHERE contact_id = $session_contact_id AND contact_client_id = $session_client_id"); +$contact_sql = mysqli_query($mysqli, "SELECT contact_billing, contact_email, contact_name, contact_photo, contact_pin, contact_primary, + contact_technical, contact_title FROM contacts WHERE contact_id = $session_contact_id AND contact_client_id = $session_client_id"); $contact = mysqli_fetch_assoc($contact_sql); $session_contact_name = escapeSql($contact['contact_name']); @@ -88,7 +89,7 @@ if ($contact['contact_billing'] == 1) { } // Load client session vars -$client_sql = mysqli_query($mysqli, "SELECT * FROM clients WHERE client_id = $session_client_id"); +$client_sql = mysqli_query($mysqli, "SELECT client_name FROM clients WHERE client_id = $session_client_id"); $client = mysqli_fetch_assoc($client_sql); $session_client_name = $client['client_name']; diff --git a/client/login_microsoft.php b/client/login_microsoft.php index 2c603b608..5a4179b86 100644 --- a/client/login_microsoft.php +++ b/client/login_microsoft.php @@ -126,7 +126,7 @@ if (isset($_GET['code']) || isset($_GET['error'])) { $upn = mysqli_real_escape_string($mysqli, $msgraph_response["userPrincipalName"]); - $sql = mysqli_query($mysqli, "SELECT * FROM users + $sql = mysqli_query($mysqli, "SELECT contact_client_id, contact_id, user_auth_method, user_email, user_id FROM users LEFT JOIN contacts ON user_id = contact_user_id LEFT JOIN clients ON contact_client_id = client_id WHERE user_email = '$upn' diff --git a/client/login_reset.php b/client/login_reset.php index 584fd105a..18bdbac9a 100644 --- a/client/login_reset.php +++ b/client/login_reset.php @@ -109,7 +109,7 @@ if ($_SERVER['REQUEST_METHOD'] == "POST") { $client = intval($_POST['client']); // Query user - $sql = mysqli_query($mysqli, "SELECT * FROM users LEFT JOIN contacts ON user_id = contact_user_id WHERE user_email = '$email' AND user_password_reset_token = '$token' AND contact_client_id = $client AND user_auth_method = 'local' AND user_type = 2 AND user_status = 1 AND user_archived_at IS NULL LIMIT 1"); + $sql = mysqli_query($mysqli, "SELECT contact_id, contact_name, user_id, user_password_reset_token FROM users LEFT JOIN contacts ON user_id = contact_user_id WHERE user_email = '$email' AND user_password_reset_token = '$token' AND contact_client_id = $client AND user_auth_method = 'local' AND user_type = 2 AND user_status = 1 AND user_archived_at IS NULL LIMIT 1"); $user_row = mysqli_fetch_assoc($sql); $contact_id = intval($user_row['contact_id']); $user_id = intval($user_row['user_id']); @@ -207,7 +207,7 @@ if ($_SERVER['REQUEST_METHOD'] == "POST") { $email = escapeSql($_GET['email']); $client = intval($_GET['client']); - $sql = mysqli_query($mysqli, "SELECT * FROM users LEFT JOIN contacts ON user_id = contact_user_id WHERE user_email = '$email' AND user_password_reset_token = '$token' AND contact_client_id = $client LIMIT 1"); + $sql = mysqli_query($mysqli, "SELECT user_password_reset_token FROM users LEFT JOIN contacts ON user_id = contact_user_id WHERE user_email = '$email' AND user_password_reset_token = '$token' AND contact_client_id = $client LIMIT 1"); $user_row = mysqli_fetch_assoc($sql); // Sanity check diff --git a/client/post.php b/client/post.php index 3b333d7bd..3f03302a7 100644 --- a/client/post.php +++ b/client/post.php @@ -111,7 +111,7 @@ if (isset($_POST['add_ticket_comment'])) { // Get ticket details & Notify the assigned tech (if any) - $ticket_details = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT * FROM tickets LEFT JOIN clients ON ticket_client_id = client_id WHERE ticket_id = $ticket_id LIMIT 1")); + $ticket_details = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT client_name, ticket_assigned_to, ticket_number, ticket_subject FROM tickets LEFT JOIN clients ON ticket_client_id = client_id WHERE ticket_id = $ticket_id LIMIT 1")); $ticket_number = intval($ticket_details['ticket_number']); $ticket_assigned_to = intval($ticket_details['ticket_assigned_to']); @@ -166,7 +166,8 @@ if (isset($_GET['approve_ticket_task'])) { $approval_id = intval($_GET['approval_id']); $url_key = escapeSql($_GET['approval_url_key']); - $approval_row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT * FROM task_approvals LEFT JOIN tasks on task_id = approval_task_id WHERE approval_id = $approval_id AND approval_task_id = $task_id AND approval_url_key = '$url_key' AND approval_status = 'pending' AND approval_scope = 'client'")); + $approval_row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT approval_created_by, approval_required_user_id, approval_scope, approval_type, task_name, + task_ticket_id FROM task_approvals LEFT JOIN tasks on task_id = approval_task_id WHERE approval_id = $approval_id AND approval_task_id = $task_id AND approval_url_key = '$url_key' AND approval_status = 'pending' AND approval_scope = 'client'")); $task_name = escapeHtml($approval_row['task_name']); $scope = escapeHtml($approval_row['approval_scope']); @@ -236,7 +237,7 @@ if (isset($_GET['resolve_ticket'])) { $ticket_id = intval($_GET['resolve_ticket']); // Get ticket details for logging - $row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT * FROM tickets WHERE ticket_id = $ticket_id LIMIT 1")); + $row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT ticket_number, ticket_prefix FROM tickets WHERE ticket_id = $ticket_id LIMIT 1")); $ticket_prefix = escapeSql($row['ticket_prefix']); $ticket_number = intval($row['ticket_number']); @@ -274,7 +275,7 @@ if (isset($_GET['reopen_ticket'])) { $ticket_id = intval($_GET['reopen_ticket']); // Get ticket details for logging - $row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT * FROM tickets WHERE ticket_id = $ticket_id LIMIT 1")); + $row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT ticket_number, ticket_prefix FROM tickets WHERE ticket_id = $ticket_id LIMIT 1")); $ticket_prefix = escapeSql($row['ticket_prefix']); $ticket_number = intval($row['ticket_number']); @@ -312,7 +313,7 @@ if (isset($_GET['close_ticket'])) { $ticket_id = intval($_GET['close_ticket']); // Get ticket details for logging - $row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT * FROM tickets WHERE ticket_id = $ticket_id LIMIT 1")); + $row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT ticket_number, ticket_prefix FROM tickets WHERE ticket_id = $ticket_id LIMIT 1")); $ticket_prefix = escapeSql($row['ticket_prefix']); $ticket_number = intval($row['ticket_number']); @@ -481,7 +482,10 @@ if (isset($_GET['add_payment_by_provider'])) { $saved_payment_id = intval($_GET['add_payment_by_provider']); // Get invoice details - $sql = mysqli_query($mysqli,"SELECT * FROM invoices + $sql = mysqli_query($mysqli,"SELECT client_id, client_name, contact_email, contact_extension, contact_mobile, + contact_mobile_country_code, contact_name, contact_phone, contact_phone_country_code, + invoice_amount, invoice_currency_code, invoice_number, invoice_prefix, invoice_status, + invoice_url_key FROM invoices LEFT JOIN clients ON invoice_client_id = client_id LEFT JOIN contacts ON client_id = contact_client_id AND contact_primary = 1 WHERE invoice_id = $invoice_id AND client_id = $session_client_id" @@ -503,7 +507,8 @@ if (isset($_GET['add_payment_by_provider'])) { $contact_mobile = escapeSql(formatPhoneNumber($row['contact_mobile'], $row['contact_mobile_country_code'])); // Get ITFlow company details - $sql = mysqli_query($mysqli,"SELECT * FROM companies WHERE company_id = 1"); + $sql = mysqli_query($mysqli,"SELECT company_address, company_city, company_country, company_email, company_name, company_phone, + company_phone_country_code, company_state, company_website, company_zip FROM companies WHERE company_id = 1"); $row = mysqli_fetch_assoc($sql); $company_name = escapeSql($row['company_name']); $company_country = escapeSql($row['company_country']); @@ -520,7 +525,9 @@ if (isset($_GET['add_payment_by_provider'])) { $config_invoice_from_email = escapeSql($config_invoice_from_email); // Get Client Payment Details - $sql = mysqli_query($mysqli, "SELECT * FROM client_saved_payment_methods LEFT JOIN payment_providers ON saved_payment_provider_id = payment_provider_id LEFT JOIN client_payment_provider ON saved_payment_client_id = client_id WHERE saved_payment_id = $saved_payment_id AND saved_payment_client_id = $session_client_id LIMIT 