More sweeps to replace select * with actual returned column names dramatically reduces php memory usage and speeds up processing dramatically especially in the crons since they run all the time

agent/post/asset.php

@@ -387,7 +387,7 @@ if (isset($_POST['bulk_assign_asset_tags'])) {
                 foreach($_POST['tags'] as $tag) {
                     $tag = intval($tag);
 
-                    $sql = mysqli_query($mysqli,"SELECT * FROM asset_tags WHERE asset_tag_asset_id = $asset_id AND asset_tag_tag_id = $tag");
+                    $sql = mysqli_query($mysqli,"SELECT 1 FROM asset_tags WHERE asset_tag_asset_id = $asset_id AND asset_tag_tag_id = $tag");
                     if (mysqli_num_rows($sql) == 0) {
                         mysqli_query($mysqli, "INSERT INTO asset_tags SET asset_tag_asset_id = $asset_id, asset_tag_tag_id = $tag");
                     }
@@ -1224,7 +1224,7 @@ if (isset($_POST["import_assets_csv"])) {
             if (!empty($column[8])) {
                 $contact = escapeSql($column[8]);
                 if ($contact) {
-                    $sql_contact = mysqli_query($mysqli,"SELECT * FROM contacts WHERE contact_name = '$contact' AND contact_client_id = $client_id");
+                    $sql_contact = mysqli_query($mysqli,"SELECT contact_id FROM contacts WHERE contact_name = '$contact' AND contact_client_id = $client_id");
                     $row = mysqli_fetch_assoc($sql_contact);
                     $contact_id = intval($row['contact_id']);
                 }
@@ -1234,7 +1234,7 @@ if (isset($_POST["import_assets_csv"])) {
             if (!empty($column[9])) {
                 $location = escapeSql($column[9]);
                 if ($location) {
-                    $sql_location = mysqli_query($mysqli,"SELECT * FROM locations WHERE location_name = '$location' AND location_client_id = $client_id");
+                    $sql_location = mysqli_query($mysqli,"SELECT location_id FROM locations WHERE location_name = '$location' AND location_client_id = $client_id");
                     $row = mysqli_fetch_assoc($sql_location);
                     $location_id = intval($row['location_id']);
                 }
@@ -1911,7 +1911,7 @@ if (isset($_POST["import_client_asset_interfaces_csv"])) {
     $file_name = $_FILES["file"]["tmp_name"];
 
     // Get Asset Details for logging
-    $sql_asset = mysqli_query($mysqli,"SELECT * FROM assets WHERE asset_id = $asset_id");
+    $sql_asset = mysqli_query($mysqli,"SELECT asset_client_id, asset_name FROM assets WHERE asset_id = $asset_id");
     $row = mysqli_fetch_assoc($sql_asset);
     $client_id = intval($row['asset_client_id']);
     $asset_name = escapeSql($row['asset_name']);
@@ -1989,7 +1989,7 @@ if (isset($_POST["import_client_asset_interfaces_csv"])) {
             if (!empty($column[7])) {
                 $network = escapeSql($column[7]);
                 if ($network) {
-                    $sql_network = mysqli_query($mysqli,"SELECT * FROM networks WHERE network_name = '$network' AND network_archived_at IS NULL AND network_client_id = $client_id");
+                    $sql_network = mysqli_query($mysqli,"SELECT network_id FROM networks WHERE network_name = '$network' AND network_archived_at IS NULL AND network_client_id = $client_id");
                     $row = mysqli_fetch_assoc($sql_network);
                     $network_id = intval($row['network_id']);
                 }

agent/post/client.php

@@ -741,7 +741,7 @@ if (isset($_POST['bulk_add_client_ticket'])) {
 
     // Check to see if adding a ticket by template
     if($ticket_template_id) {
-        $sql = mysqli_query($mysqli, "SELECT * FROM ticket_templates WHERE ticket_template_id = $ticket_template_id");
+        $sql = mysqli_query($mysqli, "SELECT ticket_template_details, ticket_template_subject FROM ticket_templates WHERE ticket_template_id = $ticket_template_id");
         $row = mysqli_fetch_assoc($sql);
 
         // Override Template Subject
@@ -751,7 +751,7 @@ if (isset($_POST['bulk_add_client_ticket'])) {
         $details = mysqli_escape_string($mysqli, $row['ticket_template_details']);
 
         // Get Associated Tasks from the ticket template
-        $sql_task_templates = mysqli_query($mysqli, "SELECT * FROM task_templates WHERE task_template_ticket_template_id = $ticket_template_id");
+        $sql_task_templates = mysqli_query($mysqli, "SELECT task_template_name, task_template_order FROM task_templates WHERE task_template_ticket_template_id = $ticket_template_id");
 
     }
 
@@ -764,7 +764,7 @@ if (isset($_POST['bulk_add_client_ticket'])) {
         foreach ($_POST['client_ids'] as $client_id) {
             $client_id = intval($client_id);
 
-            $sql = mysqli_query($mysqli, "SELECT * FROM clients WHERE client_id = $client_id");
+            $sql = mysqli_query($mysqli, "SELECT client_name FROM clients WHERE client_id = $client_id");
             $row = mysqli_fetch_assoc($sql);
 
             $client_name = escapeSql($row['client_name']);
@@ -992,7 +992,7 @@ if (isset($_POST['bulk_assign_client_tags'])) {
                 foreach($_POST['bulk_tags'] as $tag) {
                     $tag = intval($tag);
 
-                    $sql = mysqli_query($mysqli,"SELECT * FROM client_tags WHERE client_id = $client_id AND tag_id = $tag");
+                    $sql = mysqli_query($mysqli,"SELECT 1 FROM client_tags WHERE client_id = $client_id AND tag_id = $tag");
                     if (mysqli_num_rows($sql) == 0) {
                         mysqli_query($mysqli, "INSERT INTO client_tags SET client_id = $client_id, tag_id = $tag");
                     }
@@ -1181,7 +1181,8 @@ if (isset($_POST["export_client_pdf"])) {
     enforceUserPermission("module_sales", 1);
     enforceUserPermission("module_financial", 1);
 
-    $sql = mysqli_query($mysqli, "SELECT * FROM companies, settings WHERE companies.company_id = settings.company_id AND companies.company_id = 1");
+    $sql = mysqli_query($mysqli, "SELECT company_email, company_logo, company_name, company_phone, company_phone_country_code,
+        company_website FROM companies, settings WHERE companies.company_id = settings.company_id AND companies.company_id = 1");
     $row = mysqli_fetch_assoc($sql);
     $company_name = escapeHtml($row['company_name']);
     $company_phone_country_code = escapeHtml($row['company_phone_country_code']);

agent/post/contact.php

@@ -544,7 +544,7 @@ if (isset($_POST['bulk_assign_contact_tags'])) {
                 foreach($_POST['bulk_tags'] as $tag) {
                     $tag = intval($tag);
 
-                    $sql = mysqli_query($mysqli,"SELECT * FROM contact_tags WHERE contact_id = $contact_id AND tag_id = $tag");
+                    $sql = mysqli_query($mysqli,"SELECT 1 FROM contact_tags WHERE contact_id = $contact_id AND tag_id = $tag");
                     if (mysqli_num_rows($sql) == 0) {
                         mysqli_query($mysqli, "INSERT INTO contact_tags SET contact_id = $contact_id, tag_id = $tag");
                     }
@@ -584,7 +584,7 @@ if (isset($_POST['send_bulk_mail_now'])) {
         foreach($_POST['contact_ids'] as $contact_id) {
             $contact_id = intval($contact_id);
 
-            $sql = mysqli_query($mysqli,"SELECT * FROM contacts WHERE contact_id = $contact_id");
+            $sql = mysqli_query($mysqli,"SELECT contact_client_id, contact_email, contact_name FROM contacts WHERE contact_id = $contact_id");
             $row = mysqli_fetch_assoc($sql);
             $contact_name = escapeSql($row['contact_name']);
             $contact_email = escapeSql($row['contact_email']);
@@ -808,7 +808,7 @@ if (isset($_GET['anonymize_contact'])) {
 
 
     // Redact audit logs
-    $log_sql = mysqli_query($mysqli, "SELECT * FROM logs WHERE log_client_id =  $client_id");
+    $log_sql = mysqli_query($mysqli, "SELECT log_description, log_id FROM logs WHERE log_client_id =  $client_id");
     while ($log = mysqli_fetch_assoc($log_sql)) {
         $log_id = intval($log['log_id']);
         $description = $log['log_description'];
@@ -1452,7 +1452,7 @@ if (isset($_POST["import_contacts_csv"])) {
             }
             if (isset($column[7])) {
                 $location = escapeSql($column[7]);
-                $sql_location = mysqli_query($mysqli,"SELECT * FROM locations WHERE location_name = '$location' AND location_client_id = $client_id");
+                $sql_location = mysqli_query($mysqli,"SELECT location_id FROM locations WHERE location_name = '$location' AND location_client_id = $client_id");
                 $row = mysqli_fetch_assoc($sql_location);
                 $location_id = intval($row['location_id']);
             }

agent/post/credential.php

@@ -194,7 +194,7 @@ if (isset($_POST['bulk_assign_credential_tags'])) {
                 foreach($_POST['bulk_tags'] as $tag) {
                     $tag = intval($tag);
 
-                    $sql = mysqli_query($mysqli,"SELECT * FROM credential_tags WHERE credential_id = $credential_id AND tag_id = $tag");
+                    $sql = mysqli_query($mysqli,"SELECT 1 FROM credential_tags WHERE credential_id = $credential_id AND tag_id = $tag");
                     if (mysqli_num_rows($sql) == 0) {
                         mysqli_query($mysqli, "INSERT INTO credential_tags SET credential_id = $credential_id, tag_id = $tag");
                     }

agent/post/document.php

@@ -70,7 +70,7 @@ if (isset($_POST['add_document_from_template'])) {
     // Get template
     $sql_document = mysqli_query(
         $mysqli,
-        "SELECT * FROM document_templates
+        "SELECT document_template_content, document_template_name FROM document_templates
          WHERE document_template_id = $document_template_id"
     );
 
