diff --git a/admin/app_log.php b/admin/app_log.php index 350a9d72..6d64e492 100644 --- a/admin/app_log.php +++ b/admin/app_log.php @@ -8,7 +8,7 @@ require_once "includes/inc_all_admin.php"; // Log Type Filter if (isset($_GET['type']) & !empty($_GET['type'])) { - $log_type_query = "AND (app_log_type = '" . sanitizeInput($_GET['type']) . "')"; + $log_type_query = "AND (app_log_type = '" . escapeSql($_GET['type']) . "')"; $type_filter = escapeHtml($_GET['type']); } else { // Default - any @@ -18,7 +18,7 @@ if (isset($_GET['type']) & !empty($_GET['type'])) { // Log Category Filter if (isset($_GET['category']) & !empty($_GET['catergory'])) { - $log_category_query = "AND (app_log_category = '" . sanitizeInput($_GET['category']) . "')"; + $log_category_query = "AND (app_log_category = '" . escapeSql($_GET['category']) . "')"; $category_filter = escapeHtml($_GET['category']); } else { // Default - any diff --git a/admin/audit_log.php b/admin/audit_log.php index cbac2849..32c54e75 100644 --- a/admin/audit_log.php +++ b/admin/audit_log.php @@ -28,7 +28,7 @@ if (isset($_GET['client']) & !empty($_GET['client'])) { // Log Type Filter if (isset($_GET['type']) & !empty($_GET['type'])) { - $log_type_query = "AND (log_type = '" . sanitizeInput($_GET['type']) . "')"; + $log_type_query = "AND (log_type = '" . escapeSql($_GET['type']) . "')"; $type_filter = escapeHtml($_GET['type']); } else { // Default - any @@ -38,7 +38,7 @@ if (isset($_GET['type']) & !empty($_GET['type'])) { // Log Action Filter if (isset($_GET['action']) & !empty($_GET['action'])) { - $log_action_query = "AND (log_action = '" . sanitizeInput($_GET['action']) . "')"; + $log_action_query = "AND (log_action = '" . escapeSql($_GET['action']) . "')"; $action_filter = escapeHtml($_GET['action']); } else { // Default - any diff --git a/admin/category.php b/admin/category.php index 9e692808..8cf9a647 100644 --- a/admin/category.php +++ b/admin/category.php @@ -8,7 +8,7 @@ require_once "includes/inc_all_admin.php"; if (isset($_GET['category'])) { - $category = sanitizeInput($_GET['category']); + $category = escapeSql($_GET['category']); } else { $category = "Expense"; } diff --git a/admin/database_updates.php b/admin/database_updates.php index c4e8d115..6d52b604 100644 --- a/admin/database_updates.php +++ b/admin/database_updates.php @@ -1668,10 +1668,10 @@ if (LATEST_DATABASE_VERSION > CURRENT_DATABASE_VERSION) { $sql = mysqli_query($mysqli, "SELECT * FROM assets"); while ($row = mysqli_fetch_assoc($sql)) { $asset_id = intval($row['asset_id']); - $mac = sanitizeInput($row['asset_mac']); - $ip = sanitizeInput($row['asset_ip']); - $nat_ip = sanitizeInput($row['asset_nat_ip']); - $ipv6 = sanitizeInput($row['asset_ipv6']); + $mac = escapeSql($row['asset_mac']); + $ip = escapeSql($row['asset_ip']); + $nat_ip = escapeSql($row['asset_nat_ip']); + $ipv6 = escapeSql($row['asset_ipv6']); $network = intval($row['asset_network_id']); mysqli_query($mysqli, "INSERT INTO `asset_interfaces` SET interface_name = 'Primary', interface_mac = '$mac', interface_ip = '$ip', interface_nat_ip = '$nat_ip', interface_ipv6 = '$ipv6', interface_port = 'eth0', interface_primary = 1, interface_network_id = $network, interface_asset_id = $asset_id"); @@ -1793,8 +1793,8 @@ if (LATEST_DATABASE_VERSION > CURRENT_DATABASE_VERSION) { $sql_tickets_2 = mysqli_query($mysqli, "SELECT ticket_id, ticket_updated_at, ticket_closed_at FROM tickets WHERE tickets.ticket_closed_at IS NOT NULL"); foreach ($sql_tickets_2 as $row) { $ticket_id = intval($row['ticket_id']); - $ticket_updated_at = sanitizeInput($row['ticket_updated_at']); // To keep old updated_at time - $ticket_closed_at = sanitizeInput($row['ticket_closed_at']); + $ticket_updated_at = escapeSql($row['ticket_updated_at']); // To keep old updated_at time + $ticket_closed_at = escapeSql($row['ticket_closed_at']); mysqli_query($mysqli, "UPDATE tickets SET ticket_resolved_at = '$ticket_closed_at', ticket_updated_at = '$ticket_updated_at' WHERE ticket_id = '$ticket_id'"); } @@ -3933,7 +3933,7 @@ if (LATEST_DATABASE_VERSION > CURRENT_DATABASE_VERSION) { $sql_categories = mysqli_query($mysqli, "SELECT * FROM categories WHERE category_type = 'Payment Method' AND category_name != 'Stripe' AND category_archived_at IS NULL"); while ($row = mysqli_fetch_assoc($sql_categories)) { - $category_name = sanitizeInput($row['category_name']); + $category_name = escapeSql($row['category_name']); mysqli_query($mysqli,"INSERT INTO payment_methods SET payment_method_name = '$category_name'"); } diff --git a/admin/oauth_microsoft_mail_callback.php b/admin/oauth_microsoft_mail_callback.php index 88b6a066..d863ca24 100644 --- a/admin/oauth_microsoft_mail_callback.php +++ b/admin/oauth_microsoft_mail_callback.php @@ -11,10 +11,10 @@ if (!isset($session_is_admin) || !$session_is_admin) { redirect($settings_mail_path); } -$state = sanitizeInput($_GET['state'] ?? ''); +$state = escapeSql($_GET['state'] ?? ''); $code = $_GET['code'] ?? ''; -$error = sanitizeInput($_GET['error'] ?? ''); -$error_description = sanitizeInput($_GET['error_description'] ?? ''); +$error = escapeSql($_GET['error'] ?? ''); +$error_description = escapeSql($_GET['error_description'] ?? ''); $session_state = $_SESSION['mail_oauth_state'] ?? ''; $session_state_expires = intval($_SESSION['mail_oauth_state_expires_at'] ?? 0); diff --git a/admin/post/ai_model.php b/admin/post/ai_model.php index 9e30d7f1..0782c485 100644 --- a/admin/post/ai_model.php +++ b/admin/post/ai_model.php @@ -11,9 +11,9 @@ if (isset($_POST['add_ai_model'])) { validateCSRFToken($_POST['csrf_token']); $provider_id = intval($_POST['provider']); - $model = sanitizeInput($_POST['model']); - $prompt = sanitizeInput($_POST['prompt']); - $use_case = sanitizeInput($_POST['use_case']); + $model = escapeSql($_POST['model']); + $prompt = escapeSql($_POST['prompt']); + $use_case = escapeSql($_POST['use_case']); mysqli_query($mysqli,"INSERT INTO ai_models SET ai_model_name = '$model', ai_model_prompt = '$prompt', ai_model_use_case = '$use_case', ai_model_ai_provider_id = $provider_id"); @@ -32,9 +32,9 @@ if (isset($_POST['edit_ai_model'])) { validateCSRFToken($_POST['csrf_token']); $model_id = intval($_POST['model_id']); - $model = sanitizeInput($_POST['model']); - $prompt = sanitizeInput($_POST['prompt']); - $use_case = sanitizeInput($_POST['use_case']); + $model = escapeSql($_POST['model']); + $prompt = escapeSql($_POST['prompt']); + $use_case = escapeSql($_POST['use_case']); mysqli_query($mysqli,"UPDATE ai_models SET ai_model_name = '$model', ai_model_prompt = '$prompt', ai_model_use_case = '$use_case' WHERE ai_model_id = $model_id"); @@ -52,7 +52,7 @@ if (isset($_GET['delete_ai_model'])) { $model_id = intval($_GET['delete_ai_model']); - $model_name = sanitizeInput(getFieldById('ai_models', $model_id, 'ai_model_name')); + $model_name = escapeSql(getFieldById('ai_models', $model_id, 'ai_model_name')); mysqli_query($mysqli,"DELETE FROM ai_models WHERE ai_model_id = $model_id"); diff --git a/admin/post/ai_provider.php b/admin/post/ai_provider.php index 3661da61..0fb7f58b 100644 --- a/admin/post/ai_provider.php +++ b/admin/post/ai_provider.php @@ -10,10 +10,10 @@ if (isset($_POST['add_ai_provider'])) { validateCSRFToken($_POST['csrf_token']); - $provider = sanitizeInput($_POST['provider']); - $url = sanitizeInput($_POST['url']); - $model = sanitizeInput($_POST['model']); - $api_key = sanitizeInput($_POST['api_key']); + $provider = escapeSql($_POST['provider']); + $url = escapeSql($_POST['url']); + $model = escapeSql($_POST['model']); + $api_key = escapeSql($_POST['api_key']); mysqli_query($mysqli,"INSERT INTO ai_providers SET ai_provider_name = '$provider', ai_provider_api_url = '$url', ai_provider_api_key = '$api_key'"); @@ -32,9 +32,9 @@ if (isset($_POST['edit_ai_provider'])) { validateCSRFToken($_POST['csrf_token']); $provider_id = intval($_POST['provider_id']); - $provider = sanitizeInput($_POST['provider']); - $url = sanitizeInput($_POST['url']); - $api_key = sanitizeInput($_POST['api_key']); + $provider = escapeSql($_POST['provider']); + $url = escapeSql($_POST['url']); + $api_key = escapeSql($_POST['api_key']); mysqli_query($mysqli,"UPDATE ai_providers SET ai_provider_name = '$provider', ai_provider_api_url = '$url', ai_provider_api_key = '$api_key' WHERE ai_provider_id = $provider_id"); @@ -52,7 +52,7 @@ if (isset($_GET['delete_ai_provider'])) { $provider_id = intval($_GET['delete_ai_provider']); - $provider_name = sanitizeInput(getFieldById('ai_providers', $provider_id, 'ai_provider_name')); + $provider_name = escapeSql(getFieldById('ai_providers', $provider_id, 'ai_provider_name')); mysqli_query($mysqli,"DELETE FROM ai_providers WHERE ai_provider_id = $provider_id"); diff --git a/admin/post/api_keys.php b/admin/post/api_keys.php index 6b500166..013d6527 100644 --- a/admin/post/api_keys.php +++ b/admin/post/api_keys.php @@ -10,10 +10,10 @@ if (isset($_POST['add_api_key'])) { validateCSRFToken($_POST['csrf_token']); - $name = sanitizeInput($_POST['name']); - $expire = sanitizeInput($_POST['expire']); + $name = escapeSql($_POST['name']); + $expire = escapeSql($_POST['expire']); $client_id = intval($_POST['client']); - $secret = sanitizeInput($_POST['key']); // API Key + $secret = escapeSql($_POST['key']); // API Key // Credential decryption password $password = password_hash(trim($_POST['password']), PASSWORD_DEFAULT); @@ -39,7 +39,7 @@ if (isset($_GET['revoke_api_key'])) { // Get API Key Name $row = mysqli_fetch_assoc(mysqli_query($mysqli,"SELECT api_key_name, api_key_client_id FROM api_keys WHERE api_key_id = $api_key_id")); - $api_key_name = sanitizeInput($row['api_key_name']); + $api_key_name = escapeSql($row['api_key_name']); $client_id = intval($row['api_key_client_id']); mysqli_query($mysqli,"UPDATE api_keys SET api_key_expire = NOW() WHERE api_key_id = $api_key_id"); @@ -60,7 +60,7 @@ if (isset($_GET['delete_api_key'])) { // Get API Key Name $row = mysqli_fetch_assoc(mysqli_query($mysqli,"SELECT api_key_name, api_key_client_id FROM api_keys WHERE api_key_id = $api_key_id")); - $api_key_name = sanitizeInput($row['api_key_name']); + $api_key_name = escapeSql($row['api_key_name']); $client_id = intval($row['api_key_client_id']); mysqli_query($mysqli,"DELETE FROM api_keys WHERE api_key_id = $api_key_id"); @@ -88,7 +88,7 @@ if (isset($_POST['bulk_delete_api_keys'])) { // Get API Key Name $row = mysqli_fetch_assoc(mysqli_query($mysqli,"SELECT api_key_name, api_key_client_id FROM api_keys WHERE api_key_id = $api_key_id")); - $api_key_name = sanitizeInput($row['api_key_name']); + $api_key_name = escapeSql($row['api_key_name']); $client_id = intval($row['api_key_client_id']); mysqli_query($mysqli, "DELETE FROM api_keys WHERE api_key_id = $api_key_id"); diff --git a/admin/post/category.php b/admin/post/category.php index 0a6bccf7..33429886 100644 --- a/admin/post/category.php +++ b/admin/post/category.php @@ -51,8 +51,8 @@ if (isset($_GET['archive_category'])) { // Get Category Name and Type for logging $sql = mysqli_query($mysqli,"SELECT category_name, category_type FROM categories WHERE category_id = $category_id"); $row = mysqli_fetch_assoc($sql); - $category_name = sanitizeInput($row['category_name']); - $category_type = sanitizeInput($row['category_type']); + $category_name = escapeSql($row['category_name']); + $category_type = escapeSql($row['category_type']); mysqli_query($mysqli,"UPDATE categories SET category_archived_at = NOW() WHERE category_id = $category_id"); @@ -73,8 +73,8 @@ if (isset($_GET['restore_category'])) { // Get Category Name and Type for logging $sql = mysqli_query($mysqli,"SELECT category_name, category_type FROM categories WHERE category_id = $category_id"); $row = mysqli_fetch_assoc($sql); - $category_name = sanitizeInput($row['category_name']); - $category_type = sanitizeInput($row['category_type']); + $category_name = escapeSql($row['category_name']); + $category_type = escapeSql($row['category_type']); mysqli_query($mysqli,"UPDATE categories SET category_archived_at = NULL WHERE category_id = $category_id"); @@ -95,8 +95,8 @@ if (isset($_GET['delete_category'])) { // Get Category Name and Type for logging $sql = mysqli_query($mysqli,"SELECT category_name, category_type FROM categories WHERE category_id = $category_id"); $row = mysqli_fetch_assoc($sql); - $category_name = sanitizeInput($row['category_name']); - $category_type = sanitizeInput($row['category_type']); + $category_name = escapeSql($row['category_name']); + $category_type = escapeSql($row['category_type']); mysqli_query($mysqli,"DELETE FROM categories WHERE category_id = $category_id"); diff --git a/admin/post/category_model.php b/admin/post/category_model.php index 30268bce..ff17b039 100644 --- a/admin/post/category_model.php +++ b/admin/post/category_model.php @@ -1,7 +1,7 @@
----------------------------------------
YOU ARE A COLLABORATOR ON THIS TICKET"; while ($row = mysqli_fetch_assoc($sql_watchers)) { - $watcher_email = sanitizeInput($row['watcher_email']); + $watcher_email = escapeSql($row['watcher_email']); // Queue Mail $data[] = [ @@ -712,7 +712,7 @@ if (isset($_POST['update_recurring_invoice_items_order'])) { if (isset($_GET['client_duplicate_check'])) { enforceUserPermission('module_client', 2); - $name = sanitizeInput($_GET['name']); + $name = escapeSql($_GET['name']); $response['message'] = ""; // default @@ -736,8 +736,8 @@ if (isset($_GET['client_duplicate_check'])) { if (isset($_GET['contact_email_check'])) { enforceUserPermission('module_client', 2); - $email = sanitizeInput($_GET['email']); - $domain = sanitizeInput(substr($_GET['email'], strpos($_GET['email'], '@') + 1)); + $email = escapeSql($_GET['email']); + $domain = escapeSql(substr($_GET['email'], strpos($_GET['email'], '@') + 1)); $response['message'] = ""; // default @@ -1014,7 +1014,7 @@ if (isset($_GET['ai_ticket_summary'])) { if (isset($_GET['apex_domain_check'])) { enforceUserPermission('module_support', 2); - $domain = sanitizeInput($_GET['domain']); + $domain = escapeSql($_GET['domain']); $response['message'] = ""; // default diff --git a/agent/client_autopay.php b/agent/client_autopay.php index f2eb81cc..ff296f52 100644 --- a/agent/client_autopay.php +++ b/agent/client_autopay.php @@ -17,8 +17,8 @@ $config_stripe_secret = escapeHtml($stripe_vars['config_stripe_secret']); // Get client's StripeID from database $stripe_client_details = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT * FROM client_stripe WHERE client_id = $client_id LIMIT 1")); if ($stripe_client_details) { - $stripe_id = sanitizeInput($stripe_client_details['stripe_id']); - $stripe_pm = sanitizeInput($stripe_client_details['stripe_pm']); + $stripe_id = escapeSql($stripe_client_details['stripe_id']); + $stripe_pm = escapeSql($stripe_client_details['stripe_pm']); } // Stripe not enabled in settings diff --git a/agent/clients.php b/agent/clients.php index 30d62d53..47f871bb 100644 --- a/agent/clients.php +++ b/agent/clients.php @@ -32,7 +32,7 @@ if (isset($_GET['tags']) && is_array($_GET['tags']) && !empty($_GET['tags'])) { // Industry Filter if (isset($_GET['industry']) & !empty($_GET['industry'])) { - $industry_query = "AND (clients.client_type = '" . sanitizeInput($_GET['industry']) . "')"; + $industry_query = "AND (clients.client_type = '" . escapeSql($_GET['industry']) . "')"; $industry_filter = escapeHtml($_GET['industry']); } else { // Default - any @@ -42,7 +42,7 @@ if (isset($_GET['industry']) & !empty($_GET['industry'])) { // Referral Filter if (isset($_GET['referral']) & !empty($_GET['referral'])) { - $referral_query = "AND (clients.client_referral = '" . sanitizeInput($_GET['referral']) . "')"; + $referral_query = "AND (clients.client_referral = '" . escapeSql($_GET['referral']) . "')"; $referral_filter = escapeHtml($_GET['referral']); } else { // Default - any diff --git a/agent/global_search.php b/agent/global_search.php index 4a6229e3..400ef096 100644 --- a/agent/global_search.php +++ b/agent/global_search.php @@ -11,7 +11,7 @@ $purifier = new HTMLPurifier($purifier_config); if (isset($_GET['query'])) { - $query = sanitizeInput($_GET['query']); + $query = escapeSql($_GET['query']); $phone_query = preg_replace("/[^0-9]/", '', $query); if (empty($phone_query)) { diff --git a/agent/modals/product/product_stock_add.php b/agent/modals/product/product_stock_add.php index bcb3ce51..1a19b288 100644 --- a/agent/modals/product/product_stock_add.php +++ b/agent/modals/product/product_stock_add.php @@ -5,7 +5,7 @@ require_once '../../../includes/modal_header.php'; $product_id = intval($_GET['id']); // Get product name -$product_name = sanitizeInput(getFieldById('products', $product_id, 'product_name')); +$product_name = escapeSql(getFieldById('products', $product_id, 'product_name')); // Generate the HTML form content using output buffering. ob_start(); diff --git a/agent/payments.php b/agent/payments.php index 90dfd208..7f1c7890 100644 --- a/agent/payments.php +++ b/agent/payments.php @@ -20,7 +20,7 @@ enforceUserPermission('module_financial'); // Payment Method Filter if (isset($_GET['method']) & !empty($_GET['method'])) { - $payment_method_query = "AND (payment_method = '" . sanitizeInput($_GET['method']) . "')"; + $payment_method_query = "AND (payment_method = '" . escapeSql($_GET['method']) . "')"; $method_filter = escapeHtml($_GET['method']); } else { // Default - any diff --git a/agent/post/account.php b/agent/post/account.php index 9140d250..c40ae8b3 100644 --- a/agent/post/account.php +++ b/agent/post/account.php @@ -12,10 +12,10 @@ if (isset($_POST['add_account'])) { enforceUserPermission('module_financial', 2); - $name = sanitizeInput($_POST['name']); + $name = escapeSql($_POST['name']); $opening_balance = floatval($_POST['opening_balance']); - $currency_code = sanitizeInput($_POST['currency_code']); - $notes = sanitizeInput($_POST['notes']); + $currency_code = escapeSql($_POST['currency_code']); + $notes = escapeSql($_POST['notes']); mysqli_query($mysqli,"INSERT INTO accounts SET account_name = '$name', opening_balance = $opening_balance, account_currency_code = '$currency_code', account_notes = '$notes'"); @@ -34,8 +34,8 @@ if (isset($_POST['edit_account'])) { enforceUserPermission('module_financial', 2); $account_id = intval($_POST['account_id']); - $name = sanitizeInput($_POST['name']); - $notes = sanitizeInput($_POST['notes']); + $name = escapeSql($_POST['name']); + $notes = escapeSql($_POST['notes']); mysqli_query($mysqli,"UPDATE accounts SET account_name = '$name', account_notes = '$notes' WHERE account_id = $account_id"); @@ -55,7 +55,7 @@ if (isset($_GET['archive_account'])) { $account_id = intval($_GET['archive_account']); - $account_name = sanitizeInput(getFieldById('accounts', $account_id, 'account_name')); + $account_name = escapeSql(getFieldById('accounts', $account_id, 'account_name')); mysqli_query($mysqli,"UPDATE accounts SET account_archived_at = NOW() WHERE account_id = $account_id"); @@ -76,7 +76,7 @@ if (isset($_GET['delete_account'])) { $account_id = intval($_GET['delete_account']); - $account_name = sanitizeInput(getFieldById('accounts', $account_id, 'account_name')); + $account_name = escapeSql(getFieldById('accounts', $account_id, 'account_name')); mysqli_query($mysqli,"DELETE FROM accounts WHERE account_id = $account_id"); diff --git a/agent/post/asset.php b/agent/post/asset.php index a7ba2489..9795ee9d 100644 --- a/agent/post/asset.php +++ b/agent/post/asset.php @@ -91,7 +91,7 @@ if (isset($_POST['edit_asset'])) { // Get Existing Photo and assigned client_id $sql = mysqli_query($mysqli,"SELECT asset_photo, asset_client_id FROM assets WHERE asset_id = $asset_id"); $row = mysqli_fetch_assoc($sql); - $existing_file_name = sanitizeInput($row['asset_photo']); + $existing_file_name = escapeSql($row['asset_photo']); $client_id = intval($row['asset_client_id']); enforceClientAccess(); @@ -158,7 +158,7 @@ if (isset($_GET['archive_asset'])) { // Get Asset Name and Client ID for logging and alert message $sql = mysqli_query($mysqli,"SELECT asset_name, asset_client_id FROM assets WHERE asset_id = $asset_id"); $row = mysqli_fetch_assoc($sql); - $asset_name = sanitizeInput($row['asset_name']); + $asset_name = escapeSql($row['asset_name']); $client_id = intval($row['asset_client_id']); enforceClientAccess(); @@ -187,7 +187,7 @@ if (isset($_GET['restore_asset'])) { // Get Asset Name and Client ID for logging and alert message $sql = mysqli_query($mysqli,"SELECT asset_name, asset_client_id FROM assets WHERE asset_id = $asset_id"); $row = mysqli_fetch_assoc($sql); - $asset_name = sanitizeInput($row['asset_name']); + $asset_name = escapeSql($row['asset_name']); $client_id = intval($row['asset_client_id']); enforceClientAccess(); @@ -216,7 +216,7 @@ if (isset($_GET['delete_asset'])) { // Get Asset Name and Client ID for logging and alert message $sql = mysqli_query($mysqli,"SELECT asset_name, asset_client_id FROM assets WHERE asset_id = $asset_id"); $row = mysqli_fetch_assoc($sql); - $asset_name = sanitizeInput($row['asset_name']); + $asset_name = escapeSql($row['asset_name']); $client_id = intval($row['asset_client_id']); enforceClientAccess(); @@ -246,7 +246,7 @@ if (isset($_POST['bulk_assign_asset_tags'])) { $sql = mysqli_query($mysqli,"SELECT asset_name, asset_client_id FROM assets WHERE asset_id = $asset_id"); $row = mysqli_fetch_assoc($sql); - $asset_name = sanitizeInput($row['asset_name']); + $asset_name = escapeSql($row['asset_name']); $client_id = intval($row['asset_client_id']); enforceClientAccess(); @@ -290,7 +290,7 @@ if (isset($_POST['bulk_assign_asset_location'])) { // Get Location name and client id for logging and alert $sql = mysqli_query($mysqli,"SELECT location_name, location_client_id FROM locations WHERE location_id = $location_id"); $row = mysqli_fetch_assoc($sql); - $location_name = sanitizeInput($row['location_name']); + $location_name = escapeSql($row['location_name']); $client_id = intval($row['location_client_id']); enforceClientAccess(); @@ -307,7 +307,7 @@ if (isset($_POST['bulk_assign_asset_location'])) { // Get Asset Details for Logging $sql = mysqli_query($mysqli,"SELECT asset_name, asset_client_id FROM assets WHERE asset_id = $asset_id"); $row = mysqli_fetch_assoc($sql); - $asset_name = sanitizeInput($row['asset_name']); + $asset_name = escapeSql($row['asset_name']); $client_id = intval($row['asset_client_id']); enforceClientAccess(); @@ -333,7 +333,7 @@ if (isset($_POST['bulk_assign_asset_physical_location'])) { enforceUserPermission('module_support', 2); - $physical_location = sanitizeInput($_POST['physical_location']); + $physical_location = escapeSql($_POST['physical_location']); // Assign Physical Location to Selected Assets if (isset($_POST['asset_ids'])) { @@ -347,7 +347,7 @@ if (isset($_POST['bulk_assign_asset_physical_location'])) { // Get Asset Details for Logging $sql = mysqli_query($mysqli,"SELECT asset_name, asset_client_id FROM assets WHERE asset_id = $asset_id"); $row = mysqli_fetch_assoc($sql); - $asset_name = sanitizeInput($row['asset_name']); + $asset_name = escapeSql($row['asset_name']); $client_id = intval($row['asset_client_id']); enforceClientAccess(); @@ -392,15 +392,15 @@ if (isset($_POST['bulk_transfer_client_asset'])) { LEFT JOIN clients ON client_id = asset_client_id WHERE asset_id = $current_asset_id") ); - $asset_name = sanitizeInput($row['asset_name']); - $asset_notes = sanitizeInput($row['asset_notes']); + $asset_name = escapeSql($row['asset_name']); + $asset_notes = escapeSql($row['asset_notes']); $current_client_id = intval($row['asset_client_id']); - $current_client_name = sanitizeInput($row['client_name']); + $current_client_name = escapeSql($row['client_name']); enforceClientAccess($current_client_id); // Get new client name for logging - $new_client_name = sanitizeInput(getFieldById('clients', $new_client_id, 'client_name')); + $new_client_name = escapeSql(getFieldById('clients', $new_client_id, 'client_name')); // Create new asset mysqli_query($mysqli, " @@ -415,8 +415,8 @@ if (isset($_POST['bulk_transfer_client_asset'])) { $sql_interfaces = mysqli_query($mysqli, "SELECT * FROM asset_interfaces WHERE interface_asset_id = $current_asset_id"); while ($row = mysqli_fetch_assoc($sql_interfaces)) { - $interface_name = sanitizeInput($row['interface_name']); - $interface_mac = sanitizeInput($row['interface_mac']); + $interface_name = escapeSql($row['interface_name']); + $interface_mac = escapeSql($row['interface_mac']); $interface_primary = intval($row['interface_primary']); mysqli_query($mysqli,"INSERT INTO asset_interfaces SET interface_name = '$interface_name', interface_mac = '$interface_mac', interface_primary = $interface_primary, interface_asset_id = $new_asset_id"); @@ -468,7 +468,7 @@ if (isset($_POST['bulk_assign_asset_contact'])) { // Get Contact name and client id for logging and Notification $sql = mysqli_query($mysqli,"SELECT contact_name, contact_client_id FROM contacts WHERE contact_id = $contact_id"); $row = mysqli_fetch_assoc($sql); - $contact_name = sanitizeInput($row['contact_name']); + $contact_name = escapeSql($row['contact_name']); $client_id = intval($row['contact_client_id']); enforceClientAccess(); @@ -485,7 +485,7 @@ if (isset($_POST['bulk_assign_asset_contact'])) { // Get Asset Details for Logging $sql = mysqli_query($mysqli,"SELECT asset_name FROM assets WHERE asset_id = $asset_id"); $row = mysqli_fetch_assoc($sql); - $asset_name = sanitizeInput($row['asset_name']); + $asset_name = escapeSql($row['asset_name']); mysqli_query($mysqli,"UPDATE assets SET asset_contact_id = $contact_id WHERE asset_id = $asset_id"); @@ -508,7 +508,7 @@ if (isset($_POST['bulk_edit_asset_status'])) { enforceUserPermission('module_support', 2); - $status = sanitizeInput($_POST['bulk_status']); + $status = escapeSql($_POST['bulk_status']); if (isset($_POST['asset_ids'])) { @@ -520,7 +520,7 @@ if (isset($_POST['bulk_edit_asset_status'])) { // Get Asset Details for Logging $sql = mysqli_query($mysqli,"SELECT asset_name, asset_client_id FROM assets WHERE asset_id = $asset_id"); $row = mysqli_fetch_assoc($sql); - $asset_name = sanitizeInput($row['asset_name']); + $asset_name = escapeSql($row['asset_name']); $client_id = intval($row['asset_client_id']); enforceClientAccess(); @@ -560,7 +560,7 @@ if (isset($_POST['bulk_favorite_assets'])) { // Get Asset Name and Client ID for logging and alert message $sql = mysqli_query($mysqli,"SELECT asset_name, asset_client_id FROM assets WHERE asset_id = $asset_id"); $row = mysqli_fetch_assoc($sql); - $asset_name = sanitizeInput($row['asset_name']); + $asset_name = escapeSql($row['asset_name']); $client_id = intval($row['asset_client_id']); enforceClientAccess(); @@ -598,7 +598,7 @@ if (isset($_POST['bulk_unfavorite_assets'])) { // Get Asset Name and Client ID for logging and alert message $sql = mysqli_query($mysqli,"SELECT asset_name, asset_client_id FROM assets WHERE asset_id = $asset_id"); $row = mysqli_fetch_assoc($sql); - $asset_name = sanitizeInput($row['asset_name']); + $asset_name = escapeSql($row['asset_name']); $client_id = intval($row['asset_client_id']); enforceClientAccess(); @@ -636,7 +636,7 @@ if (isset($_POST['bulk_archive_assets'])) { // Get Asset Name and Client ID for logging and alert message $sql = mysqli_query($mysqli,"SELECT asset_name, asset_client_id FROM assets WHERE asset_id = $asset_id"); $row = mysqli_fetch_assoc($sql); - $asset_name = sanitizeInput($row['asset_name']); + $asset_name = escapeSql($row['asset_name']); $client_id = intval($row['asset_client_id']); enforceClientAccess(); @@ -677,7 +677,7 @@ if (isset($_POST['bulk_restore_assets'])) { // Get Asset Name and Client ID for logging and alert message $sql = mysqli_query($mysqli,"SELECT asset_name, asset_client_id FROM assets WHERE asset_id = $asset_id"); $row = mysqli_fetch_assoc($sql); - $asset_name = sanitizeInput($row['asset_name']); + $asset_name = escapeSql($row['asset_name']); $client_id = intval($row['asset_client_id']); enforceClientAccess(); @@ -719,7 +719,7 @@ if (isset($_POST['bulk_delete_assets'])) { // Get Asset Name and Client ID for logging and alert message $sql = mysqli_query($mysqli,"SELECT asset_name, asset_client_id FROM assets WHERE asset_id = $asset_id"); $row = mysqli_fetch_assoc($sql); - $asset_name = sanitizeInput($row['asset_name']); + $asset_name = escapeSql($row['asset_name']); $client_id = intval($row['asset_client_id']); enforceClientAccess(); @@ -752,13 +752,13 @@ if (isset($_POST['link_software_to_asset'])) { // Get software Name and Client ID for logging $sql_software = mysqli_query($mysqli,"SELECT software_name, software_client_id FROM software WHERE software_id = $software_id"); $row = mysqli_fetch_assoc($sql_software); - $software_name = sanitizeInput($row['software_name']); + $software_name = escapeSql($row['software_name']); $client_id = intval($row['software_client_id']); enforceClientAccess(); // Get Asset Name for logging - $asset_name = sanitizeInput(getFieldById('assets', $asset_id, 'asset_name')); + $asset_name = escapeSql(getFieldById('assets', $asset_id, 'asset_name')); mysqli_query($mysqli,"INSERT INTO software_assets SET asset_id = $asset_id, software_id = $software_id"); @@ -782,13 +782,13 @@ if (isset($_GET['unlink_software_from_asset'])) { // Get software Name and Client ID for logging $sql_software = mysqli_query($mysqli,"SELECT software_name, software_client_id FROM software WHERE software_id = $software_id"); $row = mysqli_fetch_assoc($sql_software); - $software_name = sanitizeInput($row['software_name']); + $software_name = escapeSql($row['software_name']); $client_id = intval($row['software_client_id']); enforceClientAccess(); // Get Asset Name for logging - $asset_name = sanitizeInput(getFieldById('assets', $asset_id, 'asset_name')); + $asset_name = escapeSql(getFieldById('assets', $asset_id, 'asset_name')); mysqli_query($mysqli,"DELETE FROM software_assets WHERE asset_id = $asset_id AND software_id = $software_id"); @@ -813,13 +813,13 @@ if (isset($_POST['link_asset_to_credential'])) { // Get credential Name and Client ID for logging $sql_credential = mysqli_query($mysqli,"SELECT credential_name, credential_client_id FROM credentials WHERE credential_id = $credential_id"); $row = mysqli_fetch_assoc($sql_credential); - $credential_name = sanitizeInput($row['credential_name']); + $credential_name = escapeSql($row['credential_name']); $client_id = intval($row['credential_client_id']); enforceClientAccess(); // Get Asset Name for logging - $asset_name = sanitizeInput(getFieldById('assets', $asset_id, 'asset_name')); + $asset_name = escapeSql(getFieldById('assets', $asset_id, 'asset_name')); mysqli_query($mysqli,"UPDATE credentials SET credential_asset_id = $asset_id WHERE credential_id = $credential_id"); @@ -843,13 +843,13 @@ if (isset($_GET['unlink_credential_from_asset'])) { // Get credential Name and Client ID for logging $sql_credential = mysqli_query($mysqli,"SELECT credential_name, credential_client_id FROM credentials WHERE credential_id = $credential_id"); $row = mysqli_fetch_assoc($sql_credential); - $credential_name = sanitizeInput($row['credential_name']); + $credential_name = escapeSql($row['credential_name']); $client_id = intval($row['credential_client_id']); enforceClientAccess(); // Get Asset Name for logging - $asset_name = sanitizeInput(getFieldById('assets', $asset_id, 'asset_name')); + $asset_name = escapeSql(getFieldById('assets', $asset_id, 'asset_name')); mysqli_query($mysqli,"UPDATE credentials SET credential_asset_id = 0 WHERE credential_id = $credential_id"); @@ -873,13 +873,13 @@ if (isset($_POST['link_service_to_asset'])) { // Get service Name and Client ID for logging $sql_service = mysqli_query($mysqli,"SELECT service_name, service_client_id FROM services WHERE service_id = $service_id"); $row = mysqli_fetch_assoc($sql_service); - $service_name = sanitizeInput($row['service_name']); + $service_name = escapeSql($row['service_name']); $client_id = intval($row['service_client_id']); enforceClientAccess(); // Get Asset Name for logging - $asset_name = sanitizeInput(getFieldById('assets', $asset_id, 'asset_name')); + $asset_name = escapeSql(getFieldById('assets', $asset_id, 'asset_name')); mysqli_query($mysqli,"INSERT INTO service_assets SET asset_id = $asset_id, service_id = $service_id"); @@ -903,13 +903,13 @@ if (isset($_GET['unlink_service_from_asset'])) { // Get service Name and Client ID for logging $sql_service = mysqli_query($mysqli,"SELECT service_name, service_client_id FROM services WHERE service_id = $service_id"); $row = mysqli_fetch_assoc($sql_service); - $service_name = sanitizeInput($row['service_name']); + $service_name = escapeSql($row['service_name']); $client_id = intval($row['service_client_id']); enforceClientAccess(); // Get Asset Name for logging - $asset_name = sanitizeInput(getFieldById('assets', $asset_id, 'asset_name')); + $asset_name = escapeSql(getFieldById('assets', $asset_id, 'asset_name')); mysqli_query($mysqli,"DELETE FROM service_assets WHERE asset_id = $asset_id AND service_id = $service_id"); @@ -933,13 +933,13 @@ if (isset($_POST['link_asset_to_file'])) { // Get file Name and Client ID for logging $sql_file = mysqli_query($mysqli,"SELECT file_name, file_client_id FROM files WHERE file_id = $file_id"); $row = mysqli_fetch_assoc($sql_file); - $file_name = sanitizeInput($row['file_name']); + $file_name = escapeSql($row['file_name']); $client_id = intval($row['file_client_id']); enforceClientAccess(); // Get Asset Name for logging - $asset_name = sanitizeInput(getFieldById('assets', $asset_id, 'asset_name')); + $asset_name = escapeSql(getFieldById('assets', $asset_id, 'asset_name')); // asset add query mysqli_query($mysqli,"INSERT INTO asset_files SET asset_id = $asset_id, file_id = $file_id"); @@ -964,13 +964,13 @@ if (isset($_GET['unlink_asset_from_file'])) { // Get file Name and Client ID for logging $sql_file = mysqli_query($mysqli,"SELECT file_name, file_client_id FROM files WHERE file_id = $file_id"); $row = mysqli_fetch_assoc($sql_file); - $file_name = sanitizeInput($row['file_name']); + $file_name = escapeSql($row['file_name']); $client_id = intval($row['file_client_id']); enforceClientAccess(); // Get Asset Name for logging - $asset_name = sanitizeInput(getFieldById('assets', $asset_id, 'asset_name')); + $asset_name = escapeSql(getFieldById('assets', $asset_id, 'asset_name')); mysqli_query($mysqli,"DELETE FROM asset_files WHERE asset_id = $asset_id AND file_id = $file_id"); @@ -1045,7 +1045,7 @@ if (isset($_POST["import_assets_csv"])) { // Name if (isset($column[0])) { - $name = sanitizeInput($column[0]); + $name = escapeSql($column[0]); if (mysqli_num_rows(mysqli_query($mysqli,"SELECT * FROM assets WHERE asset_name = '$name' AND asset_client_id = $client_id")) > 0) { $duplicate_detect = 1; } @@ -1053,37 +1053,37 @@ if (isset($_POST["import_assets_csv"])) { // Desc if (!empty($column[1])) { - $description = sanitizeInput($column[1]); + $description = escapeSql($column[1]); } // Type if (!empty($column[2])) { - $type = sanitizeInput($column[2]); + $type = escapeSql($column[2]); } // Make if (!empty($column[3])) { - $make = sanitizeInput($column[3]); + $make = escapeSql($column[3]); } // Model if (!empty($column[4])) { - $model = sanitizeInput($column[4]); + $model = escapeSql($column[4]); } // Serial if (!empty($column[5])) { - $serial = sanitizeInput($column[5]); + $serial = escapeSql($column[5]); } // OS if (!empty($column[6])) { - $os = sanitizeInput($column[6]); + $os = escapeSql($column[6]); } // Purchase date if (!empty($column[7])) { - $purchase_date = sanitizeInput($column[7]); + $purchase_date = escapeSql($column[7]); if (!preg_match('/^\d{4}-\d{2}-\d{2}$/', $purchase_date) || empty($purchase_date)) { $purchase_date = "NULL"; @@ -1094,7 +1094,7 @@ if (isset($_POST["import_assets_csv"])) { // Assigned to (contact) if (!empty($column[8])) { - $contact = sanitizeInput($column[8]); + $contact = escapeSql($column[8]); if ($contact) { $sql_contact = mysqli_query($mysqli,"SELECT * FROM contacts WHERE contact_name = '$contact' AND contact_client_id = $client_id"); $row = mysqli_fetch_assoc($sql_contact); @@ -1104,7 +1104,7 @@ if (isset($_POST["import_assets_csv"])) { // Location (lookup) if (!empty($column[9])) { - $location = sanitizeInput($column[9]); + $location = escapeSql($column[9]); if ($location) { $sql_location = mysqli_query($mysqli,"SELECT * FROM locations WHERE location_name = '$location' AND location_client_id = $client_id"); $row = mysqli_fetch_assoc($sql_location); @@ -1114,12 +1114,12 @@ if (isset($_POST["import_assets_csv"])) { // Physical location (varchar) if (!empty($column[10])) { - $physical_location = sanitizeInput($column[10]); + $physical_location = escapeSql($column[10]); } // Notes (varchar) if (!empty($column[11])) { - $notes = sanitizeInput($column[11]); + $notes = escapeSql($column[11]); } // Check if duplicate was detected @@ -1271,7 +1271,7 @@ if (isset($_POST['add_asset_interface'])) { WHERE asset_id = $asset_id "); $row = mysqli_fetch_assoc($sql); - $asset_name = sanitizeInput($row['asset_name']); + $asset_name = escapeSql($row['asset_name']); $client_id = intval($row['asset_client_id']); enforceClientAccess(); @@ -1335,14 +1335,14 @@ if (isset($_POST['add_asset_multiple_interfaces'])) { $asset_id = intval($_POST['asset_id']); $interface_start = intval($_POST['interface_start']); $interfaces = intval($_POST['interfaces']); - $type = sanitizeInput($_POST['type']); - $name_prefix = sanitizeInput($_POST['name_prefix']); + $type = escapeSql($_POST['type']); + $name_prefix = escapeSql($_POST['name_prefix']); $network = intval($_POST['network']); - $notes = sanitizeInput($_POST['notes']); + $notes = escapeSql($_POST['notes']); $sql = mysqli_query($mysqli, "SELECT asset_name, asset_client_id FROM assets WHERE asset_id = $asset_id"); $row = mysqli_fetch_assoc($sql); - $asset_name = sanitizeInput($row['asset_name']); + $asset_name = escapeSql($row['asset_name']); $client_id = intval($row['asset_client_id']); enforceClientAccess(); @@ -1393,7 +1393,7 @@ if (isset($_POST['edit_asset_interface'])) { "); $row = mysqli_fetch_assoc($sql); $asset_id = intval($row['asset_id']); - $asset_name= sanitizeInput($row['asset_name']); + $asset_name= escapeSql($row['asset_name']); $client_id = intval($row['asset_client_id']); enforceClientAccess(); @@ -1471,8 +1471,8 @@ if (isset($_GET['delete_asset_interface'])) { "); $row = mysqli_fetch_assoc($sql); $asset_id = intval($row['asset_id']); - $interface_name = sanitizeInput($row['interface_name']); - $asset_name = sanitizeInput($row['asset_name']); + $interface_name = escapeSql($row['interface_name']); + $asset_name = escapeSql($row['asset_name']); $client_id = intval($row['asset_client_id']); enforceClientAccess(); @@ -1505,7 +1505,7 @@ if (isset($_POST['bulk_edit_asset_interface_type'])) { enforceUserPermission('module_support', 2); - $type = sanitizeInput($_POST['bulk_type']); + $type = escapeSql($_POST['bulk_type']); if (isset($_POST['interface_ids'])) { @@ -1524,7 +1524,7 @@ if (isset($_POST['bulk_edit_asset_interface_type'])) { "); $row = mysqli_fetch_assoc($sql); $asset_id = intval($row['asset_id']); - $asset_name= sanitizeInput($row['asset_name']); + $asset_name= escapeSql($row['asset_name']); $client_id = intval($row['asset_client_id']); enforceClientAccess(); @@ -1554,7 +1554,7 @@ if (isset($_POST['bulk_edit_asset_interface_network'])) { $network_id = intval($_POST['bulk_network']); // Get Network Name for logging - $network_name = sanitizeInput(getFieldById('networks', $network_id, 'network_name')); + $network_name = escapeSql(getFieldById('networks', $network_id, 'network_name')); if (isset($_POST['interface_ids'])) { @@ -1573,7 +1573,7 @@ if (isset($_POST['bulk_edit_asset_interface_network'])) { "); $row = mysqli_fetch_assoc($sql); $asset_id = intval($row['asset_id']); - $asset_name= sanitizeInput($row['asset_name']); + $asset_name= escapeSql($row['asset_name']); $client_id = intval($row['asset_client_id']); enforceClientAccess(); @@ -1616,7 +1616,7 @@ if (isset($_POST['bulk_edit_asset_interface_ip_dhcp'])) { "); $row = mysqli_fetch_assoc($sql); $asset_id = intval($row['asset_id']); - $asset_name= sanitizeInput($row['asset_name']); + $asset_name= escapeSql($row['asset_name']); $client_id = intval($row['asset_client_id']); enforceClientAccess(); @@ -1660,8 +1660,8 @@ if (isset($_POST['bulk_delete_asset_interfaces'])) { "); $row = mysqli_fetch_assoc($sql); $asset_id = intval($row['asset_id']); - $interface_name = sanitizeInput($row['interface_name']); - $asset_name = sanitizeInput($row['asset_name']); + $interface_name = escapeSql($row['interface_name']); + $asset_name = escapeSql($row['asset_name']); $client_id = intval($row['asset_client_id']); enforceClientAccess(); @@ -1693,7 +1693,7 @@ if (isset($_POST["import_client_asset_interfaces_csv"])) { $sql_asset = mysqli_query($mysqli,"SELECT * FROM assets WHERE asset_id = $asset_id"); $row = mysqli_fetch_assoc($sql_asset); $client_id = intval($row['asset_client_id']); - $asset_name = sanitizeInput($row['asset_name']); + $asset_name = escapeSql($row['asset_name']); enforceClientAccess(); @@ -1742,31 +1742,31 @@ if (isset($_POST["import_client_asset_interfaces_csv"])) { $duplicate_detect = 0; if (isset($column[0])) { - $name = sanitizeInput($column[0]); + $name = escapeSql($column[0]); if (mysqli_num_rows(mysqli_query($mysqli,"SELECT interface_name FROM asset_interfaces WHERE interface_asset_id = $asset_id AND interface_name = '$name'")) > 0) { $duplicate_detect = 1; } } if (!empty($column[1])) { - $description = sanitizeInput($column[1]); + $description = escapeSql($column[1]); } if (!empty($column[2])) { - $type = sanitizeInput($column[2]); + $type = escapeSql($column[2]); } if (!empty($column[3])) { - $mac = sanitizeInput($column[3]); + $mac = escapeSql($column[3]); } if (!empty($column[4])) { - $ip = sanitizeInput($column[4]); + $ip = escapeSql($column[4]); } if (!empty($column[5])) { - $nat_ip = sanitizeInput($column[5]); + $nat_ip = escapeSql($column[5]); } if (!empty($column[6])) { - $ipv6 = sanitizeInput($column[6]); + $ipv6 = escapeSql($column[6]); } if (!empty($column[7])) { - $network = sanitizeInput($column[7]); + $network = escapeSql($column[7]); if ($network) { $sql_network = mysqli_query($mysqli,"SELECT * FROM networks WHERE network_name = '$network' AND network_archived_at IS NULL AND network_client_id = $client_id"); $row = mysqli_fetch_assoc($sql_network); diff --git a/agent/post/asset_interface_model.php b/agent/post/asset_interface_model.php index 52ff3347..f9616b8f 100644 --- a/agent/post/asset_interface_model.php +++ b/agent/post/asset_interface_model.php @@ -1,17 +1,17 @@ $old_value) { $new_value = $new_certificate_info[$column]; if ($old_value != $new_value && !in_array($column, $ignored_columns)) { - $column = sanitizeInput($column); - $old_value = sanitizeInput($old_value); - $new_value = sanitizeInput($new_value); + $column = escapeSql($column); + $old_value = escapeSql($old_value); + $new_value = escapeSql($new_value); mysqli_query($mysqli,"INSERT INTO certificate_history SET certificate_history_column = '$column', certificate_history_old_value = '$old_value', certificate_history_new_value = '$new_value', certificate_history_certificate_id = $certificate_id"); } } @@ -130,7 +130,7 @@ if (isset($_GET['archive_certificate'])) { // Get Certificate Name and Client ID for logging and alert message $sql = mysqli_query($mysqli,"SELECT certificate_name, certificate_client_id FROM certificates WHERE certificate_id = $certificate_id"); $row = mysqli_fetch_assoc($sql); - $certificate_name = sanitizeInput($row['certificate_name']); + $certificate_name = escapeSql($row['certificate_name']); $client_id = intval($row['certificate_client_id']); enforceClientAccess(); @@ -156,7 +156,7 @@ if (isset($_GET['restore_certificate'])) { // Get Certificate Name and Client ID for logging and alert message $sql = mysqli_query($mysqli,"SELECT certificate_name, certificate_client_id FROM certificates WHERE certificate_id = $certificate_id"); $row = mysqli_fetch_assoc($sql); - $certificate_name = sanitizeInput($row['certificate_name']); + $certificate_name = escapeSql($row['certificate_name']); $client_id = intval($row['certificate_client_id']); enforceClientAccess(); @@ -182,7 +182,7 @@ if (isset($_GET['delete_certificate'])) { // Get Certificate Name and Client ID for logging and alert message $sql = mysqli_query($mysqli,"SELECT certificate_name, certificate_client_id FROM certificates WHERE certificate_id = $certificate_id"); $row = mysqli_fetch_assoc($sql); - $certificate_name = sanitizeInput($row['certificate_name']); + $certificate_name = escapeSql($row['certificate_name']); $client_id = intval($row['certificate_client_id']); enforceClientAccess(); @@ -216,7 +216,7 @@ if (isset($_POST['bulk_delete_certificates'])) { // Get Certificate Name and Client ID for logging and alert message $sql = mysqli_query($mysqli,"SELECT certificate_name, certificate_client_id FROM certificates WHERE certificate_id = $certificate_id"); $row = mysqli_fetch_assoc($sql); - $certificate_name = sanitizeInput($row['certificate_name']); + $certificate_name = escapeSql($row['certificate_name']); $client_id = intval($row['certificate_client_id']); enforceClientAccess(); diff --git a/agent/post/certificate_model.php b/agent/post/certificate_model.php index bbf42827..3d8f5a00 100644 --- a/agent/post/certificate_model.php +++ b/agent/post/certificate_model.php @@ -1,11 +1,11 @@ 0) { $duplicate_detect = 1; } @@ -588,22 +588,22 @@ if (isset($_POST["import_clients_csv"])) { $industry = ''; if (isset($column[1])) { - $industry = sanitizeInput($column[1]); + $industry = escapeSql($column[1]); } $referral = ''; if (isset($column[2])) { - $referral = sanitizeInput($column[2]); + $referral = escapeSql($column[2]); } $website = ''; if (isset($column[3])) { - $website = sanitizeInput(preg_replace("(^https?://)", "", $column[3])); + $website = escapeSql(preg_replace("(^https?://)", "", $column[3])); } $location_name = ''; if (isset($column[4])) { - $location_name = sanitizeInput($column[4]); + $location_name = escapeSql($column[4]); } $location_phone = ''; @@ -613,37 +613,37 @@ if (isset($_POST["import_clients_csv"])) { $address = ''; if (isset($column[6])) { - $address = sanitizeInput($column[6]); + $address = escapeSql($column[6]); } $city = ''; if (isset($column[7])) { - $city = sanitizeInput($column[7]); + $city = escapeSql($column[7]); } $state = ''; if (isset($column[8])) { - $state = sanitizeInput($column[8]); + $state = escapeSql($column[8]); } $zip = ''; if (isset($column[9])) { - $zip = sanitizeInput($column[9]); + $zip = escapeSql($column[9]); } $country = ''; if (isset($column[10])) { - $country = sanitizeInput($column[10]); + $country = escapeSql($column[10]); } $contact_name = ''; if (isset($column[11])) { - $contact_name = sanitizeInput($column[11]); + $contact_name = escapeSql($column[11]); } $title = ''; if (isset($column[12])) { - $title = sanitizeInput($column[12]); + $title = escapeSql($column[12]); } $contact_phone = ''; @@ -663,7 +663,7 @@ if (isset($_POST["import_clients_csv"])) { $contact_email = ''; if (isset($column[16])) { - $contact_email = sanitizeInput($column[16]); + $contact_email = escapeSql($column[16]); } $hourly_rate = $config_default_hourly_rate; @@ -671,24 +671,24 @@ if (isset($_POST["import_clients_csv"])) { $hourly_rate = floatval($column[17]); } - $currency_code = sanitizeInput($session_company_currency); + $currency_code = escapeSql($session_company_currency); if (isset($column[18])) { - $currency_code = sanitizeInput($column[18]); + $currency_code = escapeSql($column[18]); } - $payment_terms = sanitizeInput($config_default_net_terms); + $payment_terms = escapeSql($config_default_net_terms); if (isset($column[19])) { $payment_terms = intval($column[19]); } $tax_id_number = ''; if (isset($column[20])) { - $tax_id_number = sanitizeInput($column[20]); + $tax_id_number = escapeSql($column[20]); } $abbreviation = ''; if (isset($column[21])) { - $abbreviation = sanitizeInput($column[21]); + $abbreviation = escapeSql($column[21]); } // Check if duplicate was detected @@ -783,8 +783,8 @@ if (isset($_POST['bulk_add_client_ticket'])) { } else { $ticket_status = 2; } - $subject = sanitizeInput($_POST['bulk_subject']); - $priority = sanitizeInput($_POST['bulk_priority']); + $subject = escapeSql($_POST['bulk_subject']); + $priority = escapeSql($_POST['bulk_priority']); $category_id = intval($_POST['bulk_category']); $details = mysqli_real_escape_string($mysqli, $_POST['bulk_details']); $project_id = intval($_POST['bulk_project']); @@ -799,7 +799,7 @@ if (isset($_POST['bulk_add_client_ticket'])) { // Override Template Subject if(empty($subject)) { - $subject = sanitizeInput($row['ticket_template_subject']); + $subject = escapeSql($row['ticket_template_subject']); } $details = mysqli_escape_string($mysqli, $row['ticket_template_details']); @@ -820,7 +820,7 @@ if (isset($_POST['bulk_add_client_ticket'])) { $sql = mysqli_query($mysqli, "SELECT * FROM clients WHERE client_id = $client_id"); $row = mysqli_fetch_assoc($sql); - $client_name = sanitizeInput($row['client_name']); + $client_name = escapeSql($row['client_name']); // Atomically increment and get the new ticket number mysqli_query($mysqli, " @@ -834,10 +834,10 @@ if (isset($_POST['bulk_add_client_ticket'])) { $ticket_number = mysqli_insert_id($mysqli); // Sanitize Config Vars from get_settings.php and Session Vars from check_login.php - $config_ticket_prefix = sanitizeInput($config_ticket_prefix); - $config_ticket_from_name = sanitizeInput($config_ticket_from_name); - $config_ticket_from_email = sanitizeInput($config_ticket_from_email); - $config_base_url = sanitizeInput($config_base_url); + $config_ticket_prefix = escapeSql($config_ticket_prefix); + $config_ticket_from_name = escapeSql($config_ticket_from_name); + $config_ticket_from_email = escapeSql($config_ticket_from_email); + $config_base_url = escapeSql($config_base_url); //Generate a unique URL key for clients to access $url_key = randomString(32); @@ -849,7 +849,7 @@ if (isset($_POST['bulk_add_client_ticket'])) { // Add Tasks if (!empty($_POST['tasks'])) { foreach ($_POST['tasks'] as $task) { - $task_name = sanitizeInput($task); + $task_name = escapeSql($task); // Check that task_name is not-empty (For some reason the !empty on the array doesnt work here like in watchers) if (!empty($task_name)) { mysqli_query($mysqli,"INSERT INTO tasks SET task_name = '$task_name', task_ticket_id = $ticket_id"); @@ -862,7 +862,7 @@ if (isset($_POST['bulk_add_client_ticket'])) { if (mysqli_num_rows($sql_task_templates) > 0) { while ($row = mysqli_fetch_assoc($sql_task_templates)) { $task_order = intval($row['task_template_order']); - $task_name = sanitizeInput($row['task_template_name']); + $task_name = escapeSql($row['task_template_name']); mysqli_query($mysqli,"INSERT INTO tasks SET task_name = '$task_name', task_order = $task_order, task_ticket_id = $ticket_id"); } @@ -889,7 +889,7 @@ if (isset($_POST['bulk_edit_client_industry'])) { enforceUserPermission('module_client', 2); - $industry = sanitizeInput($_POST['bulk_industry']); + $industry = escapeSql($_POST['bulk_industry']); if (isset($_POST['client_ids'])) { @@ -900,7 +900,7 @@ if (isset($_POST['bulk_edit_client_industry'])) { $sql = mysqli_query($mysqli,"SELECT client_name FROM clients WHERE client_id = $client_id"); $row = mysqli_fetch_assoc($sql); - $client_name = sanitizeInput($row['client_name']); + $client_name = escapeSql($row['client_name']); mysqli_query($mysqli,"UPDATE clients SET client_type = '$industry' WHERE client_id = $client_id"); @@ -923,7 +923,7 @@ if (isset($_POST['bulk_edit_client_referral'])) { enforceUserPermission('module_client', 2); - $referral = sanitizeInput($_POST['bulk_referral']); + $referral = escapeSql($_POST['bulk_referral']); if (isset($_POST['client_ids'])) { @@ -934,7 +934,7 @@ if (isset($_POST['bulk_edit_client_referral'])) { $sql = mysqli_query($mysqli,"SELECT client_name FROM clients WHERE client_id = $client_id"); $row = mysqli_fetch_assoc($sql); - $client_name = sanitizeInput($row['client_name']); + $client_name = escapeSql($row['client_name']); mysqli_query($mysqli,"UPDATE clients SET client_referral = '$referral' WHERE client_id = $client_id"); @@ -968,7 +968,7 @@ if (isset($_POST['bulk_edit_client_hourly_rate'])) { $sql = mysqli_query($mysqli,"SELECT client_name FROM clients WHERE client_id = $client_id"); $row = mysqli_fetch_assoc($sql); - $client_name = sanitizeInput($row['client_name']); + $client_name = escapeSql($row['client_name']); mysqli_query($mysqli,"UPDATE clients SET client_rate = '$rate' WHERE client_id = $client_id"); @@ -1002,7 +1002,7 @@ if (isset($_POST['bulk_edit_client_net_terms'])) { $sql = mysqli_query($mysqli,"SELECT client_name FROM clients WHERE client_id = $client_id"); $row = mysqli_fetch_assoc($sql); - $client_name = sanitizeInput($row['client_name']); + $client_name = escapeSql($row['client_name']); mysqli_query($mysqli,"UPDATE clients SET client_net_terms = $net_terms WHERE client_id = $client_id"); @@ -1034,7 +1034,7 @@ if (isset($_POST['bulk_assign_client_tags'])) { $sql = mysqli_query($mysqli,"SELECT client_name FROM clients WHERE client_id = $client_id"); $row = mysqli_fetch_assoc($sql); - $client_name = sanitizeInput($row['client_name']); + $client_name = escapeSql($row['client_name']); if ($_POST['bulk_remove_tags']) { mysqli_query($mysqli, "DELETE FROM client_tags WHERE client_id = $client_id"); @@ -1074,11 +1074,11 @@ if (isset($_POST['bulk_send_client_email']) && isset($_POST['client_ids'])) { $count = count($client_ids); // Email metadata - $mail_from = sanitizeInput($_POST['mail_from']); - $mail_from_name = sanitizeInput($_POST['mail_from_name']); - $subject = sanitizeInput($_POST['subject']); + $mail_from = escapeSql($_POST['mail_from']); + $mail_from_name = escapeSql($_POST['mail_from_name']); + $subject = escapeSql($_POST['subject']); $body = mysqli_real_escape_string($mysqli, $_POST['body']); - $queued_at = sanitizeInput($_POST['queued_at']); + $queued_at = escapeSql($_POST['queued_at']); // Build contact type filters $filters = []; @@ -1115,7 +1115,7 @@ if (isset($_POST['bulk_send_client_email']) && isset($_POST['client_ids'])) { $unique_contacts = []; while ($row = mysqli_fetch_assoc($result)) { - $contact_email = sanitizeInput($row['contact_email']); + $contact_email = escapeSql($row['contact_email']); // Skip if email is missing or invalid if (empty($contact_email) || !filter_var($contact_email, FILTER_VALIDATE_EMAIL)) { @@ -1128,7 +1128,7 @@ if (isset($_POST['bulk_send_client_email']) && isset($_POST['client_ids'])) { } $unique_contacts[$contact_email] = true; - $contact_name = sanitizeInput($row['contact_name']); + $contact_name = escapeSql($row['contact_name']); $data[] = [ 'from' => $mail_from, @@ -1169,7 +1169,7 @@ if (isset($_POST['bulk_archive_clients'])) { $sql = mysqli_query($mysqli,"SELECT client_name FROM clients WHERE client_id = $client_id"); $row = mysqli_fetch_assoc($sql); - $client_name = sanitizeInput($row['client_name']); + $client_name = escapeSql($row['client_name']); mysqli_query($mysqli,"UPDATE clients SET client_archived_at = NOW() WHERE client_id = $client_id"); @@ -1205,7 +1205,7 @@ if (isset($_POST['bulk_unarchive_clients'])) { $sql = mysqli_query($mysqli,"SELECT client_name FROM clients WHERE client_id = $client_id"); $row = mysqli_fetch_assoc($sql); - $client_name = sanitizeInput($row['client_name']); + $client_name = escapeSql($row['client_name']); mysqli_query($mysqli,"UPDATE clients SET client_archived_at = NULL WHERE client_id = $client_id"); diff --git a/agent/post/contact.php b/agent/post/contact.php index 2da5871e..8c187e5d 100644 --- a/agent/post/contact.php +++ b/agent/post/contact.php @@ -96,7 +96,7 @@ if (isset($_POST['edit_contact'])) { // Get Contact Info $sql = mysqli_query($mysqli,"SELECT contact_photo, contact_user_id, contact_client_id FROM contacts WHERE contact_id = $contact_id"); $row = mysqli_fetch_assoc($sql); - $existing_file_name = sanitizeInput($row['contact_photo']); + $existing_file_name = escapeSql($row['contact_photo']); $contact_user_id = intval($row['contact_user_id']); $client_id = intval($row['contact_client_id']); @@ -175,17 +175,17 @@ if (isset($_POST['edit_contact'])) { if ($send_email && $auth_method && $config_smtp_provider && $contact_user_id) { // Sanitize Config vars from get_settings.php - $config_ticket_from_email = sanitizeInput($config_ticket_from_email); - $config_ticket_from_name = sanitizeInput($config_ticket_from_name); - $config_mail_from_email = sanitizeInput($config_mail_from_email); - $config_mail_from_name = sanitizeInput($config_mail_from_name); - $config_base_url = sanitizeInput($config_base_url); + $config_ticket_from_email = escapeSql($config_ticket_from_email); + $config_ticket_from_name = escapeSql($config_ticket_from_name); + $config_mail_from_email = escapeSql($config_mail_from_email); + $config_mail_from_name = escapeSql($config_mail_from_name); + $config_base_url = escapeSql($config_base_url); // Get Company Phone Number $sql = mysqli_query($mysqli,"SELECT company_name, company_phone FROM companies WHERE company_id = 1"); $row = mysqli_fetch_assoc($sql); - $company_name = sanitizeInput($row['company_name']); - $company_phone = sanitizeInput(formatPhoneNumber($row['company_phone'])); + $company_name = escapeSql($row['company_name']); + $company_phone = escapeSql(formatPhoneNumber($row['company_phone'])); // Authentication info (azure, reset password, or tech-provided temporary password) @@ -234,13 +234,13 @@ if (isset($_POST['add_contact_note'])) { enforceUserPermission('module_client', 2); $contact_id = intval($_POST['contact_id']); - $type = sanitizeInput($_POST['type']); - $note = sanitizeInput($_POST['note']); + $type = escapeSql($_POST['type']); + $note = escapeSql($_POST['note']); // Get Contact details for logging and alerting $sql = mysqli_query($mysqli,"SELECT contact_name, contact_client_id FROM contacts WHERE contact_id = $contact_id"); $row = mysqli_fetch_assoc($sql); - $contact_name = sanitizeInput($row['contact_name']); + $contact_name = escapeSql($row['contact_name']); $client_id = intval($row['contact_client_id']); enforceClientAccess(); @@ -269,8 +269,8 @@ if (isset($_GET['archive_contact_note'])) { // Get Contact Name and Client ID for logging and alert message $sql = mysqli_query($mysqli,"SELECT contact_note_type, contact_id, contact_name, contact_client_id FROM contact_notes LEFT JOIN contacts ON contact_id = contact_note_contact_id WHERE contact_note_id = $contact_note_id"); $row = mysqli_fetch_assoc($sql); - $contact_note_type = sanitizeInput($row['contact_note_type']); - $contact_name = sanitizeInput($row['contact_name']); + $contact_note_type = escapeSql($row['contact_note_type']); + $contact_name = escapeSql($row['contact_name']); $client_id = intval($row['contact_client_id']); $contact_id = intval($row['contact_id']); @@ -297,8 +297,8 @@ if (isset($_GET['restore_contact_note'])) { // Get Contact Name and Client ID for logging and alert message $sql = mysqli_query($mysqli,"SELECT contact_note_type, contact_id, contact_name, contact_client_id FROM contact_notes LEFT JOIN contacts ON contact_id = contact_note_contact_id WHERE contact_note_id = $contact_note_id"); $row = mysqli_fetch_assoc($sql); - $contact_note_type = sanitizeInput($row['contact_note_type']); - $contact_name = sanitizeInput($row['contact_name']); + $contact_note_type = escapeSql($row['contact_note_type']); + $contact_name = escapeSql($row['contact_name']); $client_id = intval($row['contact_client_id']); $contact_id = intval($row['contact_id']); @@ -325,8 +325,8 @@ if (isset($_GET['delete_contact_note'])) { // Get Contact Name and Client ID for logging and alert message $sql = mysqli_query($mysqli,"SELECT contact_note_type, contact_id, contact_name, contact_client_id FROM contact_notes LEFT JOIN contacts ON contact_id = contact_note_contact_id WHERE contact_note_id = $contact_note_id"); $row = mysqli_fetch_assoc($sql); - $contact_note_type = sanitizeInput($row['contact_note_type']); - $contact_name = sanitizeInput($row['contact_name']); + $contact_note_type = escapeSql($row['contact_note_type']); + $contact_name = escapeSql($row['contact_name']); $client_id = intval($row['contact_client_id']); $contact_id = intval($row['contact_id']); @@ -353,7 +353,7 @@ if (isset($_POST['bulk_assign_contact_location'])) { // Get Location name for logging and Notification $sql = mysqli_query($mysqli,"SELECT location_name, location_client_id FROM locations WHERE location_id = $location_id"); $row = mysqli_fetch_assoc($sql); - $location_name = sanitizeInput($row['location_name']); + $location_name = escapeSql($row['location_name']); $client_id = intval($row['location_client_id']); enforceClientAccess(); @@ -370,7 +370,7 @@ if (isset($_POST['bulk_assign_contact_location'])) { // Get Contact Details for Logging $sql = mysqli_query($mysqli,"SELECT contact_name FROM contacts WHERE contact_id = $contact_id"); $row = mysqli_fetch_assoc($sql); - $contact_name = sanitizeInput($row['contact_name']); + $contact_name = escapeSql($row['contact_name']); mysqli_query($mysqli,"UPDATE contacts SET contact_location_id = $location_id WHERE contact_id = $contact_id"); @@ -407,7 +407,7 @@ if (isset($_POST['bulk_edit_contact_phone'])) { // Get Contact Details for Logging $sql = mysqli_query($mysqli,"SELECT contact_name, contact_client_id FROM contacts WHERE contact_id = $contact_id"); $row = mysqli_fetch_assoc($sql); - $contact_name = sanitizeInput($row['contact_name']); + $contact_name = escapeSql($row['contact_name']); $client_id = intval($row['contact_client_id']); enforceClientAccess(); @@ -433,7 +433,7 @@ if (isset($_POST['bulk_edit_contact_department'])) { enforceUserPermission('module_client', 2); - $department = sanitizeInput($_POST['bulk_department']); + $department = escapeSql($_POST['bulk_department']); // Assign Location to Selected Contacts if (isset($_POST['contact_ids'])) { @@ -447,7 +447,7 @@ if (isset($_POST['bulk_edit_contact_department'])) { // Get Contact Details for Logging $sql = mysqli_query($mysqli,"SELECT contact_name, contact_client_id FROM contacts WHERE contact_id = $contact_id"); $row = mysqli_fetch_assoc($sql); - $contact_name = sanitizeInput($row['contact_name']); + $contact_name = escapeSql($row['contact_name']); $client_id = intval($row['contact_client_id']); enforceClientAccess(); @@ -489,7 +489,7 @@ if (isset($_POST['bulk_edit_contact_role'])) { // Get Contact Details for Logging $sql = mysqli_query($mysqli,"SELECT contact_name, contact_client_id FROM contacts WHERE contact_id = $contact_id"); $row = mysqli_fetch_assoc($sql); - $contact_name = sanitizeInput($row['contact_name']); + $contact_name = escapeSql($row['contact_name']); $client_id = intval($row['contact_client_id']); enforceClientAccess(); @@ -529,7 +529,7 @@ if (isset($_POST['bulk_assign_contact_tags'])) { // Get Contact Details for Logging $sql = mysqli_query($mysqli,"SELECT contact_name, contact_client_id FROM contacts WHERE contact_id = $contact_id"); $row = mysqli_fetch_assoc($sql); - $contact_name = sanitizeInput($row['contact_name']); + $contact_name = escapeSql($row['contact_name']); $client_id = intval($row['contact_client_id']); enforceClientAccess(); @@ -574,11 +574,11 @@ if (isset($_POST['send_bulk_mail_now'])) { $count = count($_POST['contact_ids']); - $mail_from = sanitizeInput($_POST['mail_from']); - $mail_from_name = sanitizeInput($_POST['mail_from_name']); - $subject = sanitizeInput($_POST['subject']); + $mail_from = escapeSql($_POST['mail_from']); + $mail_from_name = escapeSql($_POST['mail_from_name']); + $subject = escapeSql($_POST['subject']); $body = mysqli_escape_string($mysqli, $_POST['body']); - $queued_at = sanitizeInput($_POST['queued_at']); + $queued_at = escapeSql($_POST['queued_at']); // Add Emails foreach($_POST['contact_ids'] as $contact_id) { @@ -586,8 +586,8 @@ if (isset($_POST['send_bulk_mail_now'])) { $sql = mysqli_query($mysqli,"SELECT * FROM contacts WHERE contact_id = $contact_id"); $row = mysqli_fetch_assoc($sql); - $contact_name = sanitizeInput($row['contact_name']); - $contact_email = sanitizeInput($row['contact_email']); + $contact_name = escapeSql($row['contact_name']); + $contact_email = escapeSql($row['contact_email']); $client_id = intval($row['contact_client_id']); enforceClientAccess(); @@ -633,7 +633,7 @@ if (isset($_POST['bulk_archive_contacts'])) { // Get Contact Name and Client ID for logging and alert message $sql = mysqli_query($mysqli,"SELECT contact_name, contact_client_id, contact_primary, contact_user_id FROM contacts WHERE contact_id = $contact_id"); $row = mysqli_fetch_assoc($sql); - $contact_name = sanitizeInput($row['contact_name']); + $contact_name = escapeSql($row['contact_name']); $contact_primary = intval($row['contact_primary']); $client_id = intval($row['contact_client_id']); $contact_user_id = intval($row['contact_user_id']); @@ -685,7 +685,7 @@ if (isset($_POST['bulk_restore_contacts'])) { // Get Contact Name and Client ID for logging and alert message $sql = mysqli_query($mysqli,"SELECT contact_name, contact_client_id, contact_user_id FROM contacts WHERE contact_id = $contact_id"); $row = mysqli_fetch_assoc($sql); - $contact_name = sanitizeInput($row['contact_name']); + $contact_name = escapeSql($row['contact_name']); $client_id = intval($row['contact_client_id']); $contact_user_id = intval($row['contact_user_id']); @@ -730,7 +730,7 @@ if (isset($_POST['bulk_delete_contacts'])) { // Get Name and Client ID for logging and alert message $sql = mysqli_query($mysqli,"SELECT contact_name, contact_client_id, contact_user_id FROM contacts WHERE contact_id = $contact_id"); $row = mysqli_fetch_assoc($sql); - $contact_name = sanitizeInput($row['contact_name']); + $contact_name = escapeSql($row['contact_name']); $client_id = intval($row['contact_client_id']); $contact_user_id = intval($row['contact_user_id']); @@ -769,10 +769,10 @@ if (isset($_GET['anonymize_contact'])) { $sql = mysqli_query($mysqli,"SELECT contact_name, contact_email, contact_client_id, contact_user_id FROM contacts WHERE contact_id = $contact_id"); $row = mysqli_fetch_assoc($sql); - $contact_name = sanitizeInput($row['contact_name']); + $contact_name = escapeSql($row['contact_name']); $contact_first_name = explode(" ", $contact_name)[0]; - $contact_email = sanitizeInput($row['contact_email']); - $contact_phone = sanitizeInput($row['contact_phone']); + $contact_email = escapeSql($row['contact_email']); + $contact_phone = escapeSql($row['contact_phone']); $info_to_redact = array($contact_name, $contact_first_name, $contact_email, $contact_phone); $client_id = intval($row['contact_client_id']); @@ -813,7 +813,7 @@ if (isset($_GET['anonymize_contact'])) { $log_id = intval($log['log_id']); $description = $log['log_description']; $description = str_ireplace($info_to_redact, "*****", $description); - $description = sanitizeInput($description); + $description = escapeSql($description); mysqli_query($mysqli,"UPDATE logs SET log_description = '$description' WHERE log_id = $log_id AND log_client_id = $client_id"); } @@ -828,14 +828,14 @@ if (isset($_GET['anonymize_contact'])) { // Redact contact name or email in the subject of all tickets they raised $subject = $ticket['ticket_subject']; $subject = str_ireplace($info_to_redact, "*****", $subject); - $subject = sanitizeInput($subject); + $subject = escapeSql($subject); mysqli_query($mysqli,"UPDATE tickets SET ticket_subject = '$subject' WHERE ticket_id = $ticket_id"); // Redact contact name or email in the description of all tickets they raised $details = $ticket['ticket_details']; $details = str_ireplace($info_to_redact, "*****", $details); - $details = sanitizeInput($details); + $details = escapeSql($details); mysqli_query($mysqli,"UPDATE tickets SET ticket_details = '$details' WHERE ticket_id = $ticket_id"); // Redact contact name or email in the replies of all tickets they raised @@ -845,7 +845,7 @@ if (isset($_GET['anonymize_contact'])) { $ticket_reply_id = intval($ticket_reply['ticket_reply_id']); $ticket_reply_details = $ticket_reply['ticket_reply']; $ticket_reply_details = str_ireplace($info_to_redact, "*****", $ticket_reply_details); - $ticket_reply_details = sanitizeInput($ticket_reply_details); + $ticket_reply_details = escapeSql($ticket_reply_details); mysqli_query($mysqli,"UPDATE ticket_replies SET ticket_reply = '$ticket_reply_details' WHERE ticket_reply_id = $ticket_reply_id" @@ -876,7 +876,7 @@ if (isset($_GET['archive_contact'])) { // Get Contact Name and Client ID for logging and alert message $sql = mysqli_query($mysqli,"SELECT contact_name, contact_client_id, contact_user_id FROM contacts WHERE contact_id = $contact_id"); $row = mysqli_fetch_assoc($sql); - $contact_name = sanitizeInput($row['contact_name']); + $contact_name = escapeSql($row['contact_name']); $client_id = intval($row['contact_client_id']); $contact_user_id = intval($row['contact_user_id']); @@ -908,7 +908,7 @@ if (isset($_GET['restore_contact'])) { // Get Contact Name and Client ID for logging and alert message $sql = mysqli_query($mysqli,"SELECT contact_name, contact_client_id, contact_user_id FROM contacts WHERE contact_id = $contact_id"); $row = mysqli_fetch_assoc($sql); - $contact_name = sanitizeInput($row['contact_name']); + $contact_name = escapeSql($row['contact_name']); $client_id = intval($row['contact_client_id']); $contact_user_id = intval($row['contact_user_id']); @@ -940,7 +940,7 @@ if (isset($_GET['delete_contact'])) { // Get Contact Name and Client ID for logging and alert message $sql = mysqli_query($mysqli,"SELECT contact_name, contact_client_id FROM contacts WHERE contact_id = $contact_id"); $row = mysqli_fetch_assoc($sql); - $contact_name = sanitizeInput($row['contact_name']); + $contact_name = escapeSql($row['contact_name']); $client_id = intval($row['contact_client_id']); $contact_user_id = intval($row['contact_user_id']); @@ -973,13 +973,13 @@ if (isset($_POST['link_contact_to_asset'])) { // Get Asset Name and Client ID for logging $sql_asset = mysqli_query($mysqli,"SELECT asset_name, asset_client_id FROM assets WHERE asset_id = $asset_id"); $row = mysqli_fetch_assoc($sql_asset); - $asset_name = sanitizeInput($row['asset_name']); + $asset_name = escapeSql($row['asset_name']); $client_id = intval($row['asset_client_id']); enforceClientAccess(); // Get Contact Name for logging - $contact_name = sanitizeInput(getFieldById('contacts', $contact_id, 'contact_name')); + $contact_name = escapeSql(getFieldById('contacts', $contact_id, 'contact_name')); mysqli_query($mysqli,"UPDATE assets SET asset_contact_id = $contact_id WHERE asset_id = $asset_id"); @@ -1003,13 +1003,13 @@ if (isset($_GET['unlink_asset_from_contact'])) { // Get asset Name and Client ID for logging $sql_asset = mysqli_query($mysqli,"SELECT asset_name, asset_client_id FROM assets WHERE asset_id = $asset_id"); $row = mysqli_fetch_assoc($sql_asset); - $asset_name = sanitizeInput($row['asset_name']); + $asset_name = escapeSql($row['asset_name']); $client_id = intval($row['asset_client_id']); enforceClientAccess(); // Get Contact Name for logging - $contact_name = sanitizeInput(getFieldById('contacts', $contact_id, 'contact_name')); + $contact_name = escapeSql(getFieldById('contacts', $contact_id, 'contact_name')); mysqli_query($mysqli,"UPDATE assets SET asset_contact_id = 0 WHERE asset_id = $asset_id"); @@ -1033,13 +1033,13 @@ if (isset($_POST['link_software_to_contact'])) { // Get software Name and Client ID for logging $sql_software = mysqli_query($mysqli,"SELECT software_name, software_client_id FROM software WHERE software_id = $software_id"); $row = mysqli_fetch_assoc($sql_software); - $software_name = sanitizeInput($row['software_name']); + $software_name = escapeSql($row['software_name']); $client_id = intval($row['software_client_id']); enforceClientAccess(); // Get Contact Name for logging - $contact_name = sanitizeInput(getFieldById('contacts', $contact_id, 'contact_name')); + $contact_name = escapeSql(getFieldById('contacts', $contact_id, 'contact_name')); mysqli_query($mysqli,"INSERT INTO software_contacts SET contact_id = $contact_id, software_id = $software_id"); @@ -1063,13 +1063,13 @@ if (isset($_GET['unlink_software_from_contact'])) { // Get software Name and Client ID for logging $sql_software = mysqli_query($mysqli,"SELECT software_name, software_client_id FROM software WHERE software_id = $software_id"); $row = mysqli_fetch_assoc($sql_software); - $software_name = sanitizeInput($row['software_name']); + $software_name = escapeSql($row['software_name']); $client_id = intval($row['software_client_id']); enforceClientAccess(); // Get Contact Name for logging - $contact_name = sanitizeInput(getFieldById('contacts', $contact_id, 'contact_name')); + $contact_name = escapeSql(getFieldById('contacts', $contact_id, 'contact_name')); mysqli_query($mysqli,"DELETE FROM software_contacts WHERE contact_id = $contact_id AND software_id = $software_id"); @@ -1093,13 +1093,13 @@ if (isset($_POST['link_contact_to_credential'])) { // Get credential Name and Client ID for logging $sql_credential = mysqli_query($mysqli,"SELECT credential_name, credential_client_id FROM credentials WHERE credential_id = $credential_id"); $row = mysqli_fetch_assoc($sql_credential); - $credential_name = sanitizeInput($row['credential_name']); + $credential_name = escapeSql($row['credential_name']); $client_id = intval($row['credential_client_id']); enforceClientAccess(); // Get Contact Name for logging - $contact_name = sanitizeInput(getFieldById('contacts', $contact_id, 'contact_name')); + $contact_name = escapeSql(getFieldById('contacts', $contact_id, 'contact_name')); mysqli_query($mysqli,"UPDATE credentials SET credential_contact_id = $contact_id WHERE credential_id = $credential_id"); @@ -1123,13 +1123,13 @@ if (isset($_GET['unlink_credential_from_contact'])) { // Get credential Name and Client ID for logging $sql_credential = mysqli_query($mysqli,"SELECT credential_name, credential_client_id FROM credentials WHERE credential_id = $credential_id"); $row = mysqli_fetch_assoc($sql_credential); - $credential_name = sanitizeInput($row['credential_name']); + $credential_name = escapeSql($row['credential_name']); $client_id = intval($row['credential_client_id']); enforceClientAccess(); // Get Contact Name for logging - $contact_name = sanitizeInput(getFieldById('contacts', $contact_id, 'contact_name')); + $contact_name = escapeSql(getFieldById('contacts', $contact_id, 'contact_name')); mysqli_query($mysqli,"UPDATE credentials SET credential_contact_id = 0 WHERE credential_id = $credential_id"); @@ -1153,13 +1153,13 @@ if (isset($_POST['link_service_to_contact'])) { // Get service Name and Client ID for logging $sql_service = mysqli_query($mysqli,"SELECT service_name, service_client_id FROM services WHERE service_id = $service_id"); $row = mysqli_fetch_assoc($sql_service); - $service_name = sanitizeInput($row['service_name']); + $service_name = escapeSql($row['service_name']); $client_id = intval($row['service_client_id']); enforceClientAccess(); // Get Contact Name for logging - $contact_name = sanitizeInput(getFieldById('contacts', $contact_id, 'contact_name')); + $contact_name = escapeSql(getFieldById('contacts', $contact_id, 'contact_name')); mysqli_query($mysqli,"INSERT INTO service_contacts SET contact_id = $contact_id, service_id = $service_id"); @@ -1183,13 +1183,13 @@ if (isset($_GET['unlink_service_from_contact'])) { // Get service Name and Client ID for logging $sql_service = mysqli_query($mysqli,"SELECT service_name, service_client_id FROM services WHERE service_id = $service_id"); $row = mysqli_fetch_assoc($sql_service); - $service_name = sanitizeInput($row['service_name']); + $service_name = escapeSql($row['service_name']); $client_id = intval($row['service_client_id']); enforceClientAccess(); // Get Contact Name for logging - $contact_name = sanitizeInput(getFieldById('contacts', $contact_id, 'contact_name')); + $contact_name = escapeSql(getFieldById('contacts', $contact_id, 'contact_name')); mysqli_query($mysqli,"DELETE FROM service_contacts WHERE contact_id = $contact_id AND service_id = $service_id"); @@ -1213,13 +1213,13 @@ if (isset($_POST['link_contact_to_file'])) { // Get file Name and Client ID for logging $sql_file = mysqli_query($mysqli,"SELECT file_name, file_client_id FROM files WHERE file_id = $file_id"); $row = mysqli_fetch_assoc($sql_file); - $file_name = sanitizeInput($row['file_name']); + $file_name = escapeSql($row['file_name']); $client_id = intval($row['file_client_id']); enforceClientAccess(); // Get Contact Name for logging - $contact_name = sanitizeInput(getFieldById('contacts', $contact_id, 'contact_name')); + $contact_name = escapeSql(getFieldById('contacts', $contact_id, 'contact_name')); // Contact add query mysqli_query($mysqli,"INSERT INTO contact_files SET contact_id = $contact_id, file_id = $file_id"); @@ -1244,13 +1244,13 @@ if (isset($_GET['unlink_contact_from_file'])) { // Get file Name and Client ID for logging $sql_file = mysqli_query($mysqli,"SELECT file_name, file_client_id FROM files WHERE file_id = $file_id"); $row = mysqli_fetch_assoc($sql_file); - $file_name = sanitizeInput($row['file_name']); + $file_name = escapeSql($row['file_name']); $client_id = intval($row['file_client_id']); enforceClientAccess(); // Get Contact Name for logging - $contact_name = sanitizeInput(getFieldById('contacts', $contact_id, 'contact_name')); + $contact_name = escapeSql(getFieldById('contacts', $contact_id, 'contact_name')); mysqli_query($mysqli,"DELETE FROM contact_files WHERE contact_id = $contact_id AND file_id = $file_id"); @@ -1370,19 +1370,19 @@ if (isset($_POST["import_contacts_csv"])) { while(($column = fgetcsv($file, 1000, ",")) !