1"); + $sql = mysqli_query($mysqli, "SELECT payment_provider_account, payment_provider_client, payment_provider_private_key, + payment_provider_public_key, saved_payment_client_id, saved_payment_description, + saved_payment_provider_method FROM client_saved_payment_methods LEFT JOIN payment_providers ON saved_payment_provider_id = payment_provider_id LEFT JOIN client_payment_provider ON saved_payment_client_id = client_id WHERE saved_payment_id = $saved_payment_id AND saved_payment_client_id = $session_client_id LIMIT 1"); $row = mysqli_fetch_assoc($sql); $public_key = escapeSql($row['payment_provider_public_key']); @@ -671,7 +678,7 @@ if (isset($_POST['create_stripe_customer'])) { // Get Stripe provider $stripe_provider_result = mysqli_query($mysqli, " - SELECT * FROM payment_providers + SELECT payment_provider_id, payment_provider_private_key FROM payment_providers WHERE payment_provider_name = 'Stripe' AND payment_provider_active = 1 LIMIT 1 @@ -759,7 +766,7 @@ if (isset($_GET['create_stripe_checkout'])) { // Fetch Stripe provider info $stripe_provider_result = mysqli_query($mysqli, " - SELECT * FROM payment_providers + SELECT payment_provider_id, payment_provider_private_key FROM payment_providers WHERE payment_provider_name = 'Stripe' AND payment_provider_active = 1 LIMIT 1 @@ -842,7 +849,7 @@ if (isset($_GET['stripe_save_card'])) { // Get Stripe provider $stripe_provider_result = mysqli_query($mysqli, " - SELECT * FROM payment_providers + SELECT payment_provider_id, payment_provider_private_key FROM payment_providers WHERE payment_provider_name = 'Stripe' AND payment_provider_active = 1 LIMIT 1 @@ -925,7 +932,8 @@ if (isset($_GET['stripe_save_card'])) { // Email Confirmation $sql_settings = mysqli_query($mysqli, " - SELECT * FROM companies, settings + SELECT company_name, company_phone, company_phone_country_code, config_invoice_from_email, + config_invoice_from_name, config_smtp_host FROM companies, settings WHERE companies.company_id = settings.company_id AND companies.company_id = 1 "); @@ -973,7 +981,7 @@ if (isset($_GET['delete_saved_payment'])) { // Get Stripe provider info $stripe_provider_result = mysqli_query($mysqli, " - SELECT * FROM payment_providers + SELECT payment_provider_id, payment_provider_private_key FROM payment_providers WHERE payment_provider_name = 'Stripe' AND payment_provider_active = 1 LIMIT 1 @@ -1073,7 +1081,8 @@ if (isset($_POST['set_recurring_payment'])) { $saved_payment_id = intval($_POST['saved_payment_id']); // Get Recurring Invoice Info for logging and alerting - $sql = mysqli_query($mysqli, "SELECT * FROM recurring_invoices WHERE recurring_invoice_id = $recurring_invoice_id AND recurring_invoice_client_id = $session_client_id"); + $sql = mysqli_query($mysqli, "SELECT recurring_invoice_amount, recurring_invoice_currency_code, recurring_invoice_number, + recurring_invoice_prefix FROM recurring_invoices WHERE recurring_invoice_id = $recurring_invoice_id AND recurring_invoice_client_id = $session_client_id"); $row = mysqli_fetch_assoc($sql); $recurring_invoice_prefix = escapeSql($row['recurring_invoice_prefix']); $recurring_invoice_number = intval($row['recurring_invoice_number']); @@ -1084,7 +1093,8 @@ if (isset($_POST['set_recurring_payment'])) { // Get Payment provider and method $sql = mysqli_query($mysqli, " - SELECT * FROM payment_providers + SELECT payment_provider_account, payment_provider_id, payment_provider_name, + saved_payment_description FROM payment_providers LEFT JOIN client_saved_payment_methods ON saved_payment_provider_id = payment_provider_id WHERE saved_payment_id = $saved_payment_id AND saved_payment_client_id = $session_client_id diff --git a/client/recurring_invoices.php b/client/recurring_invoices.php index bdec469ea..a65b94d40 100644 --- a/client/recurring_invoices.php +++ b/client/recurring_invoices.php @@ -19,7 +19,7 @@ $recurring_invoices_sql = mysqli_query($mysqli, "SELECT * FROM recurring_invoice ); // Get Payment Provide Details -$payment_provider_sql = mysqli_query($mysqli, "SELECT * FROM payment_providers WHERE payment_provider_active = 1 LIMIT 1"); +$payment_provider_sql = mysqli_query($mysqli, "SELECT payment_provider_id, payment_provider_name, payment_provider_threshold FROM payment_providers WHERE payment_provider_active = 1 LIMIT 1"); $row = mysqli_fetch_assoc($payment_provider_sql); $payment_provider_id = intval($row['payment_provider_id']); $payment_provider_name = escapeHtml($row['payment_provider_name']); @@ -74,7 +74,7 @@ $payment_provider_threshold = floatval($row['payment_provider_threshold']); ly - 0) { ?