@@ -154,7 +154,8 @@ if (isset($_POST['edit_document'])) {
     // 1) Load the current document to create a version
     $sql_original_document = mysqli_query(
         $mysqli,
-        "SELECT * FROM documents
+        "SELECT document_content, document_created_at, document_created_by, document_description,
+            document_name, document_updated_at, document_updated_by FROM documents
          WHERE document_client_id = $client_id
            AND document_id = $document_id"
     );

agent/post/domain.php

@@ -207,7 +207,7 @@ if (isset($_GET['archive_domain'])) {
     $domain_id = intval($_GET['archive_domain']);
 
     //Get domain Name
-    $sql = mysqli_query($mysqli,"SELECT * FROM domains WHERE domain_id = $domain_id");
+    $sql = mysqli_query($mysqli,"SELECT domain_client_id, domain_name FROM domains WHERE domain_id = $domain_id");
     $row = mysqli_fetch_assoc($sql);
     $domain_name = escapeSql($row['domain_name']);
     $client_id = intval($row['domain_client_id']);

agent/post/event.php

@@ -50,7 +50,7 @@ if (isset($_GET['delete_calendar'])) {
     $calendar_id = intval($_GET['delete_calendar']);
 
     // Get Calendar Name
-    $sql = mysqli_query($mysqli,"SELECT * FROM calendars WHERE calendar_id = $calendar_id");
+    $sql = mysqli_query($mysqli,"SELECT calendar_name FROM calendars WHERE calendar_id = $calendar_id");
     $row = mysqli_fetch_assoc($sql);
     $calendar_name = escapeSql($row['calendar_name']);
 
@@ -192,7 +192,8 @@ if (isset($_POST['add_event'])) {
         $contact_name = escapeSql($row['contact_name']);
         $contact_email = escapeSql($row['contact_email']);
 
-        $sql_company = mysqli_query($mysqli,"SELECT * FROM companies WHERE company_id = 1");
+        $sql_company = mysqli_query($mysqli,"SELECT company_address, company_city, company_country, company_email, company_logo, company_name,
+            company_phone, company_state, company_website, company_zip FROM companies WHERE company_id = 1");
         $row = mysqli_fetch_assoc($sql_company);
         $company_name = escapeSql($row['company_name']);
         $company_country = escapeSql($row['company_country']);
@@ -266,7 +267,8 @@ if (isset($_POST['edit_event'])) {
         $contact_name = escapeSql($row['contact_name']);
         $contact_email = escapeSql($row['contact_email']);
 
-        $sql_company = mysqli_query($mysqli,"SELECT * FROM companies WHERE company_id = 1");
+        $sql_company = mysqli_query($mysqli,"SELECT company_address, company_city, company_country, company_email, company_logo, company_name,
+            company_phone, company_state, company_website, company_zip FROM companies WHERE company_id = 1");
         $row = mysqli_fetch_assoc($sql_company);
         $company_name = escapeSql($row['company_name']);
         $company_country = escapeSql($row['company_country']);
@@ -323,7 +325,7 @@ if (isset($_GET['delete_event'])) {
     $event_id = intval($_GET['delete_event']);
 
     // Get Event Title
-    $sql = mysqli_query($mysqli,"SELECT * FROM calendar_events WHERE event_id = $event_id");
+    $sql = mysqli_query($mysqli,"SELECT event_client_id, event_title FROM calendar_events WHERE event_id = $event_id");
     $row = mysqli_fetch_assoc($sql);
     $event_title = escapeSql($row['event_title']);
     $client_id = intval($row['event_client_id']);

agent/post/expense.php

@@ -104,7 +104,7 @@ if (isset($_GET['delete_expense'])) {
 
     $expense_id = intval($_GET['delete_expense']);
 
-    $sql = mysqli_query($mysqli,"SELECT * FROM expenses WHERE expense_id = $expense_id");
+    $sql = mysqli_query($mysqli,"SELECT expense_client_id, expense_description, expense_receipt FROM expenses WHERE expense_id = $expense_id");
     $row = mysqli_fetch_assoc($sql);
     $expense_receipt = escapeSql($row['expense_receipt']);
     $expense_description = escapeSql($row['expense_description']);
@@ -270,7 +270,7 @@ if (isset($_POST['bulk_delete_expenses'])) {
 
             $expense_id = intval($expense_id);
 
-            $sql = mysqli_query($mysqli,"SELECT * FROM expenses WHERE expense_id = $expense_id");
+            $sql = mysqli_query($mysqli,"SELECT expense_client_id, expense_description, expense_receipt FROM expenses WHERE expense_id = $expense_id");
             $row = mysqli_fetch_assoc($sql);
             $expense_description = escapeSql($row['expense_description']);
             $expense_receipt = escapeSql($row['expense_receipt']);

agent/post/file.php

@@ -267,7 +267,7 @@ if (isset($_POST['bulk_archive_files'])) {
 
             $file_id = intval($file_id);
 
-            $sql_file = mysqli_query($mysqli,"SELECT * FROM files WHERE file_id = $file_id");
+            $sql_file = mysqli_query($mysqli,"SELECT file_client_id, file_name FROM files WHERE file_id = $file_id");
             $row = mysqli_fetch_assoc($sql_file);
             $client_id = intval($row['file_client_id']);
             $file_name = escapeSql($row['file_name']);
@@ -411,7 +411,7 @@ if (isset($_POST['bulk_restore_files'])) {
 
             $file_id = intval($file_id);
 
-            $sql_file = mysqli_query($mysqli,"SELECT * FROM files WHERE file_id = $file_id");
+            $sql_file = mysqli_query($mysqli,"SELECT file_client_id, file_name FROM files WHERE file_id = $file_id");
             $row = mysqli_fetch_assoc($sql_file);
             $client_id = intval($row['file_client_id']);
             $file_name = escapeSql($row['file_name']);

agent/post/invoice.php

@@ -103,7 +103,9 @@ if (isset($_POST['add_invoice_copy'])) {
     $date = escapeSql($_POST['date']);
 
     //Get Net Terms
-    $sql = mysqli_query($mysqli,"SELECT * FROM clients, invoices WHERE client_id = invoice_client_id AND invoice_id = $invoice_id");
+    $sql = mysqli_query($mysqli,"SELECT client_net_terms, invoice_amount, invoice_category_id, invoice_client_id,
+        invoice_currency_code, invoice_discount_amount, invoice_note, invoice_number,
+        invoice_prefix, invoice_scope FROM clients, invoices WHERE client_id = invoice_client_id AND invoice_id = $invoice_id");
     $row = mysqli_fetch_assoc($sql);
     $client_net_terms = intval($row['client_net_terms']);
     $invoice_scope = escapeSql($row['invoice_scope']);
@@ -279,14 +281,14 @@ if (isset($_GET['delete_invoice'])) {
     }
 
     //Delete History Associated with the Invoice
-    $sql = mysqli_query($mysqli,"SELECT * FROM history WHERE history_invoice_id = $invoice_id");
+    $sql = mysqli_query($mysqli,"SELECT history_id FROM history WHERE history_invoice_id = $invoice_id");
     while($row = mysqli_fetch_assoc($sql)) {
         $history_id = intval($row['history_id']);
         mysqli_query($mysqli,"DELETE FROM history WHERE history_id = $history_id");
     }
 
     //Delete Payments Associated with the Invoice
-    $sql = mysqli_query($mysqli,"SELECT * FROM payments WHERE payment_invoice_id = $invoice_id");
+    $sql = mysqli_query($mysqli,"SELECT payment_id FROM payments WHERE payment_invoice_id = $invoice_id");
     while($row = mysqli_fetch_assoc($sql)) {
         $payment_id = intval($row['payment_id']);
         mysqli_query($mysqli,"DELETE FROM payments WHERE payment_id = $payment_id");
@@ -353,7 +355,7 @@ if (isset($_POST['add_invoice_item'])) {
 
     // Tax
     if ($tax_id > 0) {
-        $sql = mysqli_query($mysqli,"SELECT * FROM taxes WHERE tax_id = $tax_id");
+        $sql = mysqli_query($mysqli,"SELECT tax_percent FROM taxes WHERE tax_id = $tax_id");
         $row = mysqli_fetch_assoc($sql);
         $tax_percent = floatval($row['tax_percent']);
         $tax_amount = $subtotal * $tax_percent / 100;
@@ -366,7 +368,7 @@ if (isset($_POST['add_invoice_item'])) {
     mysqli_query($mysqli,"INSERT INTO invoice_items SET item_name = '$name', item_description = '$description', item_quantity = $qty, item_price = $price, item_subtotal = $subtotal, item_tax = $tax_amount, item_total = $total, item_order = $item_order, item_tax_id = $tax_id, item_product_id = $product_id, item_invoice_id = $invoice_id");
 
     // Get Discount and Invoice Details
-    $sql = mysqli_query($mysqli,"SELECT * FROM invoices WHERE invoice_id = $invoice_id");
+    $sql = mysqli_query($mysqli,"SELECT invoice_discount_amount, invoice_number, invoice_prefix FROM invoices WHERE invoice_id = $invoice_id");
     $row = mysqli_fetch_assoc($sql);
     $invoice_prefix = escapeSql($row['invoice_prefix']);
     $invoice_number = intval($row['invoice_number']);
@@ -401,7 +403,7 @@ if (isset($_POST['invoice_note'])) {
     $note = escapeSql($_POST['note']);
 