== false) { $duplicate_detect = 0; if (isset($column[0])) { - $name = sanitizeInput($column[0]); + $name = escapeSql($column[0]); if (mysqli_num_rows(mysqli_query($mysqli,"SELECT * FROM contacts WHERE contact_name = '$name' AND contact_client_id = $client_id")) > 0) { $duplicate_detect = 1; } } if (isset($column[1])) { - $title = sanitizeInput($column[1]); + $title = escapeSql($column[1]); } if (isset($column[2])) { - $department = sanitizeInput($column[2]); + $department = escapeSql($column[2]); } if (isset($column[3])) { - $email = sanitizeInput($column[3]); + $email = escapeSql($column[3]); } if (isset($column[4])) { $phone = preg_replace("/[^0-9]/", '',$column[4]); @@ -1394,7 +1394,7 @@ if (isset($_POST["import_contacts_csv"])) { $mobile = preg_replace("/[^0-9]/", '',$column[6]); } if (isset($column[7])) { - $location = sanitizeInput($column[7]); + $location = escapeSql($column[7]); $sql_location = mysqli_query($mysqli,"SELECT * FROM locations WHERE location_name = '$location' AND location_client_id = $client_id"); $row = mysqli_fetch_assoc($sql_location); $location_id = intval($row['location_id']); diff --git a/agent/post/contact_model.php b/agent/post/contact_model.php index dde1a191..9b3226c8 100644 --- a/agent/post/contact_model.php +++ b/agent/post/contact_model.php @@ -1,20 +1,20 @@ 0){ $duplicate_detect = 1; } } // Desc if (isset($column[1])) { - $description = sanitizeInput($column[1]); + $description = escapeSql($column[1]); } // User if (isset($column[2])) { - $username = sanitizeInput(encryptCredentialEntry($column[2])); + $username = escapeSql(encryptCredentialEntry($column[2])); } // Pass if (isset($column[3])) { - $password = sanitizeInput(encryptCredentialEntry($column[3])); + $password = escapeSql(encryptCredentialEntry($column[3])); } // OTP if (isset($column[4])) { - $totp = sanitizeInput($column[4]); + $totp = escapeSql($column[4]); } // URL if (isset($column[4])) { - $uri = sanitizeInput($column[5]); + $uri = escapeSql($column[5]); } // Check if duplicate was detected diff --git a/agent/post/credential_model.php b/agent/post/credential_model.php index f55e3272..4d839ac2 100644 --- a/agent/post/credential_model.php +++ b/agent/post/credential_model.php @@ -2,14 +2,14 @@ // Model of reusable variables for client credentials - not to be confused with the ITFLow login process defined('FROM_POST_HANDLER') || die("Direct file access is not allowed"); -$name = sanitizeInput($_POST['name']); -$description = sanitizeInput($_POST['description']); -$uri = sanitizeInput($_POST['uri']); -$uri_2 = sanitizeInput($_POST['uri_2']); +$name = escapeSql($_POST['name']); +$description = escapeSql($_POST['description']); +$uri = escapeSql($_POST['uri']); +$uri_2 = escapeSql($_POST['uri_2']); $username = encryptCredentialEntry(trim($_POST['username'])); $password = encryptCredentialEntry(trim($_POST['password'])); -$otp_secret = sanitizeInput($_POST['otp_secret']); -$note = sanitizeInput($_POST['note']); +$otp_secret = escapeSql($_POST['otp_secret']); +$note = escapeSql($_POST['note']); $favorite = intval($_POST['favorite'] ?? 0); $contact_id = intval($_POST['contact'] ?? 0); $asset_id = intval($_POST['asset'] ?? 0); diff --git a/agent/post/credit.php b/agent/post/credit.php index 5bfcaa02..fb0d3f39 100644 --- a/agent/post/credit.php +++ b/agent/post/credit.php @@ -14,9 +14,9 @@ if (isset($_POST['add_credit'])) { $client_id = intval($_POST['client']); $amount = floatval($_POST['amount']); - $type = sanitizeInput($_POST['type']); - $expire = sanitizeInput($_POST['expire']); - $note = sanitizeInput($_POST['note']); + $type = escapeSql($_POST['type']); + $expire = escapeSql($_POST['expire']); + $note = escapeSql($_POST['note']); mysqli_query($mysqli,"INSERT INTO credits SET credit_amount = $amount, credit_type = '$type', credit_note = '$note', credit_created_by = $session_user_id, credit_client_id = $client_id"); diff --git a/agent/post/document.php b/agent/post/document.php index b0703075..a952ab39 100644 --- a/agent/post/document.php +++ b/agent/post/document.php @@ -60,8 +60,8 @@ if (isset($_POST['add_document_from_template'])) { enforceUserPermission('module_support', 2); $client_id = intval($_POST['client_id']); - $document_name = sanitizeInput($_POST['name']); - $document_description = sanitizeInput($_POST['description']); + $document_name = escapeSql($_POST['name']); + $document_description = escapeSql($_POST['description']); $document_template_id = intval($_POST['document_template_id']); $folder = intval($_POST['folder']); @@ -76,7 +76,7 @@ if (isset($_POST['add_document_from_template'])) { $row = mysqli_fetch_assoc($sql_document); - $document_template_name = sanitizeInput($row['document_template_name']); + $document_template_name = escapeSql($row['document_template_name']); $template_content_html = $row['document_template_content']; // raw HTML from template // 1) Create the new document with placeholder content to get an ID @@ -110,7 +110,7 @@ if (isset($_POST['add_document_from_template'])) { // 4) Prepare content + content_raw $content = mysqli_real_escape_string($mysqli, $processed_html); - $content_raw = sanitizeInput( + $content_raw = escapeSql( $document_name . " " . str_replace("<", " <", $processed_html) ); $content_raw = mysqli_real_escape_string($mysqli, $content_raw); @@ -161,13 +161,13 @@ if (isset($_POST['edit_document'])) { $row = mysqli_fetch_assoc($sql_original_document); - $original_document_name = sanitizeInput($row['document_name']); - $original_document_description = sanitizeInput($row['document_description']); + $original_document_name = escapeSql($row['document_name']); + $original_document_description = escapeSql($row['document_description']); $original_document_content = mysqli_real_escape_string($mysqli, $row['document_content']); $original_document_created_by = intval($row['document_created_by']); $original_document_updated_by = intval($row['document_updated_by']); - $original_document_created_at = sanitizeInput($row['document_created_at']); - $original_document_updated_at = sanitizeInput($row['document_updated_at']); + $original_document_created_at = escapeSql($row['document_created_at']); + $original_document_updated_at = escapeSql($row['document_updated_at']); if ($original_document_updated_at) { $document_version_created_at = $original_document_updated_at; @@ -211,7 +211,7 @@ if (isset($_POST['edit_document'])) { $content = mysqli_real_escape_string($mysqli, $processed_html); // Rebuild content_raw for full-text search - $content_raw = sanitizeInput( + $content_raw = escapeSql( $name . " " . str_replace("<", " <", $processed_html) ); $content_raw = mysqli_real_escape_string($mysqli, $content_raw); @@ -254,7 +254,7 @@ if (isset($_POST['move_document'])) { // Get Document Name Client ID for logging $sql_document = mysqli_query($mysqli,"SELECT document_name, document_client_id FROM documents WHERE document_id = $document_id"); $row = mysqli_fetch_assoc($sql_document); - $document_name = sanitizeInput($row['document_name']); + $document_name = escapeSql($row['document_name']); $client_id = intval($row['document_client_id']); enforceClientAccess(); @@ -262,7 +262,7 @@ if (isset($_POST['move_document'])) { // Get Folder Name for logging $sql_folder = mysqli_query($mysqli,"SELECT folder_name FROM folders WHERE folder_id = $folder_id"); $row = mysqli_fetch_assoc($sql_folder); - $folder_name = sanitizeInput($row['folder_name']); + $folder_name = escapeSql($row['folder_name']); // Document edit query mysqli_query($mysqli,"UPDATE documents SET document_folder_id = $folder_id, document_updated_at = document_updated_at WHERE document_id = $document_id"); @@ -282,7 +282,7 @@ if (isset($_POST['rename_document'])) { enforceUserPermission('module_support', 2); $document_id = intval($_POST['document_id']); - $name = sanitizeInput($_POST['name']); + $name = escapeSql($_POST['name']); $client_id = intval(getFieldById('documents', $document_id, 'document_client_id')); @@ -291,7 +291,7 @@ if (isset($_POST['rename_document'])) { // Get Document Name before renaming for logging $sql_document = mysqli_query($mysqli,"SELECT document_name FROM documents WHERE document_id = $document_id"); $row = mysqli_fetch_assoc($sql_document); - $old_document_name = sanitizeInput($row['document_name']); + $old_document_name = escapeSql($row['document_name']); // Document edit query mysqli_query($mysqli,"UPDATE documents SET document_name = '$name', document_updated_at = document_updated_at WHERE document_id = $document_id"); @@ -316,7 +316,7 @@ if (isset($_POST['bulk_move_document'])) { // Get folder name for logging and Notification $sql = mysqli_query($mysqli,"SELECT folder_name, folder_client_id FROM folders WHERE folder_id = $folder_id"); $row = mysqli_fetch_assoc($sql); - $folder_name = sanitizeInput($row['folder_name']); + $folder_name = escapeSql($row['folder_name']); $client_id = intval($row['folder_client_id']); enforceClientAccess(); @@ -330,7 +330,7 @@ if (isset($_POST['bulk_move_document'])) { foreach($_POST['document_ids'] as $document_id) { $document_id = intval($document_id); // Get document name for logging - $document_name = sanitizeInput(getFieldById('documents', $document_id, 'document_name')); + $document_name = escapeSql(getFieldById('documents', $document_id, 'document_name')); // Document move query mysqli_query($mysqli,"UPDATE documents SET document_folder_id = $folder_id, document_updated_at = document_updated_at WHERE document_id = $document_id"); @@ -359,13 +359,13 @@ if (isset($_POST['link_file_to_document'])) { // Get Document Name and Client ID for logging $sql_document = mysqli_query($mysqli,"SELECT document_name, document_client_id FROM documents WHERE document_id = $document_id"); $row = mysqli_fetch_assoc($sql_document); - $document_name = sanitizeInput($row['document_name']); + $document_name = escapeSql($row['document_name']); $client_id = intval($row['document_client_id']); enforceClientAccess(); // Get File Name for logging - $file_name = sanitizeInput(getFieldById('files', $file_id, 'file_name')); + $file_name = escapeSql(getFieldById('files', $file_id, 'file_name')); // Document add query mysqli_query($mysqli,"INSERT INTO document_files SET file_id = $file_id, document_id = $document_id"); @@ -390,13 +390,13 @@ if (isset($_GET['unlink_file_from_document'])) { // Get Document Name and Client ID for logging $sql_document = mysqli_query($mysqli,"SELECT document_name, document_client_id FROM documents WHERE document_id = $document_id"); $row = mysqli_fetch_assoc($sql_document); - $document_name = sanitizeInput($row['document_name']); + $document_name = escapeSql($row['document_name']); $client_id = intval($row['document_client_id']); enforceClientAccess(); // Get File Name for logging - $file_name = sanitizeInput(getFieldById('files', $file_id, 'file_name')); + $file_name = escapeSql(getFieldById('files', $file_id, 'file_name')); mysqli_query($mysqli,"DELETE FROM document_files WHERE file_id = $file_id AND document_id = $document_id"); @@ -420,13 +420,13 @@ if (isset($_POST['link_vendor_to_document'])) { // Get Document Name and Client ID for logging $sql_document = mysqli_query($mysqli,"SELECT document_name, document_client_id FROM documents WHERE document_id = $document_id"); $row = mysqli_fetch_assoc($sql_document); - $document_name = sanitizeInput($row['document_name']); + $document_name = escapeSql($row['document_name']); $client_id = intval($row['document_client_id']); enforceClientAccess(); // Get Vendor Name for logging - $vendor_name = sanitizeInput(getFieldById('vendors', $vendor_id, 'vendor_name')); + $vendor_name = escapeSql(getFieldById('vendors', $vendor_id, 'vendor_name')); // Document add query mysqli_query($mysqli,"INSERT INTO vendor_documents SET vendor_id = $vendor_id, document_id = $document_id"); @@ -451,13 +451,13 @@ if (isset($_GET['unlink_vendor_from_document'])) { // Get Document Name and Client ID for logging $sql_document = mysqli_query($mysqli,"SELECT document_name, document_client_id FROM documents WHERE document_id = $document_id"); $row = mysqli_fetch_assoc($sql_document); - $document_name = sanitizeInput($row['document_name']); + $document_name = escapeSql($row['document_name']); $client_id = intval($row['document_client_id']); enforceClientAccess(); // Get Vendor Name for logging - $vendor_name = sanitizeInput(getFieldById('vendors', $vendor_id, 'vendor_name')); + $vendor_name = escapeSql(getFieldById('vendors', $vendor_id, 'vendor_name')); mysqli_query($mysqli,"DELETE FROM vendor_documents WHERE vendor_id = $vendor_id AND document_id = $document_id"); @@ -482,13 +482,13 @@ if (isset($_POST['link_contact_to_document'])) { // Get Document Name and Client ID for logging $sql_document = mysqli_query($mysqli,"SELECT document_name, document_client_id FROM documents WHERE document_id = $document_id"); $row = mysqli_fetch_assoc($sql_document); - $document_name = sanitizeInput($row['document_name']); + $document_name = escapeSql($row['document_name']); $client_id = intval($row['document_client_id']); enforceClientAccess(); // Get Contact Name for logging - $contact_name = sanitizeInput(getFieldById('contacts', $contact_id, 'contact_name')); + $contact_name = escapeSql(getFieldById('contacts', $contact_id, 'contact_name')); // Contact add query mysqli_query($mysqli,"INSERT INTO contact_documents SET contact_id = $contact_id, document_id = $document_id"); @@ -513,13 +513,13 @@ if (isset($_GET['unlink_contact_from_document'])) { // Get Document Name and Client ID for logging $sql_document = mysqli_query($mysqli,"SELECT document_name, document_client_id FROM documents WHERE document_id = $document_id"); $row = mysqli_fetch_assoc($sql_document); - $document_name = sanitizeInput($row['document_name']); + $document_name = escapeSql($row['document_name']); $client_id = intval($row['document_client_id']); enforceClientAccess(); // Get Contact Name for logging - $contact_name = sanitizeInput(getFieldById('contacts', $contact_id, 'contact_name')); + $contact_name = escapeSql(getFieldById('contacts', $contact_id, 'contact_name')); mysqli_query($mysqli,"DELETE FROM contact_documents WHERE contact_id = $contact_id AND document_id = $document_id"); @@ -543,13 +543,13 @@ if (isset($_POST['link_asset_to_document'])) { // Get Document Name and Client ID for logging $sql_document = mysqli_query($mysqli,"SELECT document_name, document_client_id FROM documents WHERE document_id = $document_id"); $row = mysqli_fetch_assoc($sql_document); - $document_name = sanitizeInput($row['document_name']); + $document_name = escapeSql($row['document_name']); $client_id = intval($row['document_client_id']); enforceClientAccess(); // Get Asset Name for logging - $asset_name = sanitizeInput(getFieldById('assets', $asset_id, 'asset_name')); + $asset_name = escapeSql(getFieldById('assets', $asset_id, 'asset_name')); mysqli_query($mysqli,"INSERT INTO asset_documents SET asset_id = $asset_id, document_id = $document_id"); @@ -573,13 +573,13 @@ if (isset($_GET['unlink_asset_from_document'])) { // Get Document Name and Client ID for logging $sql_document = mysqli_query($mysqli,"SELECT document_name, document_client_id FROM documents WHERE document_id = $document_id"); $row = mysqli_fetch_assoc($sql_document); - $document_name = sanitizeInput($row['document_name']); + $document_name = escapeSql($row['document_name']); $client_id = intval($row['document_client_id']); enforceClientAccess(); // Get Asset Name for logging - $asset_name = sanitizeInput(getFieldById('assets', $asset_id, 'asset_name')); + $asset_name = escapeSql(getFieldById('assets', $asset_id, 'asset_name')); mysqli_query($mysqli,"DELETE FROM asset_documents WHERE asset_id = $asset_id AND document_id = $document_id"); @@ -603,13 +603,13 @@ if (isset($_POST['link_software_to_document'])) { // Get Document Name and Client ID for logging $sql_document = mysqli_query($mysqli,"SELECT document_name, document_client_id FROM documents WHERE document_id = $document_id"); $row = mysqli_fetch_assoc($sql_document); - $document_name = sanitizeInput($row['document_name']); + $document_name = escapeSql($row['document_name']); $client_id = intval($row['document_client_id']); enforceClientAccess(); // Get Software Name for logging - $software_name = sanitizeInput(getFieldById('software', $software_id, 'software_name')); + $software_name = escapeSql(getFieldById('software', $software_id, 'software_name')); // Contact add query mysqli_query($mysqli,"INSERT INTO software_documents SET software_id = $software_id, document_id = $document_id"); @@ -634,13 +634,13 @@ if (isset($_GET['unlink_software_from_document'])) { // Get Document Name and Client ID for logging $sql_document = mysqli_query($mysqli,"SELECT document_name, document_client_id FROM documents WHERE document_id = $document_id"); $row = mysqli_fetch_assoc($sql_document); - $document_name = sanitizeInput($row['document_name']); + $document_name = escapeSql($row['document_name']); $client_id = intval($row['document_client_id']); enforceClientAccess(); // Get Software Name for logging - $software_name = sanitizeInput(getFieldById('software', $software_id, 'software_name')); + $software_name = escapeSql(getFieldById('software', $software_id, 'software_name')); mysqli_query($mysqli,"DELETE FROM software_documents WHERE software_id = $software_id AND document_id = $document_id"); @@ -670,7 +670,7 @@ if (isset($_POST['toggle_document_visibility'])) { // Get Document Name and Client ID for logging $sql_document = mysqli_query($mysqli,"SELECT document_name, document_client_id FROM documents WHERE document_id = $document_id"); $row = mysqli_fetch_assoc($sql_document); - $document_name = sanitizeInput($row['document_name']); + $document_name = escapeSql($row['document_name']); $client_id = intval($row['document_client_id']); enforceClientAccess(); @@ -696,7 +696,7 @@ if (isset($_GET['export_document'])) { // Get Contact Name and Client ID for logging and alert message $sql = mysqli_query($mysqli,"SELECT document_name, document_content, document_client_id FROM documents WHERE document_id = $document_id"); $row = mysqli_fetch_assoc($sql); - $document_name = sanitizeInput($row['document_name']); + $document_name = escapeSql($row['document_name']); $document_content = $row['document_content']; $client_id = intval($row['document_client_id']); @@ -744,7 +744,7 @@ if (isset($_GET['archive_document'])) { // Get Contact Name and Client ID for logging and alert message $sql = mysqli_query($mysqli,"SELECT document_name, document_client_id FROM documents WHERE document_id = $document_id"); $row = mysqli_fetch_assoc($sql); - $document_name = sanitizeInput($row['document_name']); + $document_name = escapeSql($row['document_name']); $client_id = intval($row['document_client_id']); enforceClientAccess(); @@ -789,7 +789,7 @@ if (isset($_GET['restore_document'])) { // Get Document Name and Client ID for logging and alert message $sql = mysqli_query($mysqli,"SELECT document_name, document_client_id FROM documents WHERE document_id = $document_id"); $row = mysqli_fetch_assoc($sql); - $document_name = sanitizeInput($row['document_name']); + $document_name = escapeSql($row['document_name']); $client_id = intval($row['document_client_id']); enforceClientAccess(); @@ -816,7 +816,7 @@ if (isset($_GET['delete_document_version'])) { $sql = mysqli_query($mysqli,"SELECT document_version_name, document_client_id FROM documents, document_versions WHERE document_version_document_id = document_id AND document_version_id = $document_version_id"); $row = mysqli_fetch_assoc($sql); $client_id = intval($row['document_client_id']); - $document_version_name = sanitizeInput($row['document_version_name']); + $document_version_name = escapeSql($row['document_version_name']); enforceClientAccess(); @@ -842,7 +842,7 @@ if (isset($_GET['delete_document'])) { $sql = mysqli_query($mysqli,"SELECT document_name, document_client_id FROM documents WHERE document_id = $document_id"); $row = mysqli_fetch_assoc($sql); $client_id = intval($row['document_client_id']); - $document_name = sanitizeInput($row['document_name']); + $document_name = escapeSql($row['document_name']); enforceClientAccess(); diff --git a/agent/post/document_model.php b/agent/post/document_model.php index 47fce409..1d710f7e 100644 --- a/agent/post/document_model.php +++ b/agent/post/document_model.php @@ -1,9 +1,9 @@ $old_value) { $new_value = $new_domain_info[$column]; if ($old_value != $new_value && !in_array($column, $ignored_columns)) { - $column = sanitizeInput($column); - $old_value = sanitizeInput($old_value); - $new_value = sanitizeInput($new_value); + $column = escapeSql($column); + $old_value = escapeSql($old_value); + $new_value = escapeSql($new_value); mysqli_query($mysqli,"INSERT INTO domain_history SET domain_history_column = '$column', domain_history_old_value = '$old_value', domain_history_new_value = '$new_value', domain_history_domain_id = $domain_id"); } } @@ -167,7 +167,7 @@ if (isset($_GET['archive_domain'])) { //Get domain Name $sql = mysqli_query($mysqli,"SELECT * FROM domains WHERE domain_id = $domain_id"); $row = mysqli_fetch_assoc($sql); - $domain_name = sanitizeInput($row['domain_name']); + $domain_name = escapeSql($row['domain_name']); $client_id = intval($row['domain_client_id']); enforceClientAccess(); @@ -193,7 +193,7 @@ if(isset($_GET['restore_domain'])){ // Get Name and Client ID for logging and alert message $sql = mysqli_query($mysqli,"SELECT domain_name, domain_client_id FROM domains WHERE domain_id = $domain_id"); $row = mysqli_fetch_assoc($sql); - $domain_name = sanitizeInput($row['domain_name']); + $domain_name = escapeSql($row['domain_name']); $client_id = intval($row['domain_client_id']); enforceClientAccess(); @@ -219,7 +219,7 @@ if (isset($_GET['delete_domain'])) { // Get Domain Name and Client ID for logging and alert message $sql = mysqli_query($mysqli,"SELECT domain_name, domain_client_id FROM domains WHERE domain_id = $domain_id"); $row = mysqli_fetch_assoc($sql); - $domain_name = sanitizeInput($row['domain_name']); + $domain_name = escapeSql($row['domain_name']); $client_id = intval($row['domain_client_id']); enforceClientAccess(); @@ -253,7 +253,7 @@ if (isset($_POST['bulk_archive_domains'])) { // Get Name and Client ID for logging and alert message $sql = mysqli_query($mysqli,"SELECT domain_name, domain_client_id FROM domains WHERE domain_id = $domain_id"); $row = mysqli_fetch_assoc($sql); - $domain_name = sanitizeInput($row['domain_name']); + $domain_name = escapeSql($row['domain_name']); $client_id = intval($row['domain_client_id']); enforceClientAccess(); @@ -292,7 +292,7 @@ if (isset($_POST['bulk_restore_domains'])) { // Get Name and Client ID for logging and alert message $sql = mysqli_query($mysqli,"SELECT domain_name, domain_client_id FROM domains WHERE domain_id = $domain_id"); $row = mysqli_fetch_assoc($sql); - $domain_name = sanitizeInput($row['domain_name']); + $domain_name = escapeSql($row['domain_name']); $client_id = intval($row['domain_client_id']); enforceClientAccess(); @@ -332,7 +332,7 @@ if (isset($_POST['bulk_delete_domains'])) { // Get Name and Client ID for logging and alert message $sql = mysqli_query($mysqli,"SELECT domain_name, domain_client_id FROM domains WHERE domain_id = $domain_id"); $row = mysqli_fetch_assoc($sql); - $domain_name = sanitizeInput($row['domain_name']); + $domain_name = escapeSql($row['domain_name']); $client_id = intval($row['domain_client_id']); enforceClientAccess(); diff --git a/agent/post/domain_model.php b/agent/post/domain_model.php index 0281b1ce..e63acf8e 100644 --- a/agent/post/domain_model.php +++ b/agent/post/domain_model.php @@ -1,11 +1,11 @@
A calendar event has been scheduled:

Event Title: $title
Event Date: $start


--
$company_name
$company_phone"; @@ -165,26 +165,26 @@ if (isset($_POST['edit_event'])) { $sql_client = mysqli_query($mysqli,"SELECT * FROM clients JOIN contacts ON contact_client_id = client_id WHERE contact_primary = 1 AND client_id = $client_id"); $row = mysqli_fetch_assoc($sql_client); - $client_name = sanitizeInput($row['client_name']); - $contact_name = sanitizeInput($row['contact_name']); - $contact_email = sanitizeInput($row['contact_email']); + $client_name = escapeSql($row['client_name']); + $contact_name = escapeSql($row['contact_name']); + $contact_email = escapeSql($row['contact_email']); $sql_company = mysqli_query($mysqli,"SELECT * FROM companies WHERE company_id = 1"); $row = mysqli_fetch_assoc($sql_company); - $company_name = sanitizeInput($row['company_name']); - $company_country = sanitizeInput($row['company_country']); - $company_address = sanitizeInput($row['company_address']); - $company_city = sanitizeInput($row['company_city']); - $company_state = sanitizeInput($row['company_state']); - $company_zip = sanitizeInput($row['company_zip']); - $company_phone = sanitizeInput(formatPhoneNumber($row['company_phone'])); - $company_email = sanitizeInput($row['company_email']); - $company_website = sanitizeInput($row['company_website']); - $company_logo = sanitizeInput($row['company_logo']); + $company_name = escapeSql($row['company_name']); + $company_country = escapeSql($row['company_country']); + $company_address = escapeSql($row['company_address']); + $company_city = escapeSql($row['company_city']); + $company_state = escapeSql($row['company_state']); + $company_zip = escapeSql($row['company_zip']); + $company_phone = escapeSql(formatPhoneNumber($row['company_phone'])); + $company_email = escapeSql($row['company_email']); + $company_website = escapeSql($row['company_website']); + $company_logo = escapeSql($row['company_logo']); // Sanitize Config Vars from get_settings.php and Session Vars from check_login.php - $config_mail_from_name = sanitizeInput($config_mail_from_name); - $config_mail_from_email = sanitizeInput($config_mail_from_email); + $config_mail_from_name = escapeSql($config_mail_from_name); + $config_mail_from_email = escapeSql($config_mail_from_email); $subject = "Calendar Event Rescheduled"; @@ -228,7 +228,7 @@ if (isset($_GET['delete_event'])) { // Get Event Title $sql = mysqli_query($mysqli,"SELECT * FROM calendar_events WHERE event_id = $event_id"); $row = mysqli_fetch_assoc($sql); - $event_title = sanitizeInput($row['event_title']); + $event_title = escapeSql($row['event_title']); $client_id = intval($row['event_client_id']); // Don't Enforce Client Access if Calendar event doesn't have a client diff --git a/agent/post/event_model.php b/agent/post/event_model.php index 673795bd..180cc7bb 100644 --- a/agent/post/event_model.php +++ b/agent/post/event_model.php @@ -2,11 +2,11 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed"); $calendar_id = intval($_POST['calendar']); -$title = sanitizeInput($_POST['title']); -$location = sanitizeInput($_POST['location']); -$description = sanitizeInput($_POST['description']); -$start = sanitizeInput($_POST['start']); -$end = sanitizeInput($_POST['end']); -$repeat = sanitizeInput($_POST['repeat'] ?? 0); +$title = escapeSql($_POST['title']); +$location = escapeSql($_POST['location']); +$description = escapeSql($_POST['description']); +$start = escapeSql($_POST['start']); +$end = escapeSql($_POST['end']); +$repeat = escapeSql($_POST['repeat'] ?? 0); $client_id = intval($_POST['client_id']); $email_event = intval($_POST['email_event'] ?? 0); diff --git a/agent/post/expense.php b/agent/post/expense.php index 21f4cad4..9928f751 100644 --- a/agent/post/expense.php +++ b/agent/post/expense.php @@ -64,7 +64,7 @@ if (isset($_POST['edit_expense'])) { $expense_id = intval($_POST['expense_id']); // Get old receipt - $existing_file_name = sanitizeInput(getFieldById('expenses', $expense_id, 'expense_receipt')); + $existing_file_name = escapeSql(getFieldById('expenses', $expense_id, 'expense_receipt')); // Check for and process attachment $extended_alert_description = ''; @@ -106,8 +106,8 @@ if (isset($_GET['delete_expense'])) { $sql = mysqli_query($mysqli,"SELECT * FROM expenses WHERE expense_id = $expense_id"); $row = mysqli_fetch_assoc($sql); - $expense_receipt = sanitizeInput($row['expense_receipt']); - $expense_description = sanitizeInput($row['expense_description']); + $expense_receipt = escapeSql($row['expense_receipt']); + $expense_description = escapeSql($row['expense_description']); $client_id = intval($row['expense_client_id']); if ($client_id) { @@ -135,7 +135,7 @@ if (isset($_POST['bulk_edit_expense_category'])) { $category_id = intval($_POST['bulk_category_id']); // Get Category name for logging and Notification - $category_name = sanitizeInput(getFieldById('categories', $category_id, 'category_name')); + $category_name = escapeSql(getFieldById('categories', $category_id, 'category_name')); // Assign category to Selected Expenses if (isset($_POST['expense_ids'])) { @@ -149,7 +149,7 @@ if (isset($_POST['bulk_edit_expense_category'])) { // Get Expense Details for Logging $sql = mysqli_query($mysqli,"SELECT expense_description, expense_client_id FROM expenses WHERE expense_id = $expense_id"); $row = mysqli_fetch_assoc($sql); - $expense_description = sanitizeInput($row['expense_description']); + $expense_description = escapeSql($row['expense_description']); $client_id = intval($row['expense_client_id']); if ($client_id) { @@ -180,7 +180,7 @@ if (isset($_POST['bulk_edit_expense_account'])) { $account_id = intval($_POST['bulk_account_id']); // Get Account name for logging and Notification - $account_name = sanitizeInput(getFieldById('accounts', $account_id, 'account_name')); + $account_name = escapeSql(getFieldById('accounts', $account_id, 'account_name')); // Assign account to Selected Expenses if (isset($_POST['expense_ids'])) { @@ -194,7 +194,7 @@ if (isset($_POST['bulk_edit_expense_account'])) { // Get Expense Details for Logging $sql = mysqli_query($mysqli,"SELECT expense_description, expense_client_id FROM expenses WHERE expense_id = $expense_id"); $row = mysqli_fetch_assoc($sql); - $expense_description = sanitizeInput($row['expense_description']); + $expense_description = escapeSql($row['expense_description']); $client_id = intval($row['expense_client_id']); if ($client_id) { @@ -227,7 +227,7 @@ if (isset($_POST['bulk_edit_expense_client'])) { enforceClientAccess(); // Get Client name for logging and Notification - $client_name = sanitizeInput(getFieldById('clients', $client_id, 'client_name')); + $client_name = escapeSql(getFieldById('clients', $client_id, 'client_name')); // Assign Client to Selected Expenses if (isset($_POST['expense_ids'])) { @@ -239,7 +239,7 @@ if (isset($_POST['bulk_edit_expense_client'])) { $expense_id = intval($expense_id); // Get Expense Details for Logging - $expense_description = sanitizeInput(getFieldById('expenses', $expense_id, 'expense_description')); + $expense_description = escapeSql(getFieldById('expenses', $expense_id, 'expense_description')); mysqli_query($mysqli,"UPDATE expenses SET expense_client_id = $client_id WHERE expense_id = $expense_id"); @@ -272,8 +272,8 @@ if (isset($_POST['bulk_delete_expenses'])) { $sql = mysqli_query($mysqli,"SELECT * FROM expenses WHERE expense_id = $expense_id"); $row = mysqli_fetch_assoc($sql); - $expense_description = sanitizeInput($row['expense_description']); - $expense_receipt = sanitizeInput($row['expense_receipt']); + $expense_description = escapeSql($row['expense_description']); + $expense_receipt = escapeSql($row['expense_receipt']); $client_id = intval($row['expense_client_id']); if ($client_id) { @@ -304,8 +304,8 @@ if (isset($_POST['export_expenses_csv'])) { enforceUserPermission('module_financial'); - $date_from = sanitizeInput($_POST['date_from']); - $date_to = sanitizeInput($_POST['date_to']); + $date_from = escapeSql($_POST['date_from']); + $date_to = escapeSql($_POST['date_to']); $account = intval($_POST['account']); $vendor = intval($_POST['vendor']); $category = intval($_POST['category']); diff --git a/agent/post/expense_model.php b/agent/post/expense_model.php index 54a7d225..753d8b94 100644 --- a/agent/post/expense_model.php +++ b/agent/post/expense_model.php @@ -1,11 +1,11 @@ 0) { $sql = mysqli_query($mysqli,"SELECT folder_name, folder_client_id FROM folders WHERE folder_id = $folder_id"); if ($row = mysqli_fetch_assoc($sql)) { - $folder_name = sanitizeInput($row['folder_name']); + $folder_name = escapeSql($row['folder_name']); $log_client_id = intval($row['folder_client_id']); } } @@ -494,7 +494,7 @@ if (isset($_POST['bulk_move_files'])) { foreach ($file_ids as $file_id) { // Get file name for logging - $file_name = sanitizeInput(getFieldById('files', $file_id, 'file_name')); + $file_name = escapeSql(getFieldById('files', $file_id, 'file_name')); $client_id = intval(getFieldById('files', $file_id, 'file_client_id')); enforceClientAccess(); @@ -532,7 +532,7 @@ if (isset($_POST['bulk_move_files'])) { foreach ($document_ids as $document_id) { // Get document name for logging - $document_name = sanitizeInput(getFieldById('documents', $document_id, 'document_name')); + $document_name = escapeSql(getFieldById('documents', $document_id, 'document_name')); $client_id = intval(getFieldById('documents', $document_id, 'document_client_id')); enforceClientAccess(); @@ -588,13 +588,13 @@ if (isset($_POST['link_asset_to_file'])) { // Get File Name and Client ID for Logging $sql = mysqli_query($mysqli,"SELECT file_name, file_client_id FROM files WHERE file_id = $file_id"); $row = mysqli_fetch_assoc($sql); - $file_name = sanitizeInput($row['file_name']); + $file_name = escapeSql($row['file_name']); $client_id = intval($row['file_client_id']); enforceClientAccess(); // Get Asset Name for Logging - $asset_name = sanitizeInput(getFieldById('assets', $asset_id, 'asset_name')); + $asset_name = escapeSql(getFieldById('assets', $asset_id, 'asset_name')); // Contact add query mysqli_query($mysqli,"INSERT INTO asset_files SET asset_id = $asset_id, file_id = $file_id"); @@ -619,13 +619,13 @@ if (isset($_GET['unlink_asset_from_file'])) { // Get File Name and Client ID for Logging $sql = mysqli_query($mysqli,"SELECT file_name, file_client_id FROM files WHERE file_id = $file_id"); $row = mysqli_fetch_assoc($sql); - $file_name = sanitizeInput($row['file_name']); + $file_name = escapeSql($row['file_name']); $client_id = intval($row['file_client_id']); enforceClientAccess(); // Get Asset Name for Logging - $asset_name = sanitizeInput(getFieldById('assets', $asset_id, 'asset_name')); + $asset_name = escapeSql(getFieldById('assets', $asset_id, 'asset_name')); mysqli_query($mysqli,"DELETE FROM asset_files WHERE asset_id = $asset_id AND file_id = $file_id"); diff --git a/agent/post/folder.php b/agent/post/folder.php index dccdf3f8..7b37b60b 100644 --- a/agent/post/folder.php +++ b/agent/post/folder.php @@ -14,7 +14,7 @@ if (isset($_POST['create_folder'])) { $client_id = intval($_POST['client_id']); $folder_location = intval($_POST['folder_location']); - $folder_name = sanitizeInput($_POST['folder_name']); + $folder_name = escapeSql($_POST['folder_name']); $parent_folder = intval($_POST['parent_folder']); enforceClientAccess(); @@ -38,12 +38,12 @@ if (isset($_POST['rename_folder'])) { enforceUserPermission('module_support', 2); $folder_id = intval($_POST['folder_id']); - $folder_name = sanitizeInput($_POST['folder_name']); + $folder_name = escapeSql($_POST['folder_name']); // Get old Folder Name Client ID for Logging $sql = mysqli_query($mysqli,"SELECT folder_name, folder_client_id FROM folders WHERE folder_id = $folder_id"); $row = mysqli_fetch_assoc($sql); - $old_folder_name = sanitizeInput($row['folder_name']); + $old_folder_name = escapeSql($row['folder_name']); $client_id = intval($row['folder_client_id']); enforceClientAccess(); @@ -70,7 +70,7 @@ if (isset($_GET['delete_folder'])) { // Get Folder Name Client ID for Logging $sql = mysqli_query($mysqli,"SELECT folder_name, folder_client_id FROM folders WHERE folder_id = $folder_id"); $row = mysqli_fetch_assoc($sql); - $folder_name = sanitizeInput($row['folder_name']); + $folder_name = escapeSql($row['folder_name']); $client_id = intval($row['folder_client_id']); enforceClientAccess(); diff --git a/agent/post/invoice.php b/agent/post/invoice.php index e0c75d04..b8bd6ff2 100644 --- a/agent/post/invoice.php +++ b/agent/post/invoice.php @@ -62,12 +62,12 @@ if (isset($_POST['edit_invoice'])) { require_once 'invoice_model.php'; $invoice_id = intval($_POST['invoice_id']); - $due = sanitizeInput($_POST['due']); + $due = escapeSql($_POST['due']); // Get Invoice Number and Prefix and Client ID for Logging $sql = mysqli_query($mysqli,"SELECT invoice_prefix, invoice_number, invoice_client_id FROM invoices WHERE invoice_id = $invoice_id"); $row = mysqli_fetch_assoc($sql); - $invoice_prefix = sanitizeInput($row['invoice_prefix']); + $invoice_prefix = escapeSql($row['invoice_prefix']); $invoice_number = intval($row['invoice_number']); $client_id = intval($row['invoice_client_id']); @@ -100,20 +100,20 @@ if (isset($_POST['add_invoice_copy'])) { enforceUserPermission('module_sales', 2); $invoice_id = intval($_POST['invoice_id']); - $date = sanitizeInput($_POST['date']); + $date = escapeSql($_POST['date']); //Get Net Terms $sql = mysqli_query($mysqli,"SELECT * FROM clients, invoices WHERE client_id = invoice_client_id AND invoice_id = $invoice_id"); $row = mysqli_fetch_assoc($sql); $client_net_terms = intval($row['client_net_terms']); - $invoice_scope = sanitizeInput($row['invoice_scope']); + $invoice_scope = escapeSql($row['invoice_scope']); $invoice_discount_amount = floatval($row['invoice_discount_amount']); $invoice_amount = floatval($row['invoice_amount']); - $invoice_currency_code = sanitizeInput($row['invoice_currency_code']); - $invoice_note = sanitizeInput($row['invoice_note']); + $invoice_currency_code = escapeSql($row['invoice_currency_code']); + $invoice_note = escapeSql($row['invoice_note']); $client_id = intval($row['invoice_client_id']); $category_id = intval($row['invoice_category_id']); - $old_invoice_prefix = sanitizeInput($row['invoice_prefix']); + $old_invoice_prefix = escapeSql($row['invoice_prefix']); $old_invoice_number = intval($row['invoice_number']); enforceClientAccess(); @@ -141,8 +141,8 @@ if (isset($_POST['add_invoice_copy'])) { $sql_items = mysqli_query($mysqli,"SELECT * FROM invoice_items WHERE item_invoice_id = $invoice_id"); while($row = mysqli_fetch_assoc($sql_items)) { $item_id = intval($row['item_id']); - $item_name = sanitizeInput($row['item_name']); - $item_description = sanitizeInput($row['item_description']); + $item_name = escapeSql($row['item_name']); + $item_description = escapeSql($row['item_description']); $item_quantity = floatval($row['item_quantity']); $item_price = floatval($row['item_price']); $item_subtotal = floatval($row['item_subtotal']); @@ -175,7 +175,7 @@ if (isset($_GET['mark_invoice_sent'])) { // Get Invoice Number and Prefix and Client ID for Logging $sql = mysqli_query($mysqli,"SELECT invoice_prefix, invoice_number, invoice_client_id FROM invoices WHERE invoice_id = $invoice_id"); $row = mysqli_fetch_assoc($sql); - $invoice_prefix = sanitizeInput($row['invoice_prefix']); + $invoice_prefix = escapeSql($row['invoice_prefix']); $invoice_number = intval($row['invoice_number']); $client_id = intval($row['invoice_client_id']); @@ -204,7 +204,7 @@ if (isset($_GET['mark_invoice_non-billable'])) { // Get Invoice Number and Prefix and Client ID for Logging $sql = mysqli_query($mysqli,"SELECT invoice_prefix, invoice_number, invoice_client_id FROM invoices WHERE invoice_id = $invoice_id"); $row = mysqli_fetch_assoc($sql); - $invoice_prefix = sanitizeInput($row['invoice_prefix']); + $invoice_prefix = escapeSql($row['invoice_prefix']); $invoice_number = intval($row['invoice_number']); $client_id = intval($row['invoice_client_id']); @@ -233,7 +233,7 @@ if (isset($_GET['cancel_invoice'])) { // Get Invoice Number and Prefix and Client ID for Logging $sql = mysqli_query($mysqli,"SELECT invoice_prefix, invoice_number, invoice_client_id FROM invoices WHERE invoice_id = $invoice_id"); $row = mysqli_fetch_assoc($sql); - $invoice_prefix = sanitizeInput($row['invoice_prefix']); + $invoice_prefix = escapeSql($row['invoice_prefix']); $invoice_number = intval($row['invoice_number']); $client_id = intval($row['invoice_client_id']); @@ -262,7 +262,7 @@ if (isset($_GET['delete_invoice'])) { // Get Invoice Number and Prefix and Client ID for Logging $sql = mysqli_query($mysqli,"SELECT invoice_prefix, invoice_number, invoice_client_id FROM invoices WHERE invoice_id = $invoice_id"); $row = mysqli_fetch_assoc($sql); - $invoice_prefix = sanitizeInput($row['invoice_prefix']); + $invoice_prefix = escapeSql($row['invoice_prefix']); $invoice_number = intval($row['invoice_number']); $client_id = intval($row['invoice_client_id']); @@ -309,8 +309,8 @@ if (isset($_POST['add_invoice_item'])) { enforceUserPermission('module_sales', 2); $invoice_id = intval($_POST['invoice_id']); - $name = sanitizeInput($_POST['name']); - $description = sanitizeInput($_POST['description']); + $name = escapeSql($_POST['name']); + $description = escapeSql($_POST['description']); $qty = floatval($_POST['qty']); $price = floatval($_POST['price']); $tax_id = intval($_POST['tax_id']); @@ -326,7 +326,7 @@ if (isset($_POST['add_invoice_item'])) { // Update Product Inventory if ($product_id) { // Only enforce stock for tangible products - $product_type = sanitizeInput(getFieldById('products', $product_id, 'product_type')); + $product_type = escapeSql(getFieldById('products', $product_id, 'product_type')); if ($product_type === 'product') { // Current available stock @@ -367,7 +367,7 @@ if (isset($_POST['add_invoice_item'])) { // Get Discount and Invoice Details $sql = mysqli_query($mysqli,"SELECT * FROM invoices WHERE invoice_id = $invoice_id"); $row = mysqli_fetch_assoc($sql); - $invoice_prefix = sanitizeInput($row['invoice_prefix']); + $invoice_prefix = escapeSql($row['invoice_prefix']); $invoice_number = intval($row['invoice_number']); $invoice_discount = floatval($row['invoice_discount_amount']); @@ -397,12 +397,12 @@ if (isset($_POST['invoice_note'])) { enforceUserPermission('module_sales', 2); $invoice_id = intval($_POST['invoice_id']); - $note = sanitizeInput($_POST['note']); + $note = escapeSql($_POST['note']); // Get Invoice Details for logging $sql = mysqli_query($mysqli,"SELECT * FROM invoices WHERE invoice_id = $invoice_id"); $row = mysqli_fetch_assoc($sql); - $invoice_prefix = sanitizeInput($row['invoice_prefix']); + $invoice_prefix = escapeSql($row['invoice_prefix']); $invoice_number = intval($row['invoice_number']); $client_id = intval($row['invoice_client_id']); @@ -425,8 +425,8 @@ if (isset($_POST['edit_invoice_item'])) { enforceUserPermission('module_sales', 2); $item_id = intval($_POST['item_id']); - $name = sanitizeInput($_POST['name']); - $description = sanitizeInput($_POST['description']); + $name = escapeSql($_POST['name']); + $description = escapeSql($_POST['description']); $qty = floatval($_POST['qty']); $price = floatval($_POST['price']); $tax_id = intval($_POST['tax_id']); @@ -453,7 +453,7 @@ if (isset($_POST['edit_invoice_item'])) { //Get Discount Amount $sql = mysqli_query($mysqli,"SELECT * FROM invoices WHERE invoice_id = $invoice_id"); $row = mysqli_fetch_assoc($sql); - $invoice_prefix = sanitizeInput($row['invoice_prefix']); + $invoice_prefix = escapeSql($row['invoice_prefix']); $invoice_number = intval($row['invoice_number']); $client_id = intval($row['invoice_client_id']); $invoice_discount = floatval($row['invoice_discount_amount']); @@ -488,7 +488,7 @@ if (isset($_GET['delete_invoice_item'])) { $sql = mysqli_query($mysqli,"SELECT * FROM invoice_items WHERE item_id = $item_id"); $row = mysqli_fetch_assoc($sql); $invoice_id = intval($row['item_invoice_id']); - $item_name = sanitizeInput($row['item_name']); + $item_name = escapeSql($row['item_name']); $item_quantity = floatval($row['item_quantity']); $item_product_id = intval($row['item_product_id']); $item_subtotal = floatval($row['item_subtotal']); @@ -497,7 +497,7 @@ if (isset($_GET['delete_invoice_item'])) { $sql = mysqli_query($mysqli,"SELECT * FROM invoices WHERE invoice_id = $invoice_id"); $row = mysqli_fetch_assoc($sql); - $invoice_prefix = sanitizeInput($row['invoice_prefix']); + $invoice_prefix = escapeSql($row['invoice_prefix']); $invoice_number = intval($row['invoice_number']); $client_id = intval($row['invoice_client_id']); @@ -538,39 +538,39 @@ if (isset($_GET['email_invoice'])) { $row = mysqli_fetch_assoc($sql); $invoice_id = intval($row['invoice_id']); - $invoice_prefix = sanitizeInput($row['invoice_prefix']); + $invoice_prefix = escapeSql($row['invoice_prefix']); $invoice_number = intval($row['invoice_number']); - $invoice_scope = sanitizeInput($row['invoice_scope']); - $invoice_status = sanitizeInput($row['invoice_status']); - $invoice_date = sanitizeInput(validateDate($row['invoice_date'])); - $invoice_due = sanitizeInput(validateDate($row['invoice_due'])); + $invoice_scope = escapeSql($row['invoice_scope']); + $invoice_status = escapeSql($row['invoice_status']); + $invoice_date = escapeSql(validateDate($row['invoice_date'])); + $invoice_due = escapeSql(validateDate($row['invoice_due'])); $invoice_amount = floatval($row['invoice_amount']); - $invoice_url_key = sanitizeInput($row['invoice_url_key']); - $invoice_currency_code = sanitizeInput($row['invoice_currency_code']); + $invoice_url_key = escapeSql($row['invoice_url_key']); + $invoice_currency_code = escapeSql($row['invoice_currency_code']); $client_id = intval($row['client_id']); - $client_name = sanitizeInput($row['client_name']); - $contact_name = sanitizeInput($row['contact_name']); - $contact_email = sanitizeInput($row['contact_email']); + $client_name = escapeSql($row['client_name']); + $contact_name = escapeSql($row['contact_name']); + $contact_email = escapeSql($row['contact_email']); enforceClientAccess(); $sql = mysqli_query($mysqli,"SELECT * FROM companies WHERE company_id = 1"); $row = mysqli_fetch_assoc($sql); - $company_name = sanitizeInput($row['company_name']); - $company_country = sanitizeInput($row['company_country']); - $company_address = sanitizeInput($row['company_address']); - $company_city = sanitizeInput($row['company_city']); - $company_state = sanitizeInput($row['company_state']); - $company_zip = sanitizeInput($row['company_zip']); - $company_phone = sanitizeInput(formatPhoneNumber($row['company_phone'], $row['company_phone_country_code'])); - $company_email = sanitizeInput($row['company_email']); - $company_website = sanitizeInput($row['company_website']); - $company_logo = sanitizeInput($row['company_logo']); + $company_name = escapeSql($row['company_name']); + $company_country = escapeSql($row['company_country']); + $company_address = escapeSql($row['company_address']); + $company_city = escapeSql($row['company_city']); + $company_state = escapeSql($row['company_state']); + $company_zip = escapeSql($row['company_zip']); + $company_phone = escapeSql(formatPhoneNumber($row['company_phone'], $row['company_phone_country_code'])); + $company_email = escapeSql($row['company_email']); + $company_website = escapeSql($row['company_website']); + $company_logo = escapeSql($row['company_logo']); // Sanitize Config vars from get_settings.php - $config_invoice_from_name = sanitizeInput($config_invoice_from_name); - $config_invoice_from_email = sanitizeInput($config_invoice_from_email); + $config_invoice_from_name = escapeSql($config_invoice_from_name); + $config_invoice_from_email = escapeSql($config_invoice_from_email); $sql_payments = mysqli_query($mysqli,"SELECT * FROM payments, accounts WHERE payment_account_id = account_id AND payment_invoice_id = $invoice_id ORDER BY payment_id DESC"); @@ -628,8 +628,8 @@ if (isset($_GET['email_invoice'])) { $data = []; while ($billing_contact = mysqli_fetch_assoc($sql_billing_contacts)) { - $billing_contact_name = sanitizeInput($billing_contact['contact_name']); - $billing_contact_email = sanitizeInput($billing_contact['contact_email']); + $billing_contact_name = escapeSql($billing_contact['contact_name']); + $billing_contact_email = escapeSql($billing_contact['contact_email']); $data[] = [ 'from' => $config_invoice_from_email, @@ -668,8 +668,8 @@ if (isset($_POST['export_invoices_csv'])) { $file_name_prepend = "$session_company_name-"; } - $date_from = sanitizeInput($_POST['date_from']); - $date_to = sanitizeInput($_POST['date_to']); + $date_from = escapeSql($_POST['date_from']); + $date_to = escapeSql($_POST['date_to']); if (!empty($date_from) && !empty($date_to)) { $date_query = "DATE(invoice_date) BETWEEN '$date_from' AND '$date_to'"; $file_name_date = "$date_from-to-$date_to"; @@ -1145,7 +1145,7 @@ if (isset($_POST['bulk_edit_invoice_category'])) { $category_id = intval($_POST['bulk_category_id']); // Get Category name for logging and Notification - $category_name = sanitizeInput(getFieldById('categories', $category_id, 'category_name')); + $category_name = escapeSql(getFieldById('categories', $category_id, 'category_name')); // Assign Income category to Selected Invoices if (isset($_POST['invoice_ids'])) { @@ -1159,9 +1159,9 @@ if (isset($_POST['bulk_edit_invoice_category'])) { // Get Invoice Details for Logging $sql = mysqli_query($mysqli,"SELECT * FROM invoices WHERE invoice_id = $invoice_id"); $row = mysqli_fetch_assoc($sql); - $invoice_prefix = sanitizeInput($row['invoice_prefix']); + $invoice_prefix = escapeSql($row['invoice_prefix']); $invoice_number = intval($row['invoice_number']); - $invoice_scope = sanitizeInput($row['invoice_scope']); + $invoice_scope = escapeSql($row['invoice_scope']); $client_id = intval($row['invoice_client_id']); enforceClientAccess(); diff --git a/agent/post/invoice_model.php b/agent/post/invoice_model.php index 81a9c4a1..41e60649 100644 --- a/agent/post/invoice_model.php +++ b/agent/post/invoice_model.php @@ -1,10 +1,10 @@ 0){ $duplicate_detect = 1; } } if(isset($column[1])){ - $description = sanitizeInput($column[1]); + $description = escapeSql($column[1]); } if(isset($column[2])){ - $address = sanitizeInput($column[2]); + $address = escapeSql($column[2]); } if(isset($column[3])){ - $city = sanitizeInput($column[3]); + $city = escapeSql($column[3]); } if(isset($column[4])){ - $state = sanitizeInput($column[4]); + $state = escapeSql($column[4]); } if(isset($column[5])){ - $zip = sanitizeInput($column[5]); + $zip = escapeSql($column[5]); } if(isset($column[6])){ $phone = preg_replace("/[^0-9]/", '',$column[6]); } if(isset($column[7])){ - $hours = sanitizeInput($column[7]); + $hours = escapeSql($column[7]); } // Check if duplicate was detected diff --git a/agent/post/location_model.php b/agent/post/location_model.php index eb062182..f022856f 100644 --- a/agent/post/location_model.php +++ b/agent/post/location_model.php @@ -1,19 +1,19 @@ id); + $pi_id = escapeSql($payment_intent->id); $pi_date = date('Y-m-d', $payment_intent->created); $pi_amount_paid = floatval(($payment_intent->amount_received / 100)); - $pi_currency = strtoupper(sanitizeInput($payment_intent->currency)); + $pi_currency = strtoupper(escapeSql($payment_intent->currency)); $pi_livemode = $payment_intent->livemode; } catch (Exception $e) { @@ -532,41 +532,41 @@ if (isset($_GET['add_payment_stripe'])) { ); $row = mysqli_fetch_assoc($sql); $invoice_number = intval($row['invoice_number']); - $invoice_status = sanitizeInput($row['invoice_status']); + $invoice_status = escapeSql($row['invoice_status']); $invoice_amount = floatval($row['invoice_amount']); - $invoice_prefix = sanitizeInput($row['invoice_prefix']); + $invoice_prefix = escapeSql($row['invoice_prefix']); $invoice_number = intval($row['invoice_number']); - $invoice_url_key = sanitizeInput($row['invoice_url_key']); - $invoice_currency_code = sanitizeInput($row['invoice_currency_code']); + $invoice_url_key = escapeSql($row['invoice_url_key']); + $invoice_currency_code = escapeSql($row['invoice_currency_code']); $client_id = intval($row['client_id']); - $client_name = sanitizeInput($row['client_name']); - $contact_name = sanitizeInput($row['contact_name']); - $contact_email = sanitizeInput($row['contact_email']); - $contact_phone = sanitizeInput(formatPhoneNumber($row['contact_phone'], $row['contact_phone_country_code'])); + $client_name = escapeSql($row['client_name']); + $contact_name = escapeSql($row['contact_name']); + $contact_email = escapeSql($row['contact_email']); + $contact_phone = escapeSql(formatPhoneNumber($row['contact_phone'], $row['contact_phone_country_code'])); $contact_extension = preg_replace("/[^0-9]/", '',$row['contact_extension']); - $contact_mobile = sanitizeInput(formatPhoneNumber($row['contact_mobile'], $row['contact_mobile_country_code'])); + $contact_mobile = escapeSql(formatPhoneNumber($row['contact_mobile'], $row['contact_mobile_country_code'])); // Get ITFlow company details $sql = mysqli_query($mysqli,"SELECT * FROM companies WHERE company_id = 1"); $row = mysqli_fetch_assoc($sql); - $company_name = sanitizeInput($row['company_name']); - $company_country = sanitizeInput($row['company_country']); - $company_address = sanitizeInput($row['company_address']); - $company_city = sanitizeInput($row['company_city']); - $company_state = sanitizeInput($row['company_state']); - $company_zip = sanitizeInput($row['company_zip']); - $company_phone = sanitizeInput(formatPhoneNumber($row['company_phone'], $row['company_phone_country_code'])); - $company_email = sanitizeInput($row['company_email']); - $company_website = sanitizeInput($row['company_website']); + $company_name = escapeSql($row['company_name']); + $company_country = escapeSql($row['company_country']); + $company_address = escapeSql($row['company_address']); + $company_city = escapeSql($row['company_city']); + $company_state = escapeSql($row['company_state']); + $company_zip = escapeSql($row['company_zip']); + $company_phone = escapeSql(formatPhoneNumber($row['company_phone'], $row['company_phone_country_code'])); + $company_email = escapeSql($row['company_email']); + $company_website = escapeSql($row['company_website']); // Sanitize Config vars from get_settings.php - $config_invoice_from_name = sanitizeInput($config_invoice_from_name); - $config_invoice_from_email = sanitizeInput($config_invoice_from_email); + $config_invoice_from_name = escapeSql($config_invoice_from_name); + $config_invoice_from_email = escapeSql($config_invoice_from_email); // Get Client Stripe details $stripe_client_details = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT * FROM client_stripe WHERE client_id = $client_id LIMIT 1")); - $stripe_id = sanitizeInput($stripe_client_details['stripe_id']); - $stripe_pm = sanitizeInput($stripe_client_details['stripe_pm']); + $stripe_id = escapeSql($stripe_client_details['stripe_id']); + $stripe_pm = escapeSql($stripe_client_details['stripe_pm']); // Sanity checks if (!$config_stripe_enable || !$stripe_id || !$stripe_pm) { @@ -606,10 +606,10 @@ if (isset($_GET['add_payment_stripe'])) { ]); // Get details from PI - $pi_id = sanitizeInput($payment_intent->id); + $pi_id = escapeSql($payment_intent->id); $pi_date = date('Y-m-d', $payment_intent->created); $pi_amount_paid = floatval(($payment_intent->amount_received / 100)); - $pi_currency = strtoupper(sanitizeInput($payment_intent->currency)); + $pi_currency = strtoupper(escapeSql($payment_intent->currency)); $pi_livemode = $payment_intent->livemode; } catch (Exception $e) { @@ -708,14 +708,14 @@ if (isset($_POST['add_bulk_payment'])) { enforceUserPermission('module_financial', 2); $client_id = intval($_POST['client_id']); - $date = sanitizeInput($_POST['date']); + $date = escapeSql($_POST['date']); $bulk_payment_amount = floatval($_POST['amount']); $bulk_payment_amount_static = floatval($_POST['amount']); $total_account_balance = floatval($_POST['balance']); $account = intval($_POST['account']); - $currency_code = sanitizeInput($_POST['currency_code']); - $payment_method = sanitizeInput($_POST['payment_method']); - $reference = sanitizeInput($_POST['reference']); + $currency_code = escapeSql($_POST['currency_code']); + $payment_method = escapeSql($_POST['payment_method']); + $reference = escapeSql($_POST['reference']); $email_receipt = intval($_POST['email_receipt']); enforceClientAccess(); @@ -738,10 +738,10 @@ if (isset($_POST['add_bulk_payment'])) { // Loop Through Each Invoice while ($row = mysqli_fetch_assoc($result_invoices)) { $invoice_id = intval($row['invoice_id']); - $invoice_prefix = sanitizeInput($row['invoice_prefix']); + $invoice_prefix = escapeSql($row['invoice_prefix']); $invoice_number = intval($row['invoice_number']); $invoice_amount = floatval($row['invoice_amount']); - $invoice_url_key = sanitizeInput($row['invoice_url_key']); + $invoice_url_key = escapeSql($row['invoice_url_key']); $invoice_balance_query = "SELECT SUM(payment_amount) AS amount_paid FROM payments WHERE payment_invoice_id = $invoice_id"; $result_amount_paid = mysqli_query($mysqli, $invoice_balance_query); $row_amount_paid = mysqli_fetch_assoc($result_amount_paid); @@ -798,19 +798,19 @@ if (isset($_POST['add_bulk_payment'])) { ); $row = mysqli_fetch_assoc($sql_client); - $client_name = sanitizeInput($row['client_name']); - $contact_name = sanitizeInput($row['contact_name']); - $contact_email = sanitizeInput($row['contact_email']); + $client_name = escapeSql($row['client_name']); + $contact_name = escapeSql($row['contact_name']); + $contact_email = escapeSql($row['contact_email']); $sql_company = mysqli_query($mysqli,"SELECT company_name, company_phone, company_phone_country_code FROM companies WHERE company_id = 1"); $row = mysqli_fetch_assoc($sql_company); - $company_name = sanitizeInput($row['company_name']); - $company_phone = sanitizeInput(formatPhoneNumber($row['company_phone'], $row['company_phone_country_code'])); + $company_name = escapeSql($row['company_name']); + $company_phone = escapeSql(formatPhoneNumber($row['company_phone'], $row['company_phone_country_code'])); // Sanitize Config vars from get_settings.php - $config_invoice_from_name = sanitizeInput($config_invoice_from_name); - $config_invoice_from_email = sanitizeInput($config_invoice_from_email); + $config_invoice_from_name = escapeSql($config_invoice_from_name); + $config_invoice_from_email = escapeSql($config_invoice_from_email); $subject = "Payment Received - Multiple Invoices"; $body = "Hello $contact_name,

Thank you for your payment of " . numfmt_format_currency($currency_format, $bulk_payment_amount_static, $currency_code) . " We\'ve applied your payment to the following invoices, updating their balances accordingly:

$email_body_invoices


We appreciate your continued business!

Sincerely,
$company_name - Billing
$config_invoice_from_email
$company_phone"; @@ -861,7 +861,7 @@ if (isset($_GET['delete_payment'])) { // Get the invoice total and details $sql = mysqli_query($mysqli,"SELECT * FROM invoices WHERE invoice_id = $invoice_id"); $row = mysqli_fetch_assoc($sql); - $invoice_prefix = sanitizeInput($row['invoice_prefix']); + $invoice_prefix = escapeSql($row['invoice_prefix']); $invoice_number = intval($row['invoice_number']); $invoice_amount = floatval($row['invoice_amount']); diff --git a/agent/post/product.php b/agent/post/product.php index 41d802e2..ce76a687 100644 --- a/agent/post/product.php +++ b/agent/post/product.php @@ -13,7 +13,7 @@ if (isset($_POST['add_product'])) { enforceUserPermission('module_sales', 2); require_once 'product_model.php'; - $type = sanitizeInput($_POST['type']); + $type = escapeSql($_POST['type']); mysqli_query($mysqli,"INSERT INTO products SET product_name = '$name', product_type = '$type', product_description = '$description', product_code = '$code', product_location = '$location', product_price = '$price', product_currency_code = '$session_company_currency', product_tax_id = $tax, product_category_id = $category"); @@ -55,7 +55,7 @@ if (isset($_GET['archive_product'])) { $product_id = intval($_GET['archive_product']); - $product_name = sanitizeInput(getFieldById('products', $product_id, 'product_name')); + $product_name = escapeSql(getFieldById('products', $product_id, 'product_name')); mysqli_query($mysqli,"UPDATE products SET product_archived_at = NOW() WHERE product_id = $product_id"); @@ -75,7 +75,7 @@ if (isset($_GET['restore_product'])) { $product_id = intval($_GET['restore_product']); - $product_name = sanitizeInput(getFieldById('products', $product_id, 'product_name')); + $product_name = escapeSql(getFieldById('products', $product_id, 'product_name')); mysqli_query($mysqli,"UPDATE products SET product_archived_at = NULL WHERE product_id = $product_id"); @@ -96,7 +96,7 @@ if (isset($_GET['delete_product'])) { $product_id = intval($_GET['delete_product']); //Get Product Name - $product_name = sanitizeInput(getFieldById('products', $product_id, 'product_name')); + $product_name = escapeSql(getFieldById('products', $product_id, 'product_name')); mysqli_query($mysqli,"DELETE FROM products WHERE product_id = $product_id"); @@ -117,7 +117,7 @@ if (isset($_POST['bulk_edit_product_category'])) { $category_id = intval($_POST['bulk_category_id']); // Get Category name for logging and Notification - $category_name = sanitizeInput(getFieldById('categories', $category_id, 'category_name')); + $category_name = escapeSql(getFieldById('categories', $category_id, 'category_name')); // Assign category to Selected Products if (isset($_POST['product_ids'])) { @@ -129,7 +129,7 @@ if (isset($_POST['bulk_edit_product_category'])) { $product_id = intval($product_id); // Get Product Details for Logging - $product_name = sanitizeInput(getFieldById('products', $product_id, 'product_name')); + $product_name = escapeSql(getFieldById('products', $product_id, 'product_name')); mysqli_query($mysqli,"UPDATE products SET product_category_id = $category_id WHERE product_id = $product_id"); @@ -161,7 +161,7 @@ if (isset($_POST['bulk_archive_products'])) { $product_id = intval($product_id); - $product_name = sanitizeInput(getFieldById('products', $product_id, 'product_name')); + $product_name = escapeSql(getFieldById('products', $product_id, 'product_name')); mysqli_query($mysqli,"UPDATE products SET product_archived_at = NOW() WHERE product_id = $product_id"); @@ -193,7 +193,7 @@ if (isset($_POST['bulk_restore_products'])) { $product_id = intval($product_id); - $product_name = sanitizeInput(getFieldById('products', $product_id, 'product_name')); + $product_name = escapeSql(getFieldById('products', $product_id, 'product_name')); mysqli_query($mysqli,"UPDATE products SET product_archived_at = NULL WHERE product_id = $product_id"); @@ -226,7 +226,7 @@ if (isset($_POST['bulk_delete_products'])) { foreach ($_POST['product_ids'] as $product_id) { $product_id = intval($product_id); - $product_name = sanitizeInput(getFieldById('products', $product_id, 'product_name')); + $product_name = escapeSql(getFieldById('products', $product_id, 'product_name')); mysqli_query($mysqli, "DELETE FROM products WHERE product_id = $product_id"); @@ -298,10 +298,10 @@ if (isset($_POST['add_product_stock'])) { $product_id = intval($_POST['product_id']); $qty = intval($_POST['qty']); $expense = intval($_POST['expense']); - $note = sanitizeInput($_POST['note']); + $note = escapeSql($_POST['note']); // Get product name - $product_name = sanitizeInput(getFieldById('products', $product_id, 'product_name')); + $product_name = escapeSql(getFieldById('products', $product_id, 'product_name')); mysqli_query($mysqli,"INSERT INTO product_stock SET stock_qty = $qty, stock_expense_id = $expense, stock_note = '$note', stock_product_id = $product_id"); diff --git a/agent/post/product_model.php b/agent/post/product_model.php index 86911847..f6fffbcd 100644 --- a/agent/post/product_model.php +++ b/agent/post/product_model.php @@ -1,10 +1,10 @@
Thank you for your inquiry, we are pleased to provide you with the following estimate.