> diff --git a/client/saved_payment_methods.php b/client/saved_payment_methods.php index 0f82c70e6..89b02c800 100644 --- a/client/saved_payment_methods.php +++ b/client/saved_payment_methods.php @@ -12,7 +12,7 @@ require_once '../includes/stripe_init.php'; // Get Stripe provider info $stripe_provider_query = mysqli_query($mysqli, " - SELECT * FROM payment_providers WHERE payment_provider_name = 'Stripe' LIMIT 1 + SELECT payment_provider_id, payment_provider_private_key, payment_provider_public_key FROM payment_providers WHERE payment_provider_name = 'Stripe' LIMIT 1 "); $stripe_provider = mysqli_fetch_assoc($stripe_provider_query); @@ -28,7 +28,7 @@ $stripe_secret_key = escapeHtml($stripe_provider['payment_provider_private_key'] // Get client's Stripe customer ID $stripe_customer_query = mysqli_query($mysqli, " - SELECT * FROM client_payment_provider + SELECT payment_provider_client FROM client_payment_provider WHERE client_id = $session_client_id AND payment_provider_id = $stripe_provider_id LIMIT 1 "); diff --git a/client/ticket.php b/client/ticket.php index 944039085..0b100a4a2 100644 --- a/client/ticket.php +++ b/client/ticket.php @@ -53,7 +53,7 @@ if (isset($_GET['id']) && intval($_GET['id'])) { // Get Ticket Attachments (not associated with a specific reply) $sql_ticket_attachments = mysqli_query( $mysqli, - "SELECT * FROM ticket_attachments + "SELECT ticket_attachment_id, ticket_attachment_name FROM ticket_attachments WHERE ticket_attachment_reply_id IS NULL AND ticket_attachment_ticket_id = $ticket_id" ); @@ -297,7 +297,7 @@ if (isset($_GET['id']) && intval($_GET['id'])) { // Get attachments for this reply $sql_ticket_reply_attachments = mysqli_query( $mysqli, - "SELECT * FROM ticket_attachments + "SELECT ticket_attachment_id, ticket_attachment_name FROM ticket_attachments WHERE ticket_attachment_reply_id = $ticket_reply_id AND ticket_attachment_ticket_id = $ticket_id" ); diff --git a/client/unpaid_invoices.php b/client/unpaid_invoices.php index 5aed26928..e509a8d29 100644 --- a/client/unpaid_invoices.php +++ b/client/unpaid_invoices.php @@ -17,7 +17,7 @@ $invoices_sql = mysqli_query($mysqli, "SELECT * FROM invoices WHERE invoice_clie // Payment Provider Active Query -$sql_payment_provider = mysqli_query($mysqli, "SELECT * FROM payment_providers WHERE payment_provider_active = 1 LIMIT 1;"); +$sql_payment_provider = mysqli_query($mysqli, "SELECT payment_provider_active, payment_provider_id, payment_provider_threshold FROM payment_providers WHERE payment_provider_active = 1 LIMIT 1;"); $row = mysqli_fetch_assoc($sql_payment_provider); $payment_provider_id = intval($row['payment_provider_id']); $payment_provider_active = intval($row['payment_provider_active']); @@ -25,7 +25,7 @@ $payment_provider_threshold = floatval($row['payment_provider_threshold']); // Saved Payment Methods $sql_saved_payment_methods = mysqli_query($mysqli, " - SELECT * FROM client_saved_payment_methods + SELECT payment_provider_name, saved_payment_description, saved_payment_id FROM client_saved_payment_methods LEFT JOIN payment_providers ON client_saved_payment_methods.saved_payment_provider_id = payment_providers.payment_provider_id WHERE saved_payment_client_id = $session_client_id @@ -156,7 +156,7 @@ $balance = $invoice_amounts - $amount_paid; NOW() LIMIT 1"); + $sql = mysqli_query($mysqli, "SELECT item_active, item_client_id, item_related_id, item_type, item_view_limit, item_views FROM shared_items WHERE item_id = $item_id AND item_key = '$item_key' AND item_expire_at > NOW() LIMIT 1"); $row = mysqli_fetch_assoc($sql); $item_active = intval($row['item_active']); @@ -49,7 +49,7 @@ if (isset($_GET['id']) && isset($_GET['key'])) { } } - $file_sql = mysqli_query($mysqli, "SELECT * FROM files WHERE file_id = $item_related_id AND file_client_id = $client_id LIMIT 1"); + $file_sql = mysqli_query($mysqli, "SELECT file_client_id, file_name, file_reference_name FROM files WHERE file_id = $item_related_id AND file_client_id = $client_id LIMIT 1"); $file_row = mysqli_fetch_assoc($file_sql); if (mysqli_num_rows($file_sql) !== 1 || !$file_row) { diff --git a/guest/guest_pay_invoice_stripe.php b/guest/guest_pay_invoice_stripe.php index bd01f16c9..adf94050b 100644 --- a/guest/guest_pay_invoice_stripe.php +++ b/guest/guest_pay_invoice_stripe.php @@ -5,7 +5,7 @@ require_once 'includes/inc_all_guest.php'; DEFINE("WORDING_PAYMENT_FAILED", "

There was an error verifying your payment. Please contact us for more information before attempting payment again.

"); // --- Get Stripe config from payment_providers table --- -$stripe_provider = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT * FROM payment_providers")); +$stripe_provider = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT payment_provider_account, payment_provider_private_key, payment_provider_public_key FROM payment_providers")); $stripe_publishable = escapeHtml($stripe_provider['payment_provider_public_key']); @@ -21,7 +21,9 @@ if (isset($_GET['invoice_id'], $_GET['url_key']) && !isset($_GET['payment_intent // Query invoice details $sql = mysqli_query( $mysqli, - "SELECT * FROM invoices + "SELECT client_id, client_name, invoice_amount, invoice_currency_code, invoice_date, + invoice_discount_amount, invoice_due, invoice_id, invoice_number, invoice_prefix, + invoice_status FROM invoices LEFT JOIN clients ON invoice_client_id = client_id WHERE invoice_id = $invoice_id AND invoice_url_key = '$invoice_url_key' @@ -182,7 +184,8 @@ if (isset($_GET['invoice_id'], $_GET['url_key']) && !isset($_GET['payment_intent // Get/Check invoice (& client/primary contact) $invoice_sql = mysqli_query( $mysqli, - "SELECT * FROM invoices + "SELECT client_id, client_name, contact_email, contact_name, invoice_amount, invoice_currency_code, + invoice_id, invoice_number, invoice_prefix, invoice_url_key FROM invoices LEFT JOIN clients ON invoice_client_id = client_id LEFT JOIN contacts ON clients.client_id = contacts.contact_client_id AND contact_primary = 1 WHERE invoice_id = $pi_invoice_id @@ -206,7 +209,7 @@ if (isset($_GET['invoice_id'], $_GET['url_key']) && !isset($_GET['payment_intent $contact_name = escapeSql($row['contact_name']); $contact_email = escapeSql($row['contact_email']); - $sql_company = mysqli_query($mysqli, "SELECT * FROM companies WHERE company_id = 1"); + $sql_company = mysqli_query($mysqli, "SELECT company_locale, company_name, company_phone FROM companies WHERE company_id = 1"); $row = mysqli_fetch_assoc($sql_company); $company_name = escapeSql($row['company_name']); $company_phone = escapeSql(formatPhoneNumber($row['company_phone'])); @@ -252,7 +255,8 @@ if (isset($_GET['invoice_id'], $_GET['url_key']) && !isset($_GET['payment_intent mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'Payment', log_action = 'Create', log_description = 'Stripe payment of $pi_currency $pi_amount_paid against invoice $invoice_prefix$invoice_number - $pi_id $extended_log_desc', log_ip = '$ip', log_user_agent = '$user_agent', log_client_id = $pi_client_id"); // Email Receipt - $sql_settings = mysqli_query($mysqli, "SELECT * FROM settings WHERE company_id = 1"); + $sql_settings = mysqli_query($mysqli, "SELECT config_invoice_from_email, config_invoice_from_name, + config_invoice_paid_notification_email, config_smtp_host FROM settings WHERE company_id = 1"); $settings = mysqli_fetch_assoc($sql_settings); $config_smtp_host = $settings['config_smtp_host']; diff --git a/guest/guest_post.php b/guest/guest_post.php index ec7a02f43..5dda1dce2 100644 --- a/guest/guest_post.php +++ b/guest/guest_post.php @@ -48,7 +48,9 @@ if (isset($_GET['accept_quote'], $_GET['url_key'])) { $row = mysqli_fetch_assoc($sql_company); $company_name = escapeSql($row['company_name']); - $sql_settings = mysqli_query($mysqli, "SELECT * FROM settings WHERE company_id = 1"); + $sql_settings = mysqli_query($mysqli, "SELECT config_quote_from_email, config_quote_from_name, config_quote_notification_email, + config_smtp_encryption, config_smtp_host, config_smtp_password, config_smtp_port, + config_smtp_username FROM settings WHERE company_id = 1"); $row = mysqli_fetch_assoc($sql_settings); $config_smtp_host = $row['config_smtp_host']; $config_smtp_port = intval($row['config_smtp_port']); @@ -121,7 +123,9 @@ if (isset($_GET['decline_quote'], $_GET['url_key'])) { $row = mysqli_fetch_assoc($sql_company); $company_name = escapeSql($row['company_name']); - $sql_settings = mysqli_query($mysqli, "SELECT * FROM settings WHERE company_id = 1"); + $sql_settings = mysqli_query($mysqli, "SELECT config_quote_from_email, config_quote_from_name, config_quote_notification_email, + config_smtp_encryption, config_smtp_host, config_smtp_password, config_smtp_port, + config_smtp_username FROM settings WHERE company_id = 1"); $row = mysqli_fetch_assoc($sql_settings); $config_smtp_host = $row['config_smtp_host']; $config_smtp_port = intval($row['config_smtp_port']); @@ -253,7 +257,8 @@ if (isset($_GET['approve_ticket_task'])) { $approval_id = intval($_GET['approval_id']); $url_key = escapeSql($_GET['approval_url_key']); - $approval_row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT * FROM task_approvals LEFT JOIN tasks on task_id = approval_task_id WHERE approval_id = $approval_id AND approval_task_id = $task_id AND approval_url_key = '$url_key' AND approval_status = 'pending'")); + $approval_row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT approval_created_by, approval_required_user_id, approval_scope, approval_type, task_name, + task_ticket_id FROM task_approvals LEFT JOIN tasks on task_id = approval_task_id WHERE approval_id = $approval_id AND approval_task_id = $task_id AND approval_url_key = '$url_key' AND approval_status = 'pending'")); $task_name = escapeHtml($approval_row['task_name']); $scope = escapeHtml($approval_row['approval_scope']); @@ -287,7 +292,12 @@ if (isset($_GET['export_quote_pdf'])) { $sql = mysqli_query( $mysqli, - "SELECT * FROM quotes + "SELECT client_currency_code, client_id, client_name, client_net_terms, client_website, + contact_email, contact_extension, contact_mobile, contact_mobile_country_code, + contact_phone, contact_phone_country_code, location_address, location_city, + location_country, location_state, location_zip, quote_amount, quote_category_id, + quote_created_at, quote_currency_code, quote_date, quote_discount_amount, quote_expire, + quote_id, quote_note, quote_number, quote_prefix, quote_scope, quote_status, quote_url_key FROM quotes LEFT JOIN clients ON quote_client_id = client_id LEFT JOIN contacts ON clients.client_id = contacts.contact_client_id AND contact_primary = 1 LEFT JOIN locations ON clients.client_id = locations.location_client_id AND location_primary = 1 @@ -332,7 +342,9 @@ if (isset($_GET['export_quote_pdf'])) { $client_net_terms = $config_default_net_terms; } - $sql = mysqli_query($mysqli, "SELECT * FROM companies, settings WHERE companies.company_id = settings.company_id AND companies.company_id = 1"); + $sql = mysqli_query($mysqli, "SELECT company_address, company_city, company_country, company_email, settings.company_id, + company_locale, company_logo, company_name, company_phone, company_phone_country_code, + company_state, company_website, company_zip FROM companies, settings WHERE companies.company_id = settings.company_id AND companies.company_id = 1"); $row = mysqli_fetch_assoc($sql); $company_id = intval($row['company_id']); @@ -488,7 +500,13 @@ if (isset($_GET['export_invoice_pdf'])) { $sql = mysqli_query( $mysqli, - "SELECT * FROM invoices + "SELECT client_currency_code, client_id, client_name, client_net_terms, client_website, + contact_email, contact_extension, contact_mobile, contact_mobile_country_code, + contact_phone, contact_phone_country_code, invoice_amount, invoice_category_id, + invoice_created_at, invoice_currency_code, invoice_date, invoice_discount_amount, + invoice_due, invoice_id, invoice_note, invoice_number, invoice_prefix, invoice_scope, + invoice_status, invoice_url_key, location_address, location_city, location_country, + location_state, location_zip FROM invoices LEFT JOIN clients ON invoice_client_id = client_id LEFT JOIN contacts ON clients.client_id = contacts.contact_client_id AND contact_primary = 1 LEFT JOIN locations ON clients.client_id = locations.location_client_id AND location_primary = 1 @@ -533,7 +551,9 @@ if (isset($_GET['export_invoice_pdf'])) { $client_net_terms = $config_default_net_terms; } - $sql = mysqli_query($mysqli, "SELECT * FROM companies WHERE company_id = 1"); + $sql = mysqli_query($mysqli, "SELECT company_address, company_city, company_country, company_email, company_id, company_locale, + company_logo, company_name, company_phone, company_phone_country_code, company_state, + company_tax_id, company_website, company_zip FROM companies WHERE company_id = 1"); $row = mysqli_fetch_assoc($sql); $company_id = intval($row['company_id']); $company_name = escapeHtml($row['company_name']); @@ -757,7 +777,7 @@ if (isset($_POST['guest_quote_upload_file'])) { $dest_path = $upload_file_dir . $file_reference_name; // Get/Create a top-level folder called Client Uploads - $folder_sql = mysqli_query($mysqli, "SELECT * FROM folders WHERE folder_name = 'Client Uploads' AND parent_folder = 0 AND folder_client_id = $client_id LIMIT 1"); + $folder_sql = mysqli_query($mysqli, "SELECT folder_id FROM folders WHERE folder_name = 'Client Uploads' AND parent_folder = 0 AND folder_client_id = $client_id LIMIT 1"); if (mysqli_num_rows($folder_sql) == 1) { // Get $row = mysqli_fetch_assoc($folder_sql); diff --git a/guest/guest_view_invoice.php b/guest/guest_view_invoice.php index 993a200b6..62a03ff31 100644 --- a/guest/guest_view_invoice.php +++ b/guest/guest_view_invoice.php @@ -14,7 +14,12 @@ $invoice_id = intval($_GET['invoice_id']); $sql = mysqli_query( $mysqli, - "SELECT * FROM invoices + "SELECT client_currency_code, client_id, client_name, client_net_terms, client_website, + contact_email, contact_extension, contact_mobile, contact_mobile_country_code, + contact_phone, contact_phone_country_code, invoice_amount, invoice_category_id, + invoice_currency_code, invoice_date, invoice_discount_amount, invoice_due, invoice_id, + invoice_note, invoice_number, invoice_prefix, invoice_status, location_address, + location_city, location_country, location_state, location_zip FROM invoices LEFT JOIN clients ON invoice_client_id = client_id LEFT JOIN locations ON clients.client_id = locations.location_client_id AND location_primary = 1 LEFT JOIN contacts ON clients.client_id = contacts.contact_client_id AND contact_primary = 1 @@ -61,7 +66,9 @@ $client_website = escapeHtml($row['client_website']); $client_currency_code = escapeHtml($row['client_currency_code']); $client_net_terms = intval($row['client_net_terms']); -$sql = mysqli_query($mysqli, "SELECT * FROM companies, settings WHERE companies.company_id = settings.company_id AND companies.company_id = 1"); +$sql = mysqli_query($mysqli, "SELECT company_address, company_city, company_country, company_email, company_locale, + company_logo, company_name, company_phone, company_phone_country_code, company_state, + company_tax_id, company_website, company_zip, config_invoice_footer FROM companies, settings WHERE companies.company_id = settings.company_id AND companies.company_id = 1"); $row = mysqli_fetch_assoc($sql); $company_name = escapeHtml($row['company_name']); @@ -88,7 +95,7 @@ $company_locale = escapeHtml($row['company_locale']); $config_invoice_footer = escapeHtml($row['config_invoice_footer']); // Get Payment Provide Details -$sql = mysqli_query($mysqli, "SELECT * FROM payment_providers WHERE payment_provider_active = 1 LIMIT 1"); +$sql = mysqli_query($mysqli, "SELECT payment_provider_id, payment_provider_name, payment_provider_threshold FROM payment_providers WHERE payment_provider_active = 1 LIMIT 1"); $row = mysqli_fetch_assoc($sql); $payment_provider_id = intval($row['payment_provider_id']); $payment_provider_name = escapeHtml($row['payment_provider_name']); diff --git a/guest/guest_view_item.php b/guest/guest_view_item.php index f513c5161..1515f63fd 100644 --- a/guest/guest_view_item.php +++ b/guest/guest_view_item.php @@ -15,7 +15,9 @@ $purifier_config->set('Cache.DefinitionImpl', null); // Disable cache by setting $purifier_config->set('URI.AllowedSchemes', ['data' => true, 'src' => true, 'http' => true, 'https' => true]); $purifier = new HTMLPurifier($purifier_config); -$sql = mysqli_query($mysqli, "SELECT * FROM companies, settings WHERE companies.company_id = settings.company_id AND companies.company_id = 1"); +$sql = mysqli_query($mysqli, "SELECT company_address, company_city, company_email, company_locale, company_logo, company_name, + company_phone, company_phone_country_code, company_state, company_website, company_zip, + config_invoice_footer FROM companies, settings WHERE companies.company_id = settings.company_id AND companies.company_id = 1"); $row = mysqli_fetch_assoc($sql); $company_name = escapeHtml($row['company_name']); @@ -47,7 +49,9 @@ if (!isset($_GET['id']) || !isset($_GET['key'])) { $item_id = intval($_GET['id']); $item_key = escapeSql($_GET['key']); -$sql = mysqli_query($mysqli, "SELECT * FROM shared_items WHERE item_id = $item_id AND item_key = '$item_key' AND item_expire_at > NOW() LIMIT 1"); +$sql = mysqli_query($mysqli, "SELECT item_active, item_client_id, item_created_at, item_encrypted_credential, + item_encrypted_username, item_expire_at, item_note, item_recipient, item_related_id, + item_type, item_view_limit, item_views FROM shared_items WHERE item_id = $item_id AND item_key = '$item_key' AND item_expire_at > NOW() LIMIT 1"); $row = mysqli_fetch_assoc($sql); // Check we got a result @@ -171,7 +175,7 @@ if ($item_type == "Document") { } elseif ($item_type == "Credential") { $encryption_key = $_GET['ek']; - $credential_sql = mysqli_query($mysqli, "SELECT * FROM credentials WHERE credential_id = $item_related_id AND credential_client_id = $client_id LIMIT 1"); + $credential_sql = mysqli_query($mysqli, "SELECT credential_id, credential_name, credential_note, credential_otp_secret, credential_uri FROM credentials WHERE credential_id = $item_related_id AND credential_client_id = $client_id LIMIT 1"); $credential_row = mysqli_fetch_assoc($credential_sql); if (mysqli_num_rows($credential_sql) !== 1 || !$credential_row) { echo "
Error retrieving login.
"; diff --git a/guest/guest_view_quote.php b/guest/guest_view_quote.php index f3887b784..e4363843a 100644 --- a/guest/guest_view_quote.php +++ b/guest/guest_view_quote.php @@ -16,7 +16,12 @@ $quote_id = intval($_GET['quote_id']); $sql = mysqli_query( $mysqli, - "SELECT * FROM quotes + "SELECT client_currency_code, client_id, client_name, client_website, contact_email, + contact_extension, contact_mobile, contact_mobile_country_code, contact_phone, + contact_phone_country_code, location_address, location_city, location_country, + location_state, location_zip, quote_amount, quote_currency_code, quote_date, + quote_discount_amount, quote_expire, quote_id, quote_note, quote_number, quote_prefix, + quote_status FROM quotes LEFT JOIN clients ON quote_client_id = client_id LEFT JOIN contacts ON clients.client_id = contacts.contact_client_id AND contact_primary = 1 LEFT JOIN locations ON clients.client_id = locations.location_client_id AND location_primary = 1 @@ -61,7 +66,9 @@ $contact_mobile = escapeHtml(formatPhoneNumber($row['contact_mobile'], $contact_ $client_website = escapeHtml($row['client_website']); $client_currency_code = escapeHtml($row['client_currency_code']); -$sql = mysqli_query($mysqli, "SELECT * FROM companies, settings WHERE companies.company_id = settings.company_id AND companies.company_id = 1"); +$sql = mysqli_query($mysqli, "SELECT company_address, company_city, company_country, company_email, company_locale, + company_logo, company_name, company_phone, company_phone_country_code, company_state, + company_website, company_zip, config_quote_footer FROM companies, settings WHERE companies.company_id = settings.company_id AND companies.company_id = 1"); $row = mysqli_fetch_assoc($sql); $company_name = escapeHtml($row['company_name']); $company_address = escapeHtml($row['company_address']); diff --git a/includes/load_company_settings.php b/includes/load_company_settings.php index e4b86a54a..722010c94 100644 --- a/includes/load_company_settings.php +++ b/includes/load_company_settings.php @@ -1,5 +1,5 @@