     // Get Invoice Details for logging
-    $sql = mysqli_query($mysqli,"SELECT * FROM invoices WHERE invoice_id = $invoice_id");
+    $sql = mysqli_query($mysqli,"SELECT invoice_client_id, invoice_number, invoice_prefix FROM invoices WHERE invoice_id = $invoice_id");
     $row = mysqli_fetch_assoc($sql);
     $invoice_prefix = escapeSql($row['invoice_prefix']);
     $invoice_number = intval($row['invoice_number']);
@@ -436,7 +438,7 @@ if (isset($_POST['edit_invoice_item'])) {
     $subtotal = $price * $qty;
 
     if ($tax_id > 0) {
-        $sql = mysqli_query($mysqli,"SELECT * FROM taxes WHERE tax_id = $tax_id");
+        $sql = mysqli_query($mysqli,"SELECT tax_percent FROM taxes WHERE tax_id = $tax_id");
         $row = mysqli_fetch_assoc($sql);
         $tax_percent = floatval($row['tax_percent']);
         $tax_amount = $subtotal * $tax_percent / 100;
@@ -452,7 +454,7 @@ if (isset($_POST['edit_invoice_item'])) {
     $invoice_id = intval($row['item_invoice_id']);
 
     //Get Discount Amount
-    $sql = mysqli_query($mysqli,"SELECT * FROM invoices WHERE invoice_id = $invoice_id");
+    $sql = mysqli_query($mysqli,"SELECT invoice_client_id, invoice_discount_amount, invoice_number, invoice_prefix FROM invoices WHERE invoice_id = $invoice_id");
     $row = mysqli_fetch_assoc($sql);
     $invoice_prefix = escapeSql($row['invoice_prefix']);
     $invoice_number = intval($row['invoice_number']);
@@ -486,7 +488,8 @@ if (isset($_GET['delete_invoice_item'])) {
 
     $item_id = intval($_GET['delete_invoice_item']);
 
-    $sql = mysqli_query($mysqli,"SELECT * FROM invoice_items WHERE item_id = $item_id");
+    $sql = mysqli_query($mysqli,"SELECT item_invoice_id, item_name, item_product_id, item_quantity, item_subtotal, item_tax,
+        item_total FROM invoice_items WHERE item_id = $item_id");
     $row = mysqli_fetch_assoc($sql);
     $invoice_id = intval($row['item_invoice_id']);
     $item_name = escapeSql($row['item_name']);
@@ -496,7 +499,7 @@ if (isset($_GET['delete_invoice_item'])) {
     $item_tax = floatval($row['item_tax']);
     $item_total = floatval($row['item_total']);
 
-    $sql = mysqli_query($mysqli,"SELECT * FROM invoices WHERE invoice_id = $invoice_id");
+    $sql = mysqli_query($mysqli,"SELECT invoice_amount, invoice_client_id, invoice_number, invoice_prefix FROM invoices WHERE invoice_id = $invoice_id");
     $row = mysqli_fetch_assoc($sql);
     $invoice_prefix = escapeSql($row['invoice_prefix']);
     $invoice_number = intval($row['invoice_number']);
@@ -531,7 +534,9 @@ if (isset($_GET['email_invoice'])) {
 
     $invoice_id = intval($_GET['email_invoice']);
 
-    $sql = mysqli_query($mysqli,"SELECT * FROM invoices
+    $sql = mysqli_query($mysqli,"SELECT client_id, client_name, contact_email, contact_name, invoice_amount, invoice_currency_code,
+        invoice_date, invoice_due, invoice_id, invoice_number, invoice_prefix, invoice_scope,
+        invoice_status, invoice_url_key FROM invoices
         LEFT JOIN clients ON invoice_client_id = client_id
         LEFT JOIN contacts ON clients.client_id = contacts.contact_client_id AND contact_primary = 1
         WHERE invoice_id = $invoice_id"
@@ -555,7 +560,8 @@ if (isset($_GET['email_invoice'])) {
 
     enforceClientAccess();
 
-    $sql = mysqli_query($mysqli,"SELECT * FROM companies WHERE company_id = 1");
+    $sql = mysqli_query($mysqli,"SELECT company_address, company_city, company_country, company_email, company_logo, company_name,
+        company_phone, company_phone_country_code, company_state, company_website, company_zip FROM companies WHERE company_id = 1");
     $row = mysqli_fetch_assoc($sql);
 
     $company_name = escapeSql($row['company_name']);
@@ -819,7 +825,13 @@ if (isset($_GET['export_invoice_pdf'])) {
 
     $sql = mysqli_query(
         $mysqli,
-        "SELECT * FROM invoices
+        "SELECT client_currency_code, client_id, client_name, client_net_terms, client_website,
+            contact_email, contact_extension, contact_mobile, contact_mobile_country_code,
+            contact_phone, contact_phone_country_code, invoice_amount, invoice_category_id,
+            invoice_created_at, invoice_currency_code, invoice_date, invoice_discount_amount,
+            invoice_due, invoice_id, invoice_note, invoice_number, invoice_prefix, invoice_scope,
+            invoice_status, invoice_url_key, location_address, location_city, location_country,
+            location_state, location_zip FROM invoices
         LEFT JOIN clients ON invoice_client_id = client_id
         LEFT JOIN contacts ON clients.client_id = contacts.contact_client_id AND contact_primary = 1
         LEFT JOIN locations ON clients.client_id = locations.location_client_id AND location_primary = 1
@@ -865,7 +877,9 @@ if (isset($_GET['export_invoice_pdf'])) {
 
     enforceClientAccess();
 
-    $sql = mysqli_query($mysqli, "SELECT * FROM companies WHERE company_id = 1");
+    $sql = mysqli_query($mysqli, "SELECT company_address, company_city, company_country, company_email, company_id, company_logo,
+        company_name, company_phone, company_phone_country_code, company_state, company_tax_id,
+        company_website, company_zip FROM companies WHERE company_id = 1");
     $row = mysqli_fetch_assoc($sql);
     $company_id = intval($row['company_id']);
     $company_name = escapeHtml($row['company_name']);
@@ -1048,7 +1062,9 @@ if (isset($_GET['export_invoice_packing_slip'])) {
 
     $sql = mysqli_query(
         $mysqli,
-        "SELECT * FROM invoices
+        "SELECT client_id, client_name, contact_email, contact_extension, contact_phone,
+            contact_phone_country_code, invoice_date, invoice_id, invoice_number, invoice_prefix,
+            location_address, location_city, location_country, location_state, location_zip FROM invoices
         LEFT JOIN clients ON invoice_client_id = client_id
         LEFT JOIN contacts ON clients.client_id = contacts.contact_client_id AND contact_primary = 1
         LEFT JOIN locations ON clients.client_id = locations.location_client_id AND location_primary = 1
@@ -1076,7 +1092,9 @@ if (isset($_GET['export_invoice_packing_slip'])) {
 
     enforceClientAccess();
 
-    $sql = mysqli_query($mysqli, "SELECT * FROM companies WHERE company_id = 1");
+    $sql = mysqli_query($mysqli, "SELECT company_address, company_city, company_country, company_email, company_id, company_logo,
+        company_name, company_phone, company_phone_country_code, company_state, company_website,
+        company_zip FROM companies WHERE company_id = 1");
     $row = mysqli_fetch_assoc($sql);
     $company_id = intval($row['company_id']);
     $company_name = escapeHtml($row['company_name']);
@@ -1206,7 +1224,7 @@ if (isset($_POST['bulk_edit_invoice_category'])) {
             $invoice_id = intval($invoice_id);
 
             // Get Invoice Details for Logging
-            $sql = mysqli_query($mysqli,"SELECT * FROM invoices WHERE invoice_id = $invoice_id");
+            $sql = mysqli_query($mysqli,"SELECT invoice_client_id, invoice_number, invoice_prefix, invoice_scope FROM invoices WHERE invoice_id = $invoice_id");
             $row = mysqli_fetch_assoc($sql);
             $invoice_prefix = escapeSql($row['invoice_prefix']);
             $invoice_number = intval($row['invoice_number']);

agent/post/location.php

@@ -242,7 +242,7 @@ if (isset($_POST['bulk_assign_location_tags'])) {
                 foreach($_POST['bulk_tags'] as $tag) {
                     $tag = intval($tag);
 
-                    $sql = mysqli_query($mysqli,"SELECT * FROM location_tags WHERE location_id = $location_id AND tag_id = $tag");
+                    $sql = mysqli_query($mysqli,"SELECT 1 FROM location_tags WHERE location_id = $location_id AND tag_id = $tag");
                     if (mysqli_num_rows($sql) == 0) {
                         mysqli_query($mysqli, "INSERT INTO location_tags SET location_id = $location_id, tag_id = $tag");
                     }

agent/post/payment.php

@@ -43,7 +43,9 @@ if (isset($_POST['add_payment'])) {
         $total_payments_amount = floatval($row['payments_amount']);
 
         //Get the invoice total
-        $sql = mysqli_query($mysqli,"SELECT * FROM invoices
+        $sql = mysqli_query($mysqli,"SELECT client_name, contact_email, contact_extension, contact_mobile, contact_mobile_country_code,
+            contact_name, contact_phone, contact_phone_country_code, invoice_amount,
+            invoice_currency_code, invoice_number, invoice_prefix, invoice_url_key FROM invoices
             LEFT JOIN clients ON invoice_client_id = client_id
             LEFT JOIN contacts ON clients.client_id = contacts.contact_client_id AND contact_primary = 1
             WHERE invoice_id = $invoice_id"
@@ -62,7 +64,8 @@ if (isset($_POST['add_payment'])) {
         $contact_extension = preg_replace("/[^0-9]/", '',$row['contact_extension']);
         $contact_mobile = escapeSql(formatPhoneNumber($row['contact_mobile'], $row['contact_mobile_country_code']));
 
-        $sql = mysqli_query($mysqli,"SELECT * FROM companies WHERE company_id = 1");
+        $sql = mysqli_query($mysqli,"SELECT company_address, company_city, company_country, company_email, company_logo, company_name,
+            company_phone, company_phone_country_code, company_state, company_website, company_zip FROM companies WHERE company_id = 1");
         $row = mysqli_fetch_assoc($sql);
 
         $company_name = escapeSql($row['company_name']);
@@ -218,7 +221,7 @@ if (isset($_POST['apply_credit'])) {
     $invoice_id = intval($_POST['invoice_id']);
     $credit_amount_applied = floatval($_POST['credit_amount_applied']);
 
-    $sql = mysqli_query($mysqli, "SELECT * FROM invoices LEFT JOIN clients ON invoice_client_id = client_id WHERE invoice_id = $invoice_id");
+    $sql = mysqli_query($mysqli, "SELECT invoice_client_id, invoice_credit_amount, invoice_number, invoice_prefix, invoice_status FROM invoices LEFT JOIN clients ON invoice_client_id = client_id WHERE invoice_id = $invoice_id");
     $row = mysqli_fetch_assoc($sql);
 
     $invoice_prefix = escapeSql($row['invoice_prefix']);
@@ -329,7 +332,10 @@ if (isset($_POST['add_payment_stripe'])) {
     $saved_payment_id = intval($_POST['saved_payment_id']);
 
     // Get invoice details
-    $sql = mysqli_query($mysqli,"SELECT * FROM invoices
+    $sql = mysqli_query($mysqli,"SELECT client_id, client_name, contact_email, contact_extension, contact_mobile,
+        contact_mobile_country_code, contact_name, contact_phone, contact_phone_country_code,
+        invoice_amount, invoice_currency_code, invoice_number, invoice_prefix, invoice_status,
+        invoice_url_key FROM invoices
             LEFT JOIN clients ON invoice_client_id = client_id
             LEFT JOIN contacts ON client_id = contact_client_id AND contact_primary = 1
             WHERE invoice_id = $invoice_id"
@@ -353,7 +359,8 @@ if (isset($_POST['add_payment_stripe'])) {
     enforceClientAccess();
 
     // Get ITFlow company details
-    $sql = mysqli_query($mysqli,"SELECT * FROM companies WHERE company_id = 1");
+    $sql = mysqli_query($mysqli,"SELECT company_address, company_city, company_country, company_email, company_name, company_phone,
+        company_phone_country_code, company_state, company_website, company_zip FROM companies WHERE company_id = 1");
     $row = mysqli_fetch_assoc($sql);
     $company_name = escapeSql($row['company_name']);
     $company_country = escapeSql($row['company_country']);
@@ -370,7 +377,8 @@ if (isset($_POST['add_payment_stripe'])) {
     $config_invoice_from_email = escapeSql($config_invoice_from_email);
 
     // Get Client Payment Details
-    $sql = mysqli_query($mysqli, "SELECT * FROM client_saved_payment_methods LEFT JOIN payment_providers ON saved_payment_provider_id = payment_provider_id LEFT JOIN client_payment_provider ON saved_payment_client_id = client_id WHERE saved_payment_id = $saved_payment_id LIMIT 1");
+    $sql = mysqli_query($mysqli, "SELECT payment_provider_account, payment_provider_client, payment_provider_private_key,
+        payment_provider_public_key, saved_payment_description, saved_payment_provider_method FROM client_saved_payment_methods LEFT JOIN payment_providers ON saved_payment_provider_id = payment_provider_id LEFT JOIN client_payment_provider ON saved_payment_client_id = client_id WHERE saved_payment_id = $saved_payment_id LIMIT 1");
     $row = mysqli_fetch_assoc($sql);
 
     $public_key = escapeSql($row['payment_provider_public_key']);
@@ -651,7 +659,7 @@ if (isset($_GET['delete_payment'])) {
     $payment_id = intval($_GET['delete_payment']);
 
     // payments has no client column - the client comes from the invoice the payment sits on
-    $sql = mysqli_query($mysqli,"SELECT * FROM payments
+    $sql = mysqli_query($mysqli,"SELECT invoice_client_id, invoice_number, invoice_prefix, payment_invoice_id FROM payments
         LEFT JOIN invoices ON payment_invoice_id = invoice_id
         WHERE payment_id = $payment_id
         LIMIT 1"

agent/post/project.php

@@ -74,7 +74,7 @@ if (isset($_POST['add_project'])) {
 
             // Task Templates for Ticket template and add the to the ticket
             $sql_task_templates = mysqli_query($mysqli,
-                "SELECT * FROM task_templates WHERE task_template_ticket_template_id = $ticket_template_id");
+                "SELECT task_template_id, task_template_name, task_template_order FROM task_templates WHERE task_template_ticket_template_id = $ticket_template_id");
             $task_template_count = mysqli_num_rows($sql_task_templates);
 
             while ($row = mysqli_fetch_assoc($sql_task_templates)) {

agent/post/quote.php

@@ -79,7 +79,8 @@ if (isset($_POST['add_quote_copy'])) {
 
     $quote_number = mysqli_insert_id($mysqli);
 
-    $sql = mysqli_query($mysqli,"SELECT * FROM quotes WHERE quote_id = $quote_id");
+    $sql = mysqli_query($mysqli,"SELECT quote_amount, quote_category_id, quote_currency_code, quote_discount_amount, quote_note,
+        quote_number, quote_prefix, quote_scope FROM quotes WHERE quote_id = $quote_id");
     $row = mysqli_fetch_assoc($sql);
     $original_quote_prefix = escapeSql($row['quote_prefix']);
     $original_quote_number = escapeSql($row['quote_number']);
@@ -135,7 +136,8 @@ if (isset($_POST['add_quote_to_invoice'])) {
     $quote_id = intval($_POST['quote_id']);
     $date = escapeSql($_POST['date']);
 
-    $sql = mysqli_query($mysqli,"SELECT * FROM clients, quotes WHERE client_id = quote_client_id AND quote_id = $quote_id");
+    $sql = mysqli_query($mysqli,"SELECT client_net_terms, quote_amount, quote_category_id, quote_client_id, quote_currency_code,
+        quote_discount_amount, quote_note, quote_number, quote_prefix, quote_scope FROM clients, quotes WHERE client_id = quote_client_id AND quote_id = $quote_id");
     $row = mysqli_fetch_assoc($sql);
     $client_net_terms = intval($row['client_net_terms']);
     $quote_prefix = escapeSql($row['quote_prefix']);
@@ -241,7 +243,7 @@ if (isset($_POST['add_quote_item'])) {
     $subtotal = $price * $qty;
 
     if ($tax_id > 0) {
-        $sql = mysqli_query($mysqli,"SELECT * FROM taxes WHERE tax_id = $tax_id");
+        $sql = mysqli_query($mysqli,"SELECT tax_percent FROM taxes WHERE tax_id = $tax_id");
         $row = mysqli_fetch_assoc($sql);
         $tax_percent = floatval($row['tax_percent']);
         $tax_amount = $subtotal * $tax_percent / 100;
@@ -254,7 +256,7 @@ if (isset($_POST['add_quote_item'])) {
     mysqli_query($mysqli,"INSERT INTO quote_items SET item_name = '$name', item_description = '$description', item_quantity = $qty, item_price = $price, item_subtotal = $subtotal, item_tax = $tax_amount, item_total = $total, item_tax_id = $tax_id, item_order = $item_order, item_quote_id = $quote_id");
 
     // Get Quote Details
-    $sql = mysqli_query($mysqli,"SELECT * FROM quotes WHERE quote_id = $quote_id");
+    $sql = mysqli_query($mysqli,"SELECT quote_client_id, quote_discount_amount, quote_number, quote_prefix FROM quotes WHERE quote_id = $quote_id");
     $row = mysqli_fetch_assoc($sql);
     $quote_prefix = escapeSql($row['quote_prefix']);
     $quote_number = escapeSql($row['quote_number']);
@@ -297,7 +299,7 @@ if (isset($_POST['edit_quote_item'])) {
     $subtotal = $price * $qty;
 
     if ($tax_id > 0) {
-        $sql = mysqli_query($mysqli,"SELECT * FROM taxes WHERE tax_id = $tax_id");
+        $sql = mysqli_query($mysqli,"SELECT tax_percent FROM taxes WHERE tax_id = $tax_id");
         $row = mysqli_fetch_assoc($sql);
         $tax_percent = floatval($row['tax_percent']);
         $tax_amount = $subtotal * $tax_percent / 100;
@@ -313,7 +315,7 @@ if (isset($_POST['edit_quote_item'])) {
     $quote_id = intval($row['item_quote_id']);
 
     //Get Discount Amount
-    $sql = mysqli_query($mysqli,"SELECT * FROM quotes WHERE quote_id = $quote_id");
+    $sql = mysqli_query($mysqli,"SELECT quote_client_id, quote_discount_amount, quote_number, quote_prefix FROM quotes WHERE quote_id = $quote_id");
     $row = mysqli_fetch_assoc($sql);
     $quote_prefix = escapeSql($row['quote_prefix']);
     $quote_number = intval($row['quote_number']);
@@ -349,7 +351,7 @@ if (isset($_POST['quote_note'])) {
     $note = escapeSql($_POST['note']);
 
     // Get Quote Details
-    $sql = mysqli_query($mysqli,"SELECT * FROM quotes WHERE quote_id = $quote_id");
+    $sql = mysqli_query($mysqli,"SELECT quote_client_id, quote_number, quote_prefix FROM quotes WHERE quote_id = $quote_id");
     $row = mysqli_fetch_assoc($sql);
     $quote_prefix = escapeSql($row['quote_prefix']);
     $quote_number = escapeSql($row['quote_number']);
@@ -378,7 +380,7 @@ if (isset($_POST['edit_quote'])) {
     $quote_id = intval($_POST['quote_id']);
 
     // Get Quote Details for logging
-    $sql = mysqli_query($mysqli,"SELECT * FROM quotes WHERE quote_id = $quote_id");
+    $sql = mysqli_query($mysqli,"SELECT quote_client_id, quote_number, quote_prefix FROM quotes WHERE quote_id = $quote_id");
     $row = mysqli_fetch_assoc($sql);
     $quote_prefix = escapeSql($row['quote_prefix']);
     $quote_number = escapeSql($row['quote_number']);
@@ -414,7 +416,7 @@ if (isset($_GET['delete_quote'])) {
     $quote_id = intval($_GET['delete_quote']);
 
     // Get Quote Details for logging
-    $sql = mysqli_query($mysqli,"SELECT * FROM quotes WHERE quote_id = $quote_id");
+    $sql = mysqli_query($mysqli,"SELECT quote_client_id, quote_number, quote_prefix FROM quotes WHERE quote_id = $quote_id");
     $row = mysqli_fetch_assoc($sql);
     $quote_prefix = escapeSql($row['quote_prefix']);
     $quote_number = escapeSql($row['quote_number']);
@@ -432,7 +434,7 @@ if (isset($_GET['delete_quote'])) {
     }
 
     //Delete History Associated with the Quote
-    $sql = mysqli_query($mysqli,"SELECT * FROM history WHERE history_quote_id = $quote_id");
+    $sql = mysqli_query($mysqli,"SELECT history_id FROM history WHERE history_quote_id = $quote_id");
     while($row = mysqli_fetch_assoc($sql)) {;
         $history_id = intval($row['history_id']);
         mysqli_query($mysqli,"DELETE FROM history WHERE history_id = $history_id");
@@ -459,7 +461,7 @@ if (isset($_GET['delete_quote_item'])) {
 
     $item_id = intval($_GET['delete_quote_item']);
 
-    $sql = mysqli_query($mysqli,"SELECT * FROM quote_items WHERE item_id = $item_id");
+    $sql = mysqli_query($mysqli,"SELECT item_name, item_quote_id, item_subtotal, item_tax, item_total FROM quote_items WHERE item_id = $item_id");
     $row = mysqli_fetch_assoc($sql);
     $item_name = escapeSql($row['item_name']);
     $quote_id = intval($row['item_quote_id']);
@@ -467,7 +469,7 @@ if (isset($_GET['delete_quote_item'])) {
     $item_tax = floatval($row['item_tax']);
     $item_total = floatval($row['item_total']);
 
-    $sql = mysqli_query($mysqli,"SELECT * FROM quotes WHERE quote_id = $quote_id");
+    $sql = mysqli_query($mysqli,"SELECT quote_amount, quote_client_id, quote_number, quote_prefix FROM quotes WHERE quote_id = $quote_id");
     $row = mysqli_fetch_assoc($sql);
     $quote_prefix = escapeSql($row['quote_prefix']);
     $quote_number = escapeSql($row['quote_number']);
@@ -497,7 +499,7 @@ if (isset($_GET['mark_quote_sent'])) {
 
     $quote_id = intval($_GET['mark_quote_sent']);
 
-    $sql = mysqli_query($mysqli,"SELECT * FROM quotes WHERE quote_id = $quote_id");
+    $sql = mysqli_query($mysqli,"SELECT quote_client_id, quote_number, quote_prefix FROM quotes WHERE quote_id = $quote_id");
     $row = mysqli_fetch_assoc($sql);
     $quote_prefix = escapeSql($row['quote_prefix']);
     $quote_number = escapeSql($row['quote_number']);
@@ -525,7 +527,7 @@ if (isset($_GET['accept_quote'])) {
 
     $quote_id = intval($_GET['accept_quote']);
 
-    $sql = mysqli_query($mysqli,"SELECT * FROM quotes WHERE quote_id = $quote_id");
+    $sql = mysqli_query($mysqli,"SELECT quote_client_id, quote_number, quote_prefix FROM quotes WHERE quote_id = $quote_id");
     $row = mysqli_fetch_assoc($sql);
     $quote_prefix = escapeSql($row['quote_prefix']);
     $quote_number = escapeSql($row['quote_number']);
@@ -555,7 +557,7 @@ if (isset($_GET['decline_quote'])) {
 
     $quote_id = intval($_GET['decline_quote']);
 
-    $sql = mysqli_query($mysqli,"SELECT * FROM quotes WHERE quote_id = $quote_id");
+    $sql = mysqli_query($mysqli,"SELECT quote_client_id, quote_number, quote_prefix FROM quotes WHERE quote_id = $quote_id");
     $row = mysqli_fetch_assoc($sql);
     $quote_prefix = escapeSql($row['quote_prefix']);
     $quote_number = escapeSql($row['quote_number']);
@@ -585,7 +587,9 @@ if (isset($_GET['email_quote'])) {
 
     $quote_id = intval($_GET['email_quote']);
 
-    $sql = mysqli_query($mysqli,"SELECT * FROM quotes
+    $sql = mysqli_query($mysqli,"SELECT client_id, client_name, contact_email, contact_name, quote_amount, quote_currency_code,
+        quote_date, quote_expire, quote_number, quote_prefix, quote_scope, quote_status,
+        quote_url_key FROM quotes
     LEFT JOIN clients ON quote_client_id = client_id
     LEFT JOIN contacts ON clients.client_id = contacts.contact_client_id AND contact_primary = 1
     WHERE quote_id = $quote_id"
@@ -608,7 +612,8 @@ if (isset($_GET['email_quote'])) {
 
     enforceClientAccess();
 
-    $sql = mysqli_query($mysqli,"SELECT * FROM companies WHERE company_id = 1");
+    $sql = mysqli_query($mysqli,"SELECT company_address, company_city, company_country, company_email, company_logo, company_name,
+        company_phone, company_phone_country_code, company_state, company_website, company_zip FROM companies WHERE company_id = 1");
     $row = mysqli_fetch_assoc($sql);
 
     $company_name = escapeSql($row['company_name']);
@@ -667,7 +672,7 @@ if (isset($_GET['mark_quote_invoiced'])) {
 
     $quote_id = intval($_GET['mark_quote_invoiced']);
 
-    $sql = mysqli_query($mysqli,"SELECT * FROM quotes WHERE quote_id = $quote_id");
+    $sql = mysqli_query($mysqli,"SELECT quote_client_id, quote_number, quote_prefix FROM quotes WHERE quote_id = $quote_id");
     $row = mysqli_fetch_assoc($sql);
     $quote_prefix = escapeSql($row['quote_prefix']);
     $quote_number = escapeSql($row['quote_number']);
@@ -771,7 +776,12 @@ if (isset($_GET['export_quote_pdf'])) {
 
     $sql = mysqli_query(
         $mysqli,
-        "SELECT * FROM quotes
+        "SELECT client_currency_code, client_id, client_name, client_net_terms, client_website,
+            contact_email, contact_extension, contact_mobile, contact_mobile_country_code,
+            contact_phone, contact_phone_country_code, location_address, location_city,
+            location_country, location_state, location_zip, quote_amount, quote_category_id,
+            quote_created_at, quote_currency_code, quote_date, quote_discount_amount, quote_expire,
+            quote_id, quote_note, quote_number, quote_prefix, quote_scope, quote_status, quote_url_key FROM quotes
         LEFT JOIN clients ON quote_client_id = client_id
         LEFT JOIN contacts ON clients.client_id = contacts.contact_client_id AND contact_primary = 1
         LEFT JOIN locations ON clients.client_id = locations.location_client_id AND location_primary = 1
@@ -817,7 +827,9 @@ if (isset($_GET['export_quote_pdf'])) {
 
     enforceClientAccess();
 
-    $sql = mysqli_query($mysqli, "SELECT * FROM companies, settings WHERE companies.company_id = settings.company_id AND companies.company_id = 1");
+    $sql = mysqli_query($mysqli, "SELECT company_address, company_city, company_country, company_email, settings.company_id,
+        company_logo, company_name, company_phone, company_phone_country_code, company_state,
+        company_website, company_zip FROM companies, settings WHERE companies.company_id = settings.company_id AND companies.company_id = 1");
     $row = mysqli_fetch_assoc($sql);
 
     $company_id = intval($row['company_id']);

agent/post/recurring_invoice.php

@@ -15,7 +15,8 @@ if (isset($_POST['add_invoice_recurring'])) {
     $invoice_id = intval($_POST['invoice_id']);
     $recurring_invoice_frequency = validateRecurringFrequency($_POST['frequency']);
 
-    $sql = mysqli_query($mysqli,"SELECT * FROM invoices WHERE invoice_id = $invoice_id");
+    $sql = mysqli_query($mysqli,"SELECT invoice_amount, invoice_category_id, invoice_client_id, invoice_currency_code,
+        invoice_date, invoice_note, invoice_number, invoice_prefix, invoice_scope FROM invoices WHERE invoice_id = $invoice_id");
     $row = mysqli_fetch_assoc($sql);
     $invoice_prefix = escapeSql($row['invoice_prefix']);
     $invoice_number = intval($row['invoice_number']);
@@ -182,7 +183,7 @@ if (isset($_GET['delete_recurring_invoice'])) {
     }
 
     //Delete History Associated with the Invoice
-    $sql = mysqli_query($mysqli,"SELECT * FROM history WHERE history_recurring_invoice_id = $recurring_invoice_id");
+    $sql = mysqli_query($mysqli,"SELECT history_id FROM history WHERE history_recurring_invoice_id = $recurring_invoice_id");
     while($row = mysqli_fetch_assoc($sql)) {
         $history_id = intval($row['history_id']);
         mysqli_query($mysqli,"DELETE FROM history WHERE history_id = $history_id");
@@ -217,7 +218,7 @@ if (isset($_POST['add_recurring_invoice_item'])) {
     $subtotal = $price * $qty;
 
     if ($tax_id > 0) {
-        $sql = mysqli_query($mysqli,"SELECT * FROM taxes WHERE tax_id = $tax_id");
+        $sql = mysqli_query($mysqli,"SELECT tax_percent FROM taxes WHERE tax_id = $tax_id");
         $row = mysqli_fetch_assoc($sql);
         $tax_percent = floatval($row['tax_percent']);
         $tax_amount = $subtotal * $tax_percent / 100;
@@ -230,7 +231,8 @@ if (isset($_POST['add_recurring_invoice_item'])) {
     mysqli_query($mysqli,"INSERT INTO recurring_invoice_items SET item_name = '$name', item_description = '$description', item_quantity = $qty, item_price = $price, item_subtotal = $subtotal, item_tax = $tax_amount, item_total = $total, item_tax_id = $tax_id, item_order = $item_order, item_recurring_invoice_id = $recurring_invoice_id");
 
 
-    $sql = mysqli_query($mysqli,"SELECT * FROM recurring_invoices WHERE recurring_invoice_id = $recurring_invoice_id");
+    $sql = mysqli_query($mysqli,"SELECT recurring_invoice_client_id, recurring_invoice_discount_amount, recurring_invoice_number,
+        recurring_invoice_prefix FROM recurring_invoices WHERE recurring_invoice_id = $recurring_invoice_id");
     $row = mysqli_fetch_assoc($sql);
     $recurring_invoice_discount = floatval($row['recurring_invoice_discount_amount']);
     $recurring_invoice_prefix = escapeSql($row['recurring_invoice_prefix']);
@@ -273,7 +275,7 @@ if (isset($_POST['edit_recurring_invoice_item'])) {
     $subtotal = $price * $qty;
 
     if ($tax_id > 0) {
-        $sql = mysqli_query($mysqli,"SELECT * FROM taxes WHERE tax_id = $tax_id");
+        $sql = mysqli_query($mysqli,"SELECT tax_percent FROM taxes WHERE tax_id = $tax_id");
         $row = mysqli_fetch_assoc($sql);
         $tax_percent = floatval($row['tax_percent']);
         $tax_amount = $subtotal * $tax_percent / 100;
@@ -289,7 +291,8 @@ if (isset($_POST['edit_recurring_invoice_item'])) {
     $recurring_invoice_id = intval($row['item_recurring_invoice_id']);
 
     //Get Discount Amount
-    $sql = mysqli_query($mysqli,"SELECT * FROM recurring_invoices WHERE recurring_invoice_id = $recurring_invoice_id");
+    $sql = mysqli_query($mysqli,"SELECT recurring_invoice_client_id, recurring_invoice_discount_amount, recurring_invoice_number,
+        recurring_invoice_prefix FROM recurring_invoices WHERE recurring_invoice_id = $recurring_invoice_id");
     $row = mysqli_fetch_assoc($sql);
     $recurring_invoice_prefix = escapeSql($row['recurring_invoice_prefix']);
     $recurring_invoice_number = intval($row['recurring_invoice_number']);
@@ -352,7 +355,7 @@ if (isset($_GET['delete_recurring_invoice_item'])) {
 
     $item_id = intval($_GET['delete_recurring_invoice_item']);
 
-    $sql = mysqli_query($mysqli,"SELECT * FROM recurring_invoice_items WHERE item_id = $item_id");
+    $sql = mysqli_query($mysqli,"SELECT item_name, item_recurring_invoice_id, item_subtotal, item_tax, item_total FROM recurring_invoice_items WHERE item_id = $item_id");
     $row = mysqli_fetch_assoc($sql);
     $recurring_invoice_id = intval($row['item_recurring_invoice_id']);
     $item_name = escapeSql($row['item_name']);
@@ -360,7 +363,8 @@ if (isset($_GET['delete_recurring_invoice_item'])) {
     $item_tax = floatval($row['item_tax']);
     $item_total = floatval($row['item_total']);
 
-    $sql = mysqli_query($mysqli,"SELECT * FROM recurring_invoices WHERE recurring_invoice_id = $recurring_invoice_id");
+    $sql = mysqli_query($mysqli,"SELECT recurring_invoice_amount, recurring_invoice_client_id, recurring_invoice_number,
+        recurring_invoice_prefix FROM recurring_invoices WHERE recurring_invoice_id = $recurring_invoice_id");
     $row = mysqli_fetch_assoc($sql);
     $recurring_invoice_prefix = escapeSql($row['recurring_invoice_prefix']);
     $recurring_invoice_number = intval($row['recurring_invoice_number']);
@@ -390,7 +394,11 @@ if (isset($_GET['force_recurring'])) {
 
     $recurring_invoice_id = intval($_GET['force_recurring']);
 
-    $sql_recurring_invoices = mysqli_query($mysqli,"SELECT * FROM recurring_invoices, clients WHERE client_id = recurring_invoice_client_id AND recurring_invoice_id = $recurring_invoice_id");
+    $sql_recurring_invoices = mysqli_query($mysqli,"SELECT client_net_terms, recurring_invoice_amount, recurring_invoice_category_id,
+        recurring_invoice_client_id, recurring_invoice_currency_code,
+        recurring_invoice_discount_amount, recurring_invoice_frequency, recurring_invoice_id,
+        recurring_invoice_last_sent, recurring_invoice_next_date, recurring_invoice_note,
+        recurring_invoice_scope, recurring_invoice_status FROM recurring_invoices, clients WHERE client_id = recurring_invoice_client_id AND recurring_invoice_id = $recurring_invoice_id");
 
     $row = mysqli_fetch_assoc($sql_recurring_invoices);
     $recurring_invoice_id = intval($row['recurring_invoice_id']);
@@ -442,7 +450,7 @@ if (isset($_GET['force_recurring'])) {
 
         //Recalculate Item Tax since Tax percents can change.
         if ($tax_id > 0) {
-            $sql = mysqli_query($mysqli,"SELECT * FROM taxes WHERE tax_id = $tax_id");
+            $sql = mysqli_query($mysqli,"SELECT tax_percent FROM taxes WHERE tax_id = $tax_id");
             $row = mysqli_fetch_assoc($sql);
             $tax_percent = floatval($row['tax_percent']);
             $item_tax_amount = $item_subtotal * $tax_percent / 100;
@@ -493,7 +501,7 @@ if (isset($_GET['force_recurring'])) {
         $contact_extension = intval($row['contact_extension']);
         $contact_mobile = escapeSql(formatPhoneNumber($row['contact_mobile'], $row['contact_mobile_country_code']));
 
-        $sql = mysqli_query($mysqli,"SELECT * FROM companies WHERE company_id = 1");
+        $sql = mysqli_query($mysqli,"SELECT company_email, company_name, company_phone, company_phone_country_code, company_website FROM companies WHERE company_id = 1");
         $row = mysqli_fetch_assoc($sql);
         $company_name = escapeSql($row['company_name']);
         $company_phone = escapeSql(formatPhoneNumber($row['company_phone'], $row['company_phone_country_code']));
@@ -559,7 +567,8 @@ if (isset($_POST['set_recurring_payment'])) {
     $saved_payment_id = intval($_POST['saved_payment_id']);
 
     // Get Recurring Invoice Info for logging and alerting
-    $sql = mysqli_query($mysqli, "SELECT * FROM recurring_invoices WHERE recurring_invoice_id = $recurring_invoice_id");
+    $sql = mysqli_query($mysqli, "SELECT recurring_invoice_amount, recurring_invoice_client_id, recurring_invoice_currency_code,
+        recurring_invoice_number, recurring_invoice_prefix FROM recurring_invoices WHERE recurring_invoice_id = $recurring_invoice_id");
     $row = mysqli_fetch_assoc($sql);
     $client_id = intval($row['recurring_invoice_client_id']);
     $recurring_invoice_prefix = escapeSql($row['recurring_invoice_prefix']);
@@ -573,7 +582,8 @@ if (isset($_POST['set_recurring_payment'])) {
 
         // Get Payment provider and method
         $sql = mysqli_query($mysqli, "
-            SELECT * FROM payment_providers
+            SELECT payment_provider_account, payment_provider_id, payment_provider_name,
+                saved_payment_description FROM payment_providers
             LEFT JOIN client_saved_payment_methods ON saved_payment_provider_id = payment_provider_id
             WHERE saved_payment_id = $saved_payment_id
         ");
@@ -703,7 +713,7 @@ if (isset($_GET['recurring_invoice_email_notify'])) {
     $recurring_invoice_email_notify = intval($_GET['recurring_invoice_email_notify']);
     $recurring_invoice_id = intval($_GET['recurring_invoice_id']);
 
-    $sql = mysqli_query($mysqli,"SELECT * FROM recurring_invoices WHERE recurring_invoice_id = $recurring_invoice_id");
+    $sql = mysqli_query($mysqli,"SELECT recurring_invoice_client_id, recurring_invoice_number, recurring_invoice_prefix FROM recurring_invoices WHERE recurring_invoice_id = $recurring_invoice_id");
     $row = mysqli_fetch_assoc($sql);
     $recurring_invoice_prefix = escapeSql($row['recurring_invoice_prefix']);
     $recurring_invoice_number = intval($row['recurring_invoice_number']);

agent/post/recurring_ticket.php

@@ -100,7 +100,10 @@ if (isset($_POST['bulk_force_recurring_tickets'])) {
         foreach ($_POST['recurring_ticket_ids'] as $recurring_ticket_id) {
 
             $recurring_ticket_id = intval($recurring_ticket_id);
-            $sql = mysqli_query($mysqli, "SELECT * FROM recurring_tickets WHERE recurring_ticket_id = $recurring_ticket_id");
+            $sql = mysqli_query($mysqli, "SELECT recurring_ticket_asset_id, recurring_ticket_assigned_to, recurring_ticket_billable,
+                recurring_ticket_category, recurring_ticket_client_id, recurring_ticket_contact_id,
+                recurring_ticket_created_by, recurring_ticket_details, recurring_ticket_frequency,
+                recurring_ticket_next_run, recurring_ticket_priority, recurring_ticket_subject FROM recurring_tickets WHERE recurring_ticket_id = $recurring_ticket_id");
 
             if (mysqli_num_rows($sql) > 0) {
                 $row = mysqli_fetch_assoc($sql);
@@ -244,7 +247,10 @@ if (isset($_GET['force_recurring_ticket'])) {
 
     $recurring_ticket_id = intval($_GET['force_recurring_ticket']);
 
-    $sql = mysqli_query($mysqli, "SELECT * FROM recurring_tickets WHERE recurring_ticket_id = $recurring_ticket_id");
+    $sql = mysqli_query($mysqli, "SELECT recurring_ticket_asset_id, recurring_ticket_assigned_to, recurring_ticket_billable,
+        recurring_ticket_category, recurring_ticket_client_id, recurring_ticket_contact_id,
+        recurring_ticket_created_by, recurring_ticket_details, recurring_ticket_frequency,
+        recurring_ticket_next_run, recurring_ticket_priority, recurring_ticket_subject FROM recurring_tickets WHERE recurring_ticket_id = $recurring_ticket_id");
 
     if (mysqli_num_rows($sql) > 0) {
         $row = mysqli_fetch_assoc($sql);
@@ -389,7 +395,7 @@ if (isset($_GET['delete_recurring_ticket'])) {
     $recurring_ticket_id = intval($_GET['delete_recurring_ticket']);
 
     // Get Scheduled Ticket Subject Ticket Prefix, Number and Client ID for logging and alert message
-    $sql = mysqli_query($mysqli, "SELECT * FROM recurring_tickets WHERE recurring_ticket_id = $recurring_ticket_id");
+    $sql = mysqli_query($mysqli, "SELECT recurring_ticket_client_id, recurring_ticket_frequency, recurring_ticket_subject FROM recurring_tickets WHERE recurring_ticket_id = $recurring_ticket_id");
     $row = mysqli_fetch_assoc($sql);
     $subject = escapeSql($row['recurring_ticket_subject']);
     $frequency = escapeSql($row['recurring_ticket_frequency']);
@@ -424,7 +430,7 @@ if (isset($_POST['bulk_delete_recurring_tickets'])) {
             $recurring_ticket_id = intval($recurring_ticket_id);
 
             // Get Scheduled Ticket Subject Ticket Prefix, Number and Client ID for logging and alert message
-            $sql = mysqli_query($mysqli, "SELECT * FROM recurring_tickets WHERE recurring_ticket_id = $recurring_ticket_id");
+            $sql = mysqli_query($mysqli, "SELECT recurring_ticket_client_id, recurring_ticket_frequency, recurring_ticket_subject FROM recurring_tickets WHERE recurring_ticket_id = $recurring_ticket_id");
             $row = mysqli_fetch_assoc($sql);
             $subject = escapeSql($row['recurring_ticket_subject']);
             $frequency = escapeSql($row['recurring_ticket_frequency']);

agent/post/software.php

@@ -19,7 +19,8 @@ if (isset($_POST['add_software_from_template'])) {
     enforceClientAccess();
 
     // GET Software Template Info
-    $sql_software_templates = mysqli_query($mysqli,"SELECT * FROM software_templates WHERE software_template_id = $software_template_id");
+    $sql_software_templates = mysqli_query($mysqli,"SELECT software_template_description, software_template_license_type, software_template_name,
+        software_template_notes, software_template_type, software_template_version FROM software_templates WHERE software_template_id = $software_template_id");
     $row = mysqli_fetch_assoc($sql_software_templates);
     $name = escapeSql($row['software_template_name']);
     $version = escapeSql($row['software_template_version']);

agent/post/task.php

@@ -43,7 +43,7 @@ if (isset($_POST['edit_ticket_task'])) {
     $task_completion_estimate = intval($_POST['completion_estimate']);
 
     // Get Client ID
-    $sql = mysqli_query($mysqli, "SELECT * FROM tasks LEFT JOIN tickets ON ticket_id = task_ticket_id WHERE task_id = $task_id");
+    $sql = mysqli_query($mysqli, "SELECT ticket_client_id FROM tasks LEFT JOIN tickets ON ticket_id = task_ticket_id WHERE task_id = $task_id");
     $row = mysqli_fetch_assoc($sql);
     $client_id = intval($row['ticket_client_id']);
     enforceClientAccess();
@@ -88,7 +88,7 @@ if (isset($_GET['delete_task'])) {
     $task_id = intval($_GET['delete_task']);
 
     // Get Client ID, task name from tasks and tickets using the task_id
-    $sql = mysqli_query($mysqli, "SELECT * FROM tasks LEFT JOIN tickets ON ticket_id = task_ticket_id WHERE task_id = $task_id");
+    $sql = mysqli_query($mysqli, "SELECT task_name, ticket_client_id FROM tasks LEFT JOIN tickets ON ticket_id = task_ticket_id WHERE task_id = $task_id");
     $row = mysqli_fetch_assoc($sql);
     $client_id = intval($row['ticket_client_id']);
     enforceClientAccess();
@@ -113,7 +113,7 @@ if (isset($_GET['complete_task'])) {
     $task_id = intval($_GET['complete_task']);
 
     // Get Client ID
-    $sql = mysqli_query($mysqli, "SELECT * FROM tasks LEFT JOIN tickets ON ticket_id = task_ticket_id WHERE task_id = $task_id");
+    $sql = mysqli_query($mysqli, "SELECT task_completion_estimate, task_name, ticket_client_id, ticket_id FROM tasks LEFT JOIN tickets ON ticket_id = task_ticket_id WHERE task_id = $task_id");
     $row = mysqli_fetch_assoc($sql);
     $client_id = intval($row['ticket_client_id']);
     enforceClientAccess();
@@ -148,7 +148,7 @@ if (isset($_GET['undo_complete_task'])) {
     $task_id = intval($_GET['undo_complete_task']);
 
     // Get Client ID
-    $sql = mysqli_query($mysqli, "SELECT * FROM tasks LEFT JOIN tickets ON ticket_id = task_ticket_id WHERE task_id = $task_id");
+    $sql = mysqli_query($mysqli, "SELECT task_name, ticket_client_id, ticket_id FROM tasks LEFT JOIN tickets ON ticket_id = task_ticket_id WHERE task_id = $task_id");
     $row = mysqli_fetch_assoc($sql);
     $client_id = intval($row['ticket_client_id']);
     enforceClientAccess();
@@ -192,7 +192,8 @@ if (isset($_POST['add_ticket_task_approver'])) {
 
     // Task/Ticket Info
     $tt_row = mysqli_fetch_assoc(mysqli_query($mysqli, "
-        SELECT * FROM tasks
+        SELECT task_name, task_ticket_id, ticket_client_id, ticket_contact_id, ticket_number,
+            ticket_prefix, ticket_status_name, ticket_subject, ticket_url_key FROM tasks
         LEFT JOIN tickets ON ticket_id = task_ticket_id
         LEFT JOIN ticket_statuses ON ticket_status = ticket_status_id
         WHERE task_id = $task_id LIMIT 1
@@ -354,7 +355,8 @@ if (isset($_GET['approve_ticket_task'])) {
     $task_id = intval($_GET['approve_ticket_task']);
     $approval_id = intval($_GET['approval_id']);
 
-    $approval_row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT * FROM task_approvals LEFT JOIN tasks on task_id = approval_task_id WHERE approval_id = $approval_id AND approval_task_id = $task_id AND approval_scope = 'internal'"));
+    $approval_row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT approval_created_by, approval_required_user_id, approval_scope, approval_type, task_name,
+        task_ticket_id FROM task_approvals LEFT JOIN tasks on task_id = approval_task_id WHERE approval_id = $approval_id AND approval_task_id = $task_id AND approval_scope = 'internal'"));
 
     $task_name = escapeHtml($approval_row['task_name']);
     $scope = escapeHtml($approval_row['approval_scope']);

agent/post/ticket.php

@@ -1171,7 +1171,7 @@ if (isset($_POST['bulk_edit_ticket_priority'])) {
         foreach ($_POST['ticket_ids'] as $ticket_id) {
             $ticket_id = intval($ticket_id);
 
-            $sql = mysqli_query($mysqli, "SELECT * FROM tickets WHERE ticket_id = $ticket_id");
+            $sql = mysqli_query($mysqli, "SELECT ticket_client_id, ticket_number, ticket_prefix, ticket_priority, ticket_subject FROM tickets WHERE ticket_id = $ticket_id");
             $row = mysqli_fetch_assoc($sql);
 
             $ticket_prefix = escapeSql($row['ticket_prefix']);
@@ -1287,7 +1287,8 @@ if (isset($_POST['bulk_merge_tickets'])) {
 
             if ($ticket_id !== $merge_into_ticket_id) {
 
-                $sql = mysqli_query($mysqli, "SELECT * FROM tickets WHERE ticket_id = $ticket_id");
+                $sql = mysqli_query($mysqli, "SELECT ticket_client_id, ticket_details, ticket_first_response_at, ticket_number, ticket_prefix,
+                    ticket_priority, ticket_subject FROM tickets WHERE ticket_id = $ticket_id");
                 $row = mysqli_fetch_assoc($sql);
 
                 $ticket_prefix = escapeSql($row['ticket_prefix']);
@@ -1369,7 +1370,8 @@ if (isset($_POST['bulk_resolve_tickets'])) {
                 // Count the Ticket Loop
                 $ticket_count++;
 
-                $sql = mysqli_query($mysqli, "SELECT * FROM tickets WHERE ticket_id = $ticket_id");
+                $sql = mysqli_query($mysqli, "SELECT ticket_client_id, ticket_first_response_at, ticket_number, ticket_prefix, ticket_priority,
+                    ticket_subject, ticket_url_key FROM tickets WHERE ticket_id = $ticket_id");
                 $row = mysqli_fetch_assoc($sql);
 
                 $ticket_prefix = escapeSql($row['ticket_prefix']);
@@ -1509,7 +1511,8 @@ if (isset($_POST['bulk_ticket_reply'])) {
         foreach ($_POST['ticket_ids'] as $ticket_id) {
             $ticket_id = intval($ticket_id);
 
-            $sql = mysqli_query($mysqli, "SELECT * FROM tickets WHERE ticket_id = $ticket_id");
+            $sql = mysqli_query($mysqli, "SELECT ticket_client_id, ticket_first_response_at, ticket_number, ticket_prefix, ticket_priority,
+                ticket_subject, ticket_url_key FROM tickets WHERE ticket_id = $ticket_id");
             $row = mysqli_fetch_assoc($sql);
 
             $ticket_prefix = escapeSql($row['ticket_prefix']);
@@ -1684,7 +1687,7 @@ if (isset($_POST['bulk_add_ticket_project'])) {
         foreach ($_POST['ticket_ids'] as $ticket_id) {
             $ticket_id = intval($ticket_id);
 
-            $sql = mysqli_query($mysqli, "SELECT * FROM tickets WHERE ticket_id = $ticket_id");
+            $sql = mysqli_query($mysqli, "SELECT ticket_client_id, ticket_number, ticket_prefix, ticket_priority, ticket_subject FROM tickets WHERE ticket_id = $ticket_id");
             $row = mysqli_fetch_assoc($sql);
 
             $ticket_prefix = escapeSql($row['ticket_prefix']);
@@ -1737,7 +1740,7 @@ if (isset($_POST['bulk_add_asset_ticket'])) {
 
     // Check to see if adding a ticket by template
     if($ticket_template_id) {
-        $sql = mysqli_query($mysqli, "SELECT * FROM ticket_templates WHERE ticket_template_id = $ticket_template_id");
+        $sql = mysqli_query($mysqli, "SELECT ticket_template_details, ticket_template_subject FROM ticket_templates WHERE ticket_template_id = $ticket_template_id");
         $row = mysqli_fetch_assoc($sql);
 
         // Override Template Subject
@@ -1756,7 +1759,7 @@ if (isset($_POST['bulk_add_asset_ticket'])) {
         foreach ($_POST['asset_ids'] as $asset_id) {
             $asset_id = intval($asset_id);
 
-            $sql = mysqli_query($mysqli, "SELECT * FROM assets WHERE asset_id = $asset_id");
+            $sql = mysqli_query($mysqli, "SELECT asset_client_id, asset_name FROM assets WHERE asset_id = $asset_id");
             $row = mysqli_fetch_assoc($sql);
 
             $asset_name = escapeSql($row['asset_name']);
@@ -2301,7 +2304,7 @@ if (isset($_GET['resolve_ticket'])) {
 
     $ticket_id = intval($_GET['resolve_ticket']);
 
-    $sql = mysqli_query($mysqli, "SELECT * FROM tickets WHERE ticket_id = $ticket_id");
+    $sql = mysqli_query($mysqli, "SELECT ticket_client_id, ticket_first_response_at, ticket_number, ticket_prefix FROM tickets WHERE ticket_id = $ticket_id");
     $row = mysqli_fetch_assoc($sql);
     $ticket_prefix = escapeSql($row['ticket_prefix']);
     $ticket_number = intval($row['ticket_number']);
@@ -2556,7 +2559,9 @@ if (isset($_POST['add_invoice_from_ticket'])) {
 
     $sql = mysqli_query(
         $mysqli,
-        "SELECT * FROM tickets
+        "SELECT asset_id, client_id, client_net_terms, contact_email, contact_id, contact_name,
+            location_name, ticket_category, ticket_closed_at, ticket_created_at, ticket_number,
+            ticket_prefix, ticket_subject, ticket_updated_at FROM tickets
         LEFT JOIN clients ON ticket_client_id = client_id
         LEFT JOIN contacts ON ticket_contact_id = contact_id
         LEFT JOIN assets ON ticket_asset_id = asset_id
@@ -2626,7 +2631,7 @@ if (isset($_POST['add_invoice_from_ticket'])) {
     $subtotal = $price * $qty;
 
     if ($tax_id > 0) {
-        $sql = mysqli_query($mysqli, "SELECT * FROM taxes WHERE tax_id = $tax_id");
+        $sql = mysqli_query($mysqli, "SELECT tax_percent FROM taxes WHERE tax_id = $tax_id");
         $row = mysqli_fetch_assoc($sql);
         $tax_percent = floatval($row['tax_percent']);
         $tax_amount = $subtotal * $tax_percent / 100;
@@ -2640,7 +2645,7 @@ if (isset($_POST['add_invoice_from_ticket'])) {
 
     //Update Invoice Balances
 
-    $sql = mysqli_query($mysqli, "SELECT * FROM invoices WHERE invoice_id = $invoice_id");
+    $sql = mysqli_query($mysqli, "SELECT invoice_amount FROM invoices WHERE invoice_id = $invoice_id");
     $row = mysqli_fetch_assoc($sql);
 
     $new_invoice_amount = floatval($row['invoice_amount']) + $total;
@@ -2682,7 +2687,7 @@ if (isset($_POST['add_quote_from_ticket'])) {
     $subtotal = $price * $qty;
     $tax_amount = 0;
     if ($tax_id > 0) {
-        $sql = mysqli_query($mysqli, "SELECT * FROM taxes WHERE tax_id = $tax_id");
+        $sql = mysqli_query($mysqli, "SELECT tax_percent FROM taxes WHERE tax_id = $tax_id");
         $row = mysqli_fetch_assoc($sql);
         $tax_percent = floatval($row['tax_percent']);
         $tax_amount = $subtotal * $tax_percent / 100;
@@ -3187,7 +3192,8 @@ if (isset($_GET['cancel_ticket_schedule'])) {
 
     //Send emails
 
-    $sql = mysqli_query($mysqli, "SELECT * FROM tickets
+    $sql = mysqli_query($mysqli, "SELECT client_name, contact_email, contact_name, ticket_client_id, ticket_details, ticket_number,
+        ticket_prefix, ticket_subject, user_email, user_name FROM tickets
         LEFT JOIN clients ON ticket_client_id = client_id
         LEFT JOIN contacts ON ticket_contact_id = contact_id
         LEFT JOIN locations on contact_location_id = location_id

agent/post/transaction.php

@@ -103,7 +103,7 @@ if (isset($_POST['export_transactions'])) {
     if ($account) {
 
         // Account details for the running balance and file name
-        $row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT * FROM accounts WHERE account_id = $account LIMIT 1"));
+        $row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT account_name, opening_balance FROM accounts WHERE account_id = $account LIMIT 1"));
         $account_name = $row['account_name'];
         $account_opening_balance = floatval($row['opening_balance']);
 

agent/post/transfer.php

@@ -78,7 +78,7 @@ if (isset($_GET['delete_transfer'])) {
     $transfer_id = intval($_GET['delete_transfer']);
 
     // Query the transfer ID to get the Payment and Expense IDs, so we can delete those as well
-    $row = mysqli_fetch_assoc(mysqli_query($mysqli,"SELECT * FROM transfers WHERE transfer_id = $transfer_id"));
+    $row = mysqli_fetch_assoc(mysqli_query($mysqli,"SELECT transfer_expense_id, transfer_revenue_id FROM transfers WHERE transfer_id = $transfer_id"));
     $expense_id = intval($row['transfer_expense_id']);
     $revenue_id = intval($row['transfer_revenue_id']);
 

agent/post/trip.php

@@ -65,7 +65,7 @@ if (isset($_GET['delete_trip'])) {
     $trip_id = intval($_GET['delete_trip']);
 
     // Get Trip Info and Client ID for logging
-    $row = mysqli_fetch_assoc(mysqli_query($mysqli,"SELECT * FROM trips WHERE trip_id = $trip_id"));
+    $row = mysqli_fetch_assoc(mysqli_query($mysqli,"SELECT trip_client_id, trip_destination, trip_source FROM trips WHERE trip_id = $trip_id"));
     $client_id = intval($row['trip_client_id']);
     $trip_source = escapeSql($row['trip_source']);
     $trip_destination = escapeSql($row['trip_destination']);

agent/post/vendor.php

@@ -26,7 +26,10 @@ if (isset($_POST['add_vendor_from_template'])) {
     $vendor_template_id = intval($_POST['vendor_template_id']);
 
     //GET Vendor Info
-    $sql_vendor_templates = mysqli_query($mysqli,"SELECT * FROM vendor_templates WHERE vendor_template_id = $vendor_template_id");
+    $sql_vendor_templates = mysqli_query($mysqli,"SELECT vendor_template_account_number, vendor_template_code, vendor_template_contact_name,
+        vendor_template_description, vendor_template_email, vendor_template_extension,
+        vendor_template_hours, vendor_template_name, vendor_template_notes, vendor_template_phone,
+        vendor_template_phone_country_code, vendor_template_sla, vendor_template_website FROM vendor_templates WHERE vendor_template_id = $vendor_template_id");
 
     $row = mysqli_fetch_assoc($sql_vendor_templates);
 
@@ -124,7 +127,7 @@ if (isset($_GET['archive_vendor'])) {
     $vendor_id = intval($_GET['archive_vendor']);
 
     //Get Vendor Name
-    $sql = mysqli_query($mysqli,"SELECT * FROM vendors WHERE vendor_id = $vendor_id");
+    $sql = mysqli_query($mysqli,"SELECT vendor_client_id, vendor_name FROM vendors WHERE vendor_id = $vendor_id");
     $row = mysqli_fetch_assoc($sql);
     $vendor_name = escapeSql($row['vendor_name']);
     $client_id = intval($row['vendor_client_id']);
@@ -184,7 +187,7 @@ if (isset($_GET['delete_vendor'])) {
     $vendor_id = intval($_GET['delete_vendor']);
 
     //Get Vendor Name
-    $sql = mysqli_query($mysqli,"SELECT * FROM vendors WHERE vendor_id = $vendor_id");
+    $sql = mysqli_query($mysqli,"SELECT vendor_client_id, vendor_name, vendor_template_id FROM vendors WHERE vendor_id = $vendor_id");
     $row = mysqli_fetch_assoc($sql);
     $vendor_name = escapeSql($row['vendor_name']);
     $client_id = intval($row['vendor_client_id']);