$quote_scope
Total Cost: " . numfmt_format_currency($currency_format, $quote_amount, $quote_currency_code) . "


View and accept your estimate online here


--
$company_name - Sales
$config_quote_from_email
$company_phone"; @@ -662,8 +662,8 @@ if (isset($_GET['mark_quote_invoiced'])) { $sql = mysqli_query($mysqli,"SELECT * FROM quotes WHERE quote_id = $quote_id"); $row = mysqli_fetch_assoc($sql); - $quote_prefix = sanitizeInput($row['quote_prefix']); - $quote_number = sanitizeInput($row['quote_number']); + $quote_prefix = escapeSql($row['quote_prefix']); + $quote_number = escapeSql($row['quote_number']); $client_id = intval($row['quote_client_id']); enforceClientAccess(); diff --git a/agent/post/quote_model.php b/agent/post/quote_model.php index 8d270809..8326a1e9 100644 --- a/agent/post/quote_model.php +++ b/agent/post/quote_model.php @@ -1,10 +1,10 @@ 0) { $row = mysqli_fetch_assoc($sql); - $subject = sanitizeInput($row['recurring_ticket_subject']); + $subject = escapeSql($row['recurring_ticket_subject']); $details = mysqli_real_escape_string($mysqli, $row['recurring_ticket_details']); - $priority = sanitizeInput($row['recurring_ticket_priority']); - $frequency = sanitizeInput(strtolower($row['recurring_ticket_frequency'])); + $priority = escapeSql($row['recurring_ticket_priority']); + $frequency = escapeSql(strtolower($row['recurring_ticket_frequency'])); $billable = intval($row['recurring_ticket_billable']); - $old_next_recurring_date = sanitizeInput($row['recurring_ticket_next_run']); + $old_next_recurring_date = escapeSql($row['recurring_ticket_next_run']); $created_id = intval($row['recurring_ticket_created_by']); $assigned_id = intval($row['recurring_ticket_assigned_to']); $contact_id = intval($row['recurring_ticket_contact_id']); @@ -112,10 +112,10 @@ if (isset($_POST['bulk_force_recurring_tickets'])) { } // Sanitize Config Vars from get_settings.php and Session Vars from check_login.php - $config_ticket_prefix = sanitizeInput($config_ticket_prefix); - $config_ticket_from_name = sanitizeInput($config_ticket_from_name); - $config_ticket_from_email = sanitizeInput($config_ticket_from_email); - $config_base_url = sanitizeInput($config_base_url); + $config_ticket_prefix = escapeSql($config_ticket_prefix); + $config_ticket_from_name = escapeSql($config_ticket_from_name); + $config_ticket_from_email = escapeSql($config_ticket_from_email); + $config_base_url = escapeSql($config_base_url); // Atomically increment and get the new ticket number mysqli_query($mysqli, " @@ -152,15 +152,15 @@ if (isset($_POST['bulk_force_recurring_tickets'])) { ); $row = mysqli_fetch_assoc($sql); - $contact_name = sanitizeInput($row['contact_name']); - $contact_email = sanitizeInput($row['contact_email']); - $client_name = sanitizeInput($row['client_name']); - $contact_name = sanitizeInput($row['contact_name']); - $contact_email = sanitizeInput($row['contact_email']); - $ticket_prefix = sanitizeInput($row['ticket_prefix']); + $contact_name = escapeSql($row['contact_name']); + $contact_email = escapeSql($row['contact_email']); + $client_name = escapeSql($row['client_name']); + $contact_name = escapeSql($row['contact_name']); + $contact_email = escapeSql($row['contact_email']); + $ticket_prefix = escapeSql($row['ticket_prefix']); $ticket_number = intval($row['ticket_number']); - $ticket_priority = sanitizeInput($row['ticket_priority']); - $ticket_subject = sanitizeInput($row['ticket_subject']); + $ticket_priority = escapeSql($row['ticket_priority']); + $ticket_subject = escapeSql($row['ticket_subject']); $ticket_details = mysqli_real_escape_string($mysqli, $row['ticket_details']); $data = []; @@ -230,12 +230,12 @@ if (isset($_GET['force_recurring_ticket'])) { if (mysqli_num_rows($sql) > 0) { $row = mysqli_fetch_assoc($sql); - $subject = sanitizeInput($row['recurring_ticket_subject']); + $subject = escapeSql($row['recurring_ticket_subject']); $details = mysqli_real_escape_string($mysqli, $row['recurring_ticket_details']); - $priority = sanitizeInput($row['recurring_ticket_priority']); - $frequency = sanitizeInput(strtolower($row['recurring_ticket_frequency'])); + $priority = escapeSql($row['recurring_ticket_priority']); + $frequency = escapeSql(strtolower($row['recurring_ticket_frequency'])); $billable = intval($row['recurring_ticket_billable']); - $old_next_recurring_date = sanitizeInput($row['recurring_ticket_next_run']); + $old_next_recurring_date = escapeSql($row['recurring_ticket_next_run']); $created_id = intval($row['recurring_ticket_created_by']); $assigned_id = intval($row['recurring_ticket_assigned_to']); $contact_id = intval($row['recurring_ticket_contact_id']); @@ -252,10 +252,10 @@ if (isset($_GET['force_recurring_ticket'])) { } // Sanitize Config Vars from get_settings.php and Session Vars from check_login.php - $config_ticket_prefix = sanitizeInput($config_ticket_prefix); - $config_ticket_from_name = sanitizeInput($config_ticket_from_name); - $config_ticket_from_email = sanitizeInput($config_ticket_from_email); - $config_base_url = sanitizeInput($config_base_url); + $config_ticket_prefix = escapeSql($config_ticket_prefix); + $config_ticket_from_name = escapeSql($config_ticket_from_name); + $config_ticket_from_email = escapeSql($config_ticket_from_email); + $config_base_url = escapeSql($config_base_url); // Atomically increment and get the new ticket number mysqli_query($mysqli, " @@ -292,15 +292,15 @@ if (isset($_GET['force_recurring_ticket'])) { ); $row = mysqli_fetch_assoc($sql); - $contact_name = sanitizeInput($row['contact_name']); - $contact_email = sanitizeInput($row['contact_email']); - $client_name = sanitizeInput($row['client_name']); - $contact_name = sanitizeInput($row['contact_name']); - $contact_email = sanitizeInput($row['contact_email']); - $ticket_prefix = sanitizeInput($row['ticket_prefix']); + $contact_name = escapeSql($row['contact_name']); + $contact_email = escapeSql($row['contact_email']); + $client_name = escapeSql($row['client_name']); + $contact_name = escapeSql($row['contact_name']); + $contact_email = escapeSql($row['contact_email']); + $ticket_prefix = escapeSql($row['ticket_prefix']); $ticket_number = intval($row['ticket_number']); - $ticket_priority = sanitizeInput($row['ticket_priority']); - $ticket_subject = sanitizeInput($row['ticket_subject']); + $ticket_priority = escapeSql($row['ticket_priority']); + $ticket_subject = escapeSql($row['ticket_subject']); $ticket_details = mysqli_real_escape_string($mysqli, $row['ticket_details']); $data = []; @@ -369,8 +369,8 @@ if (isset($_GET['delete_recurring_ticket'])) { // Get Scheduled Ticket Subject Ticket Prefix, Number and Client ID for logging and alert message $sql = mysqli_query($mysqli, "SELECT * FROM recurring_tickets WHERE recurring_ticket_id = $recurring_ticket_id"); $row = mysqli_fetch_assoc($sql); - $subject = sanitizeInput($row['recurring_ticket_subject']); - $frequency = sanitizeInput($row['recurring_ticket_frequency']); + $subject = escapeSql($row['recurring_ticket_subject']); + $frequency = escapeSql($row['recurring_ticket_frequency']); $client_id = intval($row['recurring_ticket_client_id']); enforceClientAccess(); @@ -404,8 +404,8 @@ if (isset($_POST['bulk_delete_recurring_tickets'])) { // Get Scheduled Ticket Subject Ticket Prefix, Number and Client ID for logging and alert message $sql = mysqli_query($mysqli, "SELECT * FROM recurring_tickets WHERE recurring_ticket_id = $recurring_ticket_id"); $row = mysqli_fetch_assoc($sql); - $subject = sanitizeInput($row['recurring_ticket_subject']); - $frequency = sanitizeInput($row['recurring_ticket_frequency']); + $subject = escapeSql($row['recurring_ticket_subject']); + $frequency = escapeSql($row['recurring_ticket_frequency']); $client_id = intval($row['recurring_ticket_client_id']); enforceClientAccess(); @@ -445,8 +445,8 @@ if (isset($_POST['bulk_assign_recurring_ticket'])) { $sql = mysqli_query($mysqli, "SELECT * FROM recurring_tickets WHERE recurring_ticket_id = $recurring_ticket_id"); $row = mysqli_fetch_assoc($sql); - $recurring_ticket_name = sanitizeInput($row['recurring_ticket_name']); - $recurring_ticket_subject = sanitizeInput($row['recurring_ticket_subject']); + $recurring_ticket_name = escapeSql($row['recurring_ticket_name']); + $recurring_ticket_subject = escapeSql($row['recurring_ticket_subject']); $client_id = intval($row['recurring_ticket_client_id']); enforceClientAccess(); @@ -460,8 +460,8 @@ if (isset($_POST['bulk_assign_recurring_ticket'])) { $agent_details_sql = mysqli_query($mysqli, "SELECT user_name, user_email FROM users LEFT JOIN user_settings ON users.user_id = user_settings.user_id WHERE users.user_id = $assign_to"); $agent_details = mysqli_fetch_assoc($agent_details_sql); - $agent_name = sanitizeInput($agent_details['user_name']); - $agent_email = sanitizeInput($agent_details['user_email']); + $agent_name = escapeSql($agent_details['user_name']); + $agent_email = escapeSql($agent_details['user_email']); if (!$agent_name) { flash_alert("Invalid agent!", 'error'); @@ -487,9 +487,9 @@ if (isset($_POST['bulk_assign_recurring_ticket'])) { if (!empty($config_smtp_provider)) { // Sanitize Config vars from get_settings.php - $config_ticket_from_name = sanitizeInput($config_ticket_from_name); - $config_ticket_from_email = sanitizeInput($config_ticket_from_email); - $company_name = sanitizeInput($session_company_name); + $config_ticket_from_name = escapeSql($config_ticket_from_name); + $config_ticket_from_email = escapeSql($config_ticket_from_email); + $company_name = escapeSql($session_company_name); $subject = "$config_app_name - $recurring_ticket_count recurring tickets have been assigned to you"; $body = "Hi $agent_name,

$session_name assigned $recurring_ticket_count recurring tickets to you!

$tickets_assigned_body
Thanks,
$session_name
$company_name"; @@ -523,7 +523,7 @@ if (isset($_POST['bulk_edit_recurring_ticket_priority'])) { enforceUserPermission('module_support', 2); - $priority = sanitizeInput($_POST['bulk_priority']); + $priority = escapeSql($_POST['bulk_priority']); // Assign Tech to Selected Recurring Tickets if (isset($_POST['recurring_ticket_ids'])) { @@ -537,8 +537,8 @@ if (isset($_POST['bulk_edit_recurring_ticket_priority'])) { $sql = mysqli_query($mysqli, "SELECT * FROM recurring_tickets WHERE recurring_ticket_id = $recurring_ticket_id"); $row = mysqli_fetch_assoc($sql); - $recurring_ticket_subject = sanitizeInput($row['recurring_ticket_subject']); - $original_recurring_ticket_priority = sanitizeInput($row['recurring_ticket_priority']); + $recurring_ticket_subject = escapeSql($row['recurring_ticket_subject']); + $original_recurring_ticket_priority = escapeSql($row['recurring_ticket_priority']); $client_id = intval($row['ticket_client_id']); enforceClientAccess(); @@ -578,13 +578,13 @@ if (isset($_POST['bulk_edit_recurring_ticket_category'])) { $sql = mysqli_query($mysqli, "SELECT recurring_ticket_subject, category_name, recurring_ticket_client_id FROM recurring_tickets LEFT JOIN categories ON recurring_ticket_category = category_id WHERE recurring_ticket_id = $recurring_ticket_id"); $row = mysqli_fetch_assoc($sql); - $recurring_ticket_subject = sanitizeInput($row['recurring_ticket_subject']); - $previous_recurring_ticket_category_name = sanitizeInput($row['category_name']); + $recurring_ticket_subject = escapeSql($row['recurring_ticket_subject']); + $previous_recurring_ticket_category_name = escapeSql($row['category_name']); $client_id = intval($row['recurring_ticket_client_id']); enforceClientAccess(); - $category_name = sanitizeInput(getFieldById('categories', $category_id, 'category_name')); + $category_name = escapeSql(getFieldById('categories', $category_id, 'category_name')); mysqli_query($mysqli, "UPDATE recurring_tickets SET recurring_ticket_category = '$category_id' WHERE recurring_ticket_id = $recurring_ticket_id"); @@ -626,7 +626,7 @@ if (isset($_POST['bulk_edit_recurring_ticket_billable'])) { $sql = mysqli_query($mysqli, "SELECT recurring_ticket_subject, recurring_ticket_client_id FROM recurring_tickets WHERE recurring_ticket_id = $recurring_ticket_id"); $row = mysqli_fetch_assoc($sql); - $recurring_ticket_subject = sanitizeInput($row['recurring_ticket_subject']); + $recurring_ticket_subject = escapeSql($row['recurring_ticket_subject']); $previous_recurring_ticket_billable = intval($row['recurring_ticket_billable']); if ($previous_recurring_ticket_billable) { $previous_billable_status = "Billable"; @@ -659,7 +659,7 @@ if (isset($_POST['bulk_edit_recurring_ticket_next_run_date'])) { enforceUserPermission('module_support', 2); - $next_run_date = sanitizeInput($_POST['next_run_date']); + $next_run_date = escapeSql($_POST['next_run_date']); if (isset($_POST['recurring_ticket_ids'])) { @@ -671,8 +671,8 @@ if (isset($_POST['bulk_edit_recurring_ticket_next_run_date'])) { $sql = mysqli_query($mysqli, "SELECT recurring_ticket_subject, recurring_ticket_client_id FROM recurring_tickets WHERE recurring_ticket_id = $recurring_ticket_id"); $row = mysqli_fetch_assoc($sql); - $recurring_ticket_subject = sanitizeInput($row['recurring_ticket_subject']); - $previous_recurring_ticket_next_run_date = sanitizeInput($row['recurring_ticket_next_run']); + $recurring_ticket_subject = escapeSql($row['recurring_ticket_subject']); + $previous_recurring_ticket_next_run_date = escapeSql($row['recurring_ticket_next_run']); $client_id = intval($row['recurring_ticket_client_id']); enforceClientAccess(); diff --git a/agent/post/recurring_ticket_model.php b/agent/post/recurring_ticket_model.php index a44c2fa6..47f47eba 100644 --- a/agent/post/recurring_ticket_model.php +++ b/agent/post/recurring_ticket_model.php @@ -1,10 +1,10 @@ 0) { while ($row = mysqli_fetch_assoc($sql_task_templates)) { $task_order = intval($row['task_template_order']); - $task_name = sanitizeInput($row['task_template_name']); + $task_name = escapeSql($row['task_template_name']); $task_completion_estimate = intval($row['task_template_completion_estimate']); mysqli_query($mysqli,"INSERT INTO tasks SET task_name = '$task_name', task_order = $task_order, task_completion_estimate = $task_completion_estimate, task_ticket_id = $ticket_id"); @@ -97,7 +97,7 @@ if (isset($_POST['add_ticket'])) { // Add Watchers if (isset($_POST['watchers'])) { foreach ($_POST['watchers'] as $watcher) { - $watcher_email = sanitizeInput($watcher); + $watcher_email = escapeSql($watcher); mysqli_query($mysqli, "INSERT INTO ticket_watchers SET watcher_email = '$watcher_email', watcher_ticket_id = $ticket_id"); } } @@ -120,16 +120,16 @@ if (isset($_POST['add_ticket'])) { WHERE ticket_id = $ticket_id"); $row = mysqli_fetch_assoc($sql); - $contact_name = sanitizeInput($row['contact_name']); - $contact_email = sanitizeInput($row['contact_email']); - $ticket_prefix = sanitizeInput($row['ticket_prefix']); + $contact_name = escapeSql($row['contact_name']); + $contact_email = escapeSql($row['contact_email']); + $ticket_prefix = escapeSql($row['ticket_prefix']); $ticket_number = intval($row['ticket_number']); - $ticket_category = sanitizeInput($row['ticket_category']); - $ticket_subject = sanitizeInput($row['ticket_subject']); + $ticket_category = escapeSql($row['ticket_category']); + $ticket_subject = escapeSql($row['ticket_subject']); $ticket_details = mysqli_escape_string($mysqli, $row['ticket_details']); - $ticket_priority = sanitizeInput($row['ticket_priority']); - $ticket_status = sanitizeInput($row['ticket_status']); - $ticket_status_name = sanitizeInput(getTicketStatusName($row['ticket_status'])); + $ticket_priority = escapeSql($row['ticket_priority']); + $ticket_status = escapeSql($row['ticket_status']); + $ticket_status_name = escapeSql(getTicketStatusName($row['ticket_status'])); $client_id = intval($row['ticket_client_id']); $ticket_created_by = intval($row['ticket_created_by']); $ticket_assigned_to = intval($row['ticket_assigned_to']); @@ -137,8 +137,8 @@ if (isset($_POST['add_ticket'])) { // Get Company Phone Number $sql = mysqli_query($mysqli, "SELECT company_name, company_phone, company_phone_country_code FROM companies WHERE company_id = 1"); $row = mysqli_fetch_assoc($sql); - $company_name = sanitizeInput($row['company_name']); - $company_phone = sanitizeInput(formatPhoneNumber($row['company_phone'], $row['company_phone_country_code'])); + $company_name = escapeSql($row['company_name']); + $company_phone = escapeSql(formatPhoneNumber($row['company_phone'], $row['company_phone_country_code'])); // EMAILING @@ -167,7 +167,7 @@ if (isset($_POST['add_ticket'])) { $sql_watchers = mysqli_query($mysqli, "SELECT watcher_email FROM ticket_watchers WHERE watcher_ticket_id = $ticket_id"); $body .= "

----------------------------------------
YOU HAVE BEEN ADDED AS A COLLABORATOR FOR THIS TICKET"; while ($row = mysqli_fetch_assoc($sql_watchers)) { - $watcher_email = sanitizeInput($row['watcher_email']); + $watcher_email = escapeSql($row['watcher_email']); // Queue Mail $data[] = [ @@ -207,11 +207,11 @@ if (isset($_POST['edit_ticket'])) { $assigned_to = intval($_POST['assigned_to']); $notify = intval($_POST['contact_notify'] ?? 0); $category_id = intval($_POST['category_id']); - $ticket_subject = sanitizeInput($_POST['subject']); + $ticket_subject = escapeSql($_POST['subject']); $billable = intval($_POST['billable'] ?? 0); - $ticket_priority = sanitizeInput($_POST['priority']); + $ticket_priority = escapeSql($_POST['priority']); $details = mysqli_real_escape_string($mysqli, $_POST['details']); - $vendor_ticket_number = sanitizeInput($_POST['vendor_ticket_number']); + $vendor_ticket_number = escapeSql($_POST['vendor_ticket_number']); $vendor_id = intval($_POST['vendor_id']); $asset_id = intval($_POST['asset_id']); $location_id = intval($_POST['location_id']); @@ -260,16 +260,16 @@ if (isset($_POST['edit_ticket'])) { AND ticket_closed_at IS NULL"); $row = mysqli_fetch_assoc($sql); - $contact_name = sanitizeInput($row['contact_name']); - $contact_email = sanitizeInput($row['contact_email']); - $ticket_prefix = sanitizeInput($row['ticket_prefix']); + $contact_name = escapeSql($row['contact_name']); + $contact_email = escapeSql($row['contact_email']); + $ticket_prefix = escapeSql($row['ticket_prefix']); $ticket_number = intval($row['ticket_number']); - $ticket_category = sanitizeInput($row['ticket_category']); + $ticket_category = escapeSql($row['ticket_category']); $ticket_details = mysqli_escape_string($mysqli, $row['ticket_details']); - $ticket_status = sanitizeInput($row['ticket_status_name']); + $ticket_status = escapeSql($row['ticket_status_name']); $ticket_created_by = intval($row['ticket_created_by']); $ticket_assigned_to = intval($row['ticket_assigned_to']); - $url_key = sanitizeInput($row['ticket_url_key']); + $url_key = escapeSql($row['ticket_url_key']); $client_id = intval($row['ticket_client_id']); // Notify new contact if selected @@ -278,8 +278,8 @@ if (isset($_POST['edit_ticket'])) { // Get Company Name Phone Number and Sanitize for Email Sending $sql = mysqli_query($mysqli, "SELECT company_name, company_phone, company_phone_country_code FROM companies WHERE company_id = 1"); $row = mysqli_fetch_assoc($sql); - $company_name = sanitizeInput($row['company_name']); - $company_phone = sanitizeInput(formatPhoneNumber($row['company_phone'], $row['company_phone_country_code'])); + $company_name = escapeSql($row['company_name']); + $company_phone = escapeSql(formatPhoneNumber($row['company_phone'], $row['company_phone_country_code'])); // Email content $data = []; // Queue array @@ -321,7 +321,7 @@ if (isset($_POST['edit_ticket_priority'])) { enforceUserPermission('module_support', 2); $ticket_id = intval($_POST['ticket_id']); - $priority = sanitizeInput($_POST['priority']); + $priority = escapeSql($_POST['priority']); $client_id = intval($_POST['client_id']); // Get ticket details before updating @@ -332,10 +332,10 @@ if (isset($_POST['edit_ticket_priority'])) { WHERE ticket_id = $ticket_id" ); $row = mysqli_fetch_assoc($sql); - $ticket_prefix = sanitizeInput($row['ticket_prefix']); + $ticket_prefix = escapeSql($row['ticket_prefix']); $ticket_number = intval($row['ticket_number']); - $original_priority = sanitizeInput($row['ticket_priority']); - $ticket_status = sanitizeInput($row['ticket_status_name']); + $original_priority = escapeSql($row['ticket_priority']); + $ticket_status = escapeSql($row['ticket_status_name']); $client_id = intval($row['ticket_client_id']); // Don't Enforce Client Access if Ticket doesn't have an assigned client @@ -379,15 +379,15 @@ if (isset($_POST['edit_ticket_contact'])) { $row = mysqli_fetch_assoc($sql); // Original contact - $original_contact_name = !empty($row['contact_name']) ? sanitizeInput($row['contact_name']) : 'No one'; + $original_contact_name = !empty($row['contact_name']) ? escapeSql($row['contact_name']) : 'No one'; // Ticket details - $ticket_prefix = sanitizeInput($row['ticket_prefix']); + $ticket_prefix = escapeSql($row['ticket_prefix']); $ticket_number = intval($row['ticket_number']); - $ticket_status = sanitizeInput($row['ticket_status_name']); - $ticket_subject = sanitizeInput($row['ticket_subject']); + $ticket_status = escapeSql($row['ticket_status_name']); + $ticket_subject = escapeSql($row['ticket_subject']); $ticket_details = mysqli_escape_string($mysqli, $row['ticket_details']); - $url_key = sanitizeInput($row['ticket_url_key']); + $url_key = escapeSql($row['ticket_url_key']); $client_id = intval($row['ticket_client_id']); // Don't Enforce Client Access if Ticket doesn't have an assigned client @@ -402,8 +402,8 @@ if (isset($_POST['edit_ticket_contact'])) { $sql = mysqli_query($mysqli, "SELECT contact_name, contact_email FROM contacts WHERE contact_id = $contact_id"); $row = mysqli_fetch_assoc($sql); - $contact_name = !empty($row['contact_name']) ? sanitizeInput($row['contact_name']) : 'No one'; - $contact_email = sanitizeInput($row['contact_email']); + $contact_name = !empty($row['contact_name']) ? escapeSql($row['contact_name']) : 'No one'; + $contact_email = escapeSql($row['contact_email']); // Notify new contact (if selected, valid & configured) if ($notify && filter_var($contact_email, FILTER_VALIDATE_EMAIL) && (!empty($config_smtp_provider) || !empty($config_smtp_provider))) { @@ -411,11 +411,11 @@ if (isset($_POST['edit_ticket_contact'])) { // Get Company Phone Number $sql = mysqli_query($mysqli, "SELECT company_name, company_phone, company_phone_country_code FROM companies WHERE company_id = 1"); $row = mysqli_fetch_assoc($sql); - $company_name = sanitizeInput($row['company_name']); - $company_phone = sanitizeInput(formatPhoneNumber($row['company_phone'], $row['company_phone_country_code'])); + $company_name = escapeSql($row['company_name']); + $company_phone = escapeSql(formatPhoneNumber($row['company_phone'], $row['company_phone_country_code'])); - $config_ticket_from_email = sanitizeInput($config_ticket_from_email); - $config_ticket_from_name = sanitizeInput($config_ticket_from_name); + $config_ticket_from_email = escapeSql($config_ticket_from_email); + $config_ticket_from_name = escapeSql($config_ticket_from_name); // Email content $data = []; // Queue array @@ -458,10 +458,10 @@ if (isset($_POST['edit_ticket_project'])) { $ticket_id = intval($_POST['ticket_id']); $project_id = intval($_POST['project']); - $project_name = sanitizeInput(getFieldById('projects', $project_id, 'project_name')); + $project_name = escapeSql(getFieldById('projects', $project_id, 'project_name')); $client_id = intval(getFieldById('tickets', $ticket_id, 'ticket_client_id')); - $ticket_prefix = sanitizeInput(getFieldById('tickets', $ticket_id, 'ticket_prefix')); - $ticket_number = sanitizeInput(getFieldById('tickets', $ticket_id, 'ticket_number')); + $ticket_prefix = escapeSql(getFieldById('tickets', $ticket_id, 'ticket_prefix')); + $ticket_number = escapeSql(getFieldById('tickets', $ticket_id, 'ticket_number')); // Don't Enforce Client Access if Ticket doesn't have an assigned client if ($client_id) { @@ -497,14 +497,14 @@ if (isset($_POST['add_ticket_watcher'])) { AND ticket_closed_at IS NULL"); $row = mysqli_fetch_assoc($sql); - $ticket_prefix = sanitizeInput($row['ticket_prefix']); + $ticket_prefix = escapeSql($row['ticket_prefix']); $ticket_number = intval($row['ticket_number']); - $ticket_category = sanitizeInput($row['ticket_category']); - $ticket_subject = sanitizeInput($row['ticket_subject']); + $ticket_category = escapeSql($row['ticket_category']); + $ticket_subject = escapeSql($row['ticket_subject']); $ticket_details = mysqli_escape_string($mysqli, $row['ticket_details']); - $ticket_priority = sanitizeInput($row['ticket_priority']); - $ticket_status = sanitizeInput($row['ticket_status_name']); - $url_key = sanitizeInput($row['ticket_url_key']); + $ticket_priority = escapeSql($row['ticket_priority']); + $ticket_status = escapeSql($row['ticket_status_name']); + $url_key = escapeSql($row['ticket_url_key']); $client_id = intval($row['ticket_client_id']); $ticket_created_by = intval($row['ticket_created_by']); $ticket_assigned_to = intval($row['ticket_assigned_to']); @@ -517,15 +517,15 @@ if (isset($_POST['add_ticket_watcher'])) { // Get Company Phone Number $sql = mysqli_query($mysqli, "SELECT company_name, company_phone, company_phone_country_code FROM companies WHERE company_id = 1"); $row = mysqli_fetch_assoc($sql); - $company_name = sanitizeInput($row['company_name']); - $company_phone = sanitizeInput(formatPhoneNumber($row['company_phone'], $row['company_phone_country_code'])); + $company_name = escapeSql($row['company_name']); + $company_phone = escapeSql(formatPhoneNumber($row['company_phone'], $row['company_phone_country_code'])); // Process each watcher in list foreach ($watcher_emails as $watcher_email) { if (filter_var($watcher_email, FILTER_VALIDATE_EMAIL)) { - $watcher_email = sanitizeInput($watcher_email); + $watcher_email = escapeSql($watcher_email); mysqli_query($mysqli, "INSERT INTO ticket_watchers SET watcher_email = '$watcher_email', watcher_ticket_id = $ticket_id"); @@ -579,10 +579,10 @@ if (isset($_GET['delete_ticket_watcher'])) { ); $row = mysqli_fetch_assoc($sql); - $ticket_prefix = sanitizeInput($row['ticket_prefix']); + $ticket_prefix = escapeSql($row['ticket_prefix']); $ticket_number = intval($row['ticket_number']); - $ticket_status_name = sanitizeInput($row['ticket_status_name']); - $watcher_email = sanitizeInput($row['watcher_email']); + $ticket_status_name = escapeSql($row['ticket_status_name']); + $watcher_email = escapeSql($row['watcher_email']); $client_id = intval($row['ticket_client_id']); $ticket_id = intval($row['ticket_id']); @@ -621,10 +621,10 @@ if (isset($_GET['delete_ticket_additional_asset'])) { ); $row = mysqli_fetch_assoc($sql); - $ticket_prefix = sanitizeInput($row['ticket_prefix']); + $ticket_prefix = escapeSql($row['ticket_prefix']); $ticket_number = intval($row['ticket_number']); - $ticket_status_name = sanitizeInput($row['ticket_status_name']); - $asset_name = sanitizeInput($row['asset_name']); + $ticket_status_name = escapeSql($row['ticket_status_name']); + $asset_name = escapeSql($row['asset_name']); $client_id = intval($row['ticket_client_id']); // Don't Enforce Client Access if Ticket doesn't have an assigned client @@ -684,10 +684,10 @@ if (isset($_POST['edit_ticket_asset'])) { ); $row = mysqli_fetch_assoc($sql); - $ticket_prefix = sanitizeInput($row['ticket_prefix']); + $ticket_prefix = escapeSql($row['ticket_prefix']); $ticket_number = intval($row['ticket_number']); - $ticket_status_name = sanitizeInput($row['ticket_status_name']); - $asset_name = sanitizeInput($row['asset_name']); + $ticket_status_name = escapeSql($row['ticket_status_name']); + $asset_name = escapeSql($row['asset_name']); $client_id = intval($row['ticket_client_id']); logAction("Ticket", "Edit", "$session_name changed asset to $asset_name for ticket $ticket_prefix$ticket_number", $client_id, $ticket_id); @@ -724,10 +724,10 @@ if (isset($_POST['edit_ticket_vendor'])) { ); $row = mysqli_fetch_assoc($sql); - $ticket_prefix = sanitizeInput($row['ticket_prefix']); + $ticket_prefix = escapeSql($row['ticket_prefix']); $ticket_number = intval($row['ticket_number']); - $ticket_status_name = sanitizeInput($row['ticket_status_name']); - $vendor_name = sanitizeInput($row['vendor_name']); + $ticket_status_name = escapeSql($row['ticket_status_name']); + $vendor_name = escapeSql($row['vendor_name']); $client_id = intval($row['ticket_client_id']); logAction("Ticket", "Edit", "$session_name set vendor to $vendor_name for ticket $ticket_prefix$ticket_number", $client_id, $ticket_id); @@ -763,8 +763,8 @@ if (isset($_POST['assign_ticket'])) { $agent_details_sql = mysqli_query($mysqli, "SELECT user_name, user_email FROM users WHERE users.user_id = $assigned_to"); $agent_details = mysqli_fetch_assoc($agent_details_sql); - $agent_name = sanitizeInput($agent_details['user_name']); - $agent_email = sanitizeInput($agent_details['user_email']); + $agent_name = escapeSql($agent_details['user_name']); + $agent_email = escapeSql($agent_details['user_email']); $ticket_reply = "Ticket re-assigned to $agent_name."; if (!$agent_name) { @@ -777,11 +777,11 @@ if (isset($_POST['assign_ticket'])) { $ticket_details_sql = mysqli_query($mysqli, "SELECT ticket_prefix, ticket_number, ticket_subject, ticket_client_id, client_name FROM tickets LEFT JOIN clients ON ticket_client_id = client_id WHERE ticket_id = '$ticket_id' AND ticket_status != 5"); $ticket_details = mysqli_fetch_assoc($ticket_details_sql); - $ticket_prefix = sanitizeInput($ticket_details['ticket_prefix']); + $ticket_prefix = escapeSql($ticket_details['ticket_prefix']); $ticket_number = intval($ticket_details['ticket_number']); - $ticket_subject = sanitizeInput($ticket_details['ticket_subject']); + $ticket_subject = escapeSql($ticket_details['ticket_subject']); $client_id = intval($ticket_details['ticket_client_id']); - $client_name = sanitizeInput($ticket_details['client_name']); + $client_name = escapeSql($ticket_details['client_name']); // Don't Enforce Client Access if Ticket doesn't have an assigned client if ($client_id) { @@ -816,9 +816,9 @@ if (isset($_POST['assign_ticket'])) { if (!empty($config_smtp_provider)) { // Sanitize Config vars from get_settings.php - $config_ticket_from_name = sanitizeInput($config_ticket_from_name); - $config_ticket_from_email = sanitizeInput($config_ticket_from_email); - $company_name = sanitizeInput($session_company_name); + $config_ticket_from_name = escapeSql($config_ticket_from_name); + $config_ticket_from_email = escapeSql($config_ticket_from_email); + $company_name = escapeSql($session_company_name); $subject = "$config_app_name - Ticket $ticket_prefix$ticket_number assigned to you - $ticket_subject"; $body = "Hi $agent_name,

A ticket has been assigned to you!

Client: $client_name
Ticket Number: $ticket_prefix$ticket_number
Subject: $ticket_subject

https://$config_base_url/agent/ticket.php?ticket_id=$ticket_id$client_uri

Thanks,
$session_name
$company_name"; @@ -858,11 +858,11 @@ if (isset($_GET['delete_ticket'])) { // Get Ticket and Client ID for logging and alert message $sql = mysqli_query($mysqli, "SELECT ticket_prefix, ticket_number, ticket_subject, ticket_status, ticket_closed_at, ticket_client_id FROM tickets WHERE ticket_id = $ticket_id"); $row = mysqli_fetch_assoc($sql); - $ticket_prefix = sanitizeInput($row['ticket_prefix']); - $ticket_number = sanitizeInput($row['ticket_number']); - $ticket_subject = sanitizeInput($row['ticket_subject']); - $ticket_status = sanitizeInput($row['ticket_status']); - $ticket_closed_at = sanitizeInput($row['ticket_closed_at']); + $ticket_prefix = escapeSql($row['ticket_prefix']); + $ticket_number = escapeSql($row['ticket_number']); + $ticket_subject = escapeSql($row['ticket_subject']); + $ticket_status = escapeSql($row['ticket_status']); + $ticket_closed_at = escapeSql($row['ticket_closed_at']); $client_id = intval($row['ticket_client_id']); // Don't Enforce Client Access if Ticket doesn't have an assigned client @@ -971,11 +971,11 @@ if (isset($_POST['bulk_assign_ticket'])) { $sql = mysqli_query($mysqli, "SELECT * FROM tickets LEFT JOIN ticket_statuses ON ticket_status = ticket_status_id WHERE ticket_id = $ticket_id"); $row = mysqli_fetch_assoc($sql); - $ticket_prefix = sanitizeInput($row['ticket_prefix']); + $ticket_prefix = escapeSql($row['ticket_prefix']); $ticket_number = intval($row['ticket_number']); $ticket_status = intval($row['ticket_status']); - $ticket_name = sanitizeInput($row['ticket_name']); - $ticket_subject = sanitizeInput($row['ticket_subject']); + $ticket_name = escapeSql($row['ticket_name']); + $ticket_subject = escapeSql($row['ticket_subject']); $client_id = intval($row['ticket_client_id']); // Don't Enforce Client Access if Ticket doesn't have an assigned client @@ -996,8 +996,8 @@ if (isset($_POST['bulk_assign_ticket'])) { $agent_details_sql = mysqli_query($mysqli, "SELECT user_name, user_email FROM users LEFT JOIN user_settings ON users.user_id = user_settings.user_id WHERE users.user_id = $assign_to"); $agent_details = mysqli_fetch_assoc($agent_details_sql); - $agent_name = sanitizeInput($agent_details['user_name']); - $agent_email = sanitizeInput($agent_details['user_email']); + $agent_name = escapeSql($agent_details['user_name']); + $agent_email = escapeSql($agent_details['user_email']); $ticket_reply = "Ticket re-assigned to $agent_name."; if (!$agent_name) { @@ -1028,9 +1028,9 @@ if (isset($_POST['bulk_assign_ticket'])) { if (!empty($config_smtp_provider)) { // Sanitize Config vars from get_settings.php - $config_ticket_from_name = sanitizeInput($config_ticket_from_name); - $config_ticket_from_email = sanitizeInput($config_ticket_from_email); - $company_name = sanitizeInput($session_company_name); + $config_ticket_from_name = escapeSql($config_ticket_from_name); + $config_ticket_from_email = escapeSql($config_ticket_from_email); + $company_name = escapeSql($session_company_name); $subject = "$config_app_name - $ticket_count tickets have been assigned to you"; $body = "Hi $agent_name,

$session_name assigned $ticket_count tickets to you!

$tickets_assigned_body
Thanks,
$session_name
$company_name"; @@ -1065,7 +1065,7 @@ if (isset($_POST['bulk_edit_ticket_priority'])) { enforceUserPermission('module_support', 2); // POST variables - $priority = sanitizeInput($_POST['bulk_priority']); + $priority = escapeSql($_POST['bulk_priority']); // Assign Tech to Selected Tickets if (isset($_POST['ticket_ids'])) { @@ -1079,10 +1079,10 @@ if (isset($_POST['bulk_edit_ticket_priority'])) { $sql = mysqli_query($mysqli, "SELECT * FROM tickets WHERE ticket_id = $ticket_id"); $row = mysqli_fetch_assoc($sql); - $ticket_prefix = sanitizeInput($row['ticket_prefix']); + $ticket_prefix = escapeSql($row['ticket_prefix']); $ticket_number = intval($row['ticket_number']); - $ticket_subject = sanitizeInput($row['ticket_subject']); - $original_ticket_priority = sanitizeInput($row['ticket_priority']); + $ticket_subject = escapeSql($row['ticket_subject']); + $original_ticket_priority = escapeSql($row['ticket_priority']); $client_id = intval($row['ticket_client_id']); // Don't Enforce Client Access if Ticket doesn't have an assigned client @@ -1130,10 +1130,10 @@ if (isset($_POST['bulk_edit_ticket_category'])) { $sql = mysqli_query($mysqli, "SELECT ticket_prefix, ticket_number, ticket_subject, category_name, ticket_client_id FROM tickets LEFT JOIN categories ON ticket_category = category_id WHERE ticket_id = $ticket_id"); $row = mysqli_fetch_assoc($sql); - $ticket_prefix = sanitizeInput($row['ticket_prefix']); + $ticket_prefix = escapeSql($row['ticket_prefix']); $ticket_number = intval($row['ticket_number']); - $ticket_subject = sanitizeInput($row['ticket_subject']); - $previous_ticket_category_name = sanitizeInput($row['category_name']); + $ticket_subject = escapeSql($row['ticket_subject']); + $previous_ticket_category_name = escapeSql($row['category_name']); $client_id = intval($row['ticket_client_id']); // Don't Enforce Client Access if Ticket doesn't have an assigned client @@ -1142,7 +1142,7 @@ if (isset($_POST['bulk_edit_ticket_category'])) { } // Get Category Name - $category_name = sanitizeInput(getFieldById('categories', $category_id, 'category_name')); + $category_name = escapeSql(getFieldById('categories', $category_id, 'category_name')); // Update ticket mysqli_query($mysqli, "UPDATE tickets SET ticket_category = '$category_id' WHERE ticket_id = $ticket_id"); @@ -1168,7 +1168,7 @@ if (isset($_POST['bulk_merge_tickets'])) { enforceUserPermission('module_support', 2); $merge_into_ticket_id = intval($_POST['merge_into_ticket_id']); // Parent ticket id - $merge_comment = sanitizeInput($_POST['merge_comment']); // Merge comment + $merge_comment = escapeSql($_POST['merge_comment']); // Merge comment $ticket_reply_type = 'Internal'; // Default all replies to internal // NEW PARENT ticket details @@ -1194,12 +1194,12 @@ if (isset($_POST['bulk_merge_tickets'])) { $sql = mysqli_query($mysqli, "SELECT * FROM tickets WHERE ticket_id = $ticket_id"); $row = mysqli_fetch_assoc($sql); - $ticket_prefix = sanitizeInput($row['ticket_prefix']); + $ticket_prefix = escapeSql($row['ticket_prefix']); $ticket_number = intval($row['ticket_number']); - $ticket_subject = sanitizeInput($row['ticket_subject']); + $ticket_subject = escapeSql($row['ticket_subject']); $ticket_details = mysqli_escape_string($mysqli, $row['ticket_details']); - $current_ticket_priority = sanitizeInput($row['ticket_priority']); - $ticket_first_response_at = sanitizeInput($row['ticket_first_response_at']); + $current_ticket_priority = escapeSql($row['ticket_priority']); + $ticket_first_response_at = escapeSql($row['ticket_first_response_at']); $client_id = intval($row['ticket_client_id']); // Don't Enforce Client Access if Ticket doesn't have an assigned client @@ -1243,7 +1243,7 @@ if (isset($_POST['bulk_resolve_tickets'])) { // POST variables $details = mysqli_escape_string($mysqli, $_POST['bulk_details']); - $ticket_reply_time_worked = sanitizeInput($_POST['time']); + $ticket_reply_time_worked = escapeSql($_POST['time']); $private_note = intval($_POST['bulk_private_note']); if ($private_note == 1) { $ticket_reply_type = 'Internal'; @@ -1272,12 +1272,12 @@ if (isset($_POST['bulk_resolve_tickets'])) { $sql = mysqli_query($mysqli, "SELECT * FROM tickets WHERE ticket_id = $ticket_id"); $row = mysqli_fetch_assoc($sql); - $ticket_prefix = sanitizeInput($row['ticket_prefix']); + $ticket_prefix = escapeSql($row['ticket_prefix']); $ticket_number = intval($row['ticket_number']); - $ticket_subject = sanitizeInput($row['ticket_subject']); - $current_ticket_priority = sanitizeInput($row['ticket_priority']); - $url_key = sanitizeInput($row['ticket_url_key']); - $ticket_first_response_at = sanitizeInput($row['ticket_first_response_at']); + $ticket_subject = escapeSql($row['ticket_subject']); + $current_ticket_priority = escapeSql($row['ticket_priority']); + $url_key = escapeSql($row['ticket_url_key']); + $ticket_first_response_at = escapeSql($row['ticket_first_response_at']); $client_id = intval($row['ticket_client_id']); // Don't Enforce Client Access if Ticket doesn't have an assigned client @@ -1309,19 +1309,19 @@ if (isset($_POST['bulk_resolve_tickets'])) { "); $row = mysqli_fetch_assoc($ticket_sql); - $contact_name = sanitizeInput($row['contact_name']); - $contact_email = sanitizeInput($row['contact_email']); + $contact_name = escapeSql($row['contact_name']); + $contact_email = escapeSql($row['contact_email']); // Sanitize Config vars from get_settings.php - $from_name = sanitizeInput($config_ticket_from_name); - $from_email = sanitizeInput($config_ticket_from_email); - $base_url = sanitizeInput($config_base_url); + $from_name = escapeSql($config_ticket_from_name); + $from_email = escapeSql($config_ticket_from_email); + $base_url = escapeSql($config_base_url); // Get Company Info $sql = mysqli_query($mysqli, "SELECT company_name, company_phone, company_phone_country_code FROM companies WHERE company_id = 1"); $row = mysqli_fetch_assoc($sql); - $company_name = sanitizeInput($row['company_name']); - $company_phone = sanitizeInput(formatPhoneNumber($row['company_phone'], $row['company_phone_country_code'])); + $company_name = escapeSql($row['company_name']); + $company_phone = escapeSql(formatPhoneNumber($row['company_phone'], $row['company_phone_country_code'])); // EMAIL $subject = "Ticket resolved - [$ticket_prefix$ticket_number] - $ticket_subject | (pending closure)"; @@ -1349,7 +1349,7 @@ if (isset($_POST['bulk_resolve_tickets'])) { $sql_watchers = mysqli_query($mysqli, "SELECT watcher_email FROM ticket_watchers WHERE watcher_ticket_id = $ticket_id"); $body .= "

----------------------------------------
YOU ARE A COLLABORATOR ON THIS TICKET"; while ($row = mysqli_fetch_assoc($sql_watchers)) { - $watcher_email = sanitizeInput($row['watcher_email']); + $watcher_email = escapeSql($row['watcher_email']); // Queue Mail $data[] = [ @@ -1388,7 +1388,7 @@ if (isset($_POST['bulk_ticket_reply'])) { // POST variables $ticket_reply = mysqli_escape_string($mysqli, $_POST['bulk_reply_details']); $ticket_status = intval($_POST['bulk_status']); - $ticket_reply_time_worked = sanitizeInput($_POST['time']); + $ticket_reply_time_worked = escapeSql($_POST['time']); $private_note = intval($_POST['bulk_private_reply']); if ($private_note == 1) { $ticket_reply_type = 'Internal'; @@ -1408,12 +1408,12 @@ if (isset($_POST['bulk_ticket_reply'])) { $sql = mysqli_query($mysqli, "SELECT * FROM tickets WHERE ticket_id = $ticket_id"); $row = mysqli_fetch_assoc($sql); - $ticket_prefix = sanitizeInput($row['ticket_prefix']); + $ticket_prefix = escapeSql($row['ticket_prefix']); $ticket_number = intval($row['ticket_number']); - $ticket_subject = sanitizeInput($row['ticket_subject']); - $current_ticket_priority = sanitizeInput($row['ticket_priority']); - $url_key = sanitizeInput($row['ticket_url_key']); - $ticket_first_response_at = sanitizeInput($row['ticket_first_response_at']); + $ticket_subject = escapeSql($row['ticket_subject']); + $current_ticket_priority = escapeSql($row['ticket_priority']); + $url_key = escapeSql($row['ticket_url_key']); + $ticket_first_response_at = escapeSql($row['ticket_first_response_at']); $client_id = intval($row['ticket_client_id']); // Don't Enforce Client Access if Ticket doesn't have an assigned client @@ -1470,20 +1470,20 @@ if (isset($_POST['bulk_ticket_reply'])) { $row = mysqli_fetch_assoc($sql); - $contact_name = sanitizeInput($row['contact_name']); - $contact_email = sanitizeInput($row['contact_email']); + $contact_name = escapeSql($row['contact_name']); + $contact_email = escapeSql($row['contact_email']); $ticket_created_by = intval($row['ticket_created_by']); $ticket_assigned_to = intval($row['ticket_assigned_to']); // Sanitize Config vars from get_settings.php - $from_name = sanitizeInput($config_ticket_from_name); - $from_email = sanitizeInput($config_ticket_from_email); - $base_url = sanitizeInput($config_base_url); + $from_name = escapeSql($config_ticket_from_name); + $from_email = escapeSql($config_ticket_from_email); + $base_url = escapeSql($config_base_url); $sql = mysqli_query($mysqli, "SELECT company_name, company_phone, company_phone_country_code FROM companies WHERE company_id = 1"); $row = mysqli_fetch_assoc($sql); - $company_name = sanitizeInput($row['company_name']); - $company_phone = sanitizeInput(formatPhoneNumber($row['company_phone'], $row['company_phone_country_code'])); + $company_name = escapeSql($row['company_name']); + $company_phone = escapeSql(formatPhoneNumber($row['company_phone'], $row['company_phone_country_code'])); // Send e-mail to client if public update & email is set up if ($private_note == 0 && (!empty($config_smtp_provider))) { @@ -1512,7 +1512,7 @@ if (isset($_POST['bulk_ticket_reply'])) { $sql_watchers = mysqli_query($mysqli, "SELECT watcher_email FROM ticket_watchers WHERE watcher_ticket_id = $ticket_id"); $body .= "

----------------------------------------
YOU ARE A COLLABORATOR ON THIS TICKET"; while ($row = mysqli_fetch_assoc($sql_watchers)) { - $watcher_email = sanitizeInput($row['watcher_email']); + $watcher_email = escapeSql($row['watcher_email']); // Queue Mail $data[] = [ @@ -1562,7 +1562,7 @@ if (isset($_POST['bulk_add_ticket_project'])) { // Get Project Name $sql = mysqli_query($mysqli, "SELECT project_name FROM projects WHERE project_id = $project_id"); $row = mysqli_fetch_assoc($sql); - $project_name = sanitizeInput($row['project_name']); + $project_name = escapeSql($row['project_name']); // Assign Project to Selected Tickets if (isset($_POST['ticket_ids'])) { @@ -1576,10 +1576,10 @@ if (isset($_POST['bulk_add_ticket_project'])) { $sql = mysqli_query($mysqli, "SELECT * FROM tickets WHERE ticket_id = $ticket_id"); $row = mysqli_fetch_assoc($sql); - $ticket_prefix = sanitizeInput($row['ticket_prefix']); + $ticket_prefix = escapeSql($row['ticket_prefix']); $ticket_number = intval($row['ticket_number']); - $ticket_subject = sanitizeInput($row['ticket_subject']); - $current_ticket_priority = sanitizeInput($row['ticket_priority']); + $ticket_subject = escapeSql($row['ticket_subject']); + $current_ticket_priority = escapeSql($row['ticket_priority']); $client_id = intval($row['ticket_client_id']); // Don't Enforce Client Access if Ticket doesn't have an assigned client @@ -1615,8 +1615,8 @@ if (isset($_POST['bulk_add_asset_ticket'])) { } else { $ticket_status = 2; } - $subject = sanitizeInput($_POST['bulk_subject']); - $priority = sanitizeInput($_POST['bulk_priority']); + $subject = escapeSql($_POST['bulk_subject']); + $priority = escapeSql($_POST['bulk_priority']); $category_id = intval($_POST['bulk_category']); $details = mysqli_real_escape_string($mysqli, $_POST['bulk_details']); $project_id = intval($_POST['bulk_project']); @@ -1631,7 +1631,7 @@ if (isset($_POST['bulk_add_asset_ticket'])) { // Override Template Subject if(empty($subject)) { - $subject = sanitizeInput($row['ticket_template_subject']); + $subject = escapeSql($row['ticket_template_subject']); } $details = mysqli_escape_string($mysqli, $row['ticket_template_details']); @@ -1652,7 +1652,7 @@ if (isset($_POST['bulk_add_asset_ticket'])) { $sql = mysqli_query($mysqli, "SELECT * FROM assets WHERE asset_id = $asset_id"); $row = mysqli_fetch_assoc($sql); - $asset_name = sanitizeInput($row['asset_name']); + $asset_name = escapeSql($row['asset_name']); $client_id = intval($row['asset_client_id']); // Don't Enforce Client Access if Ticket doesn't have an assigned client @@ -1674,10 +1674,10 @@ if (isset($_POST['bulk_add_asset_ticket'])) { $ticket_number = mysqli_insert_id($mysqli); // Sanitize Config Vars from get_settings.php and Session Vars from check_login.php - $config_ticket_prefix = sanitizeInput($config_ticket_prefix); - $config_ticket_from_name = sanitizeInput($config_ticket_from_name); - $config_ticket_from_email = sanitizeInput($config_ticket_from_email); - $config_base_url = sanitizeInput($config_base_url); + $config_ticket_prefix = escapeSql($config_ticket_prefix); + $config_ticket_from_name = escapeSql($config_ticket_from_name); + $config_ticket_from_email = escapeSql($config_ticket_from_email); + $config_base_url = escapeSql($config_base_url); //Generate a unique URL key for clients to access $url_key = randomString(32); @@ -1689,7 +1689,7 @@ if (isset($_POST['bulk_add_asset_ticket'])) { // Add Tasks if (!empty($_POST['tasks'])) { foreach ($_POST['tasks'] as $task) { - $task_name = sanitizeInput($task); + $task_name = escapeSql($task); // Check that task_name is not-empty (For some reason the !empty on the array doesnt work here like in watchers) if (!empty($task_name)) { mysqli_query($mysqli,"INSERT INTO tasks SET task_name = '$task_name', task_ticket_id = $ticket_id"); @@ -1702,7 +1702,7 @@ if (isset($_POST['bulk_add_asset_ticket'])) { if (mysqli_num_rows($sql_task_templates) > 0) { while ($row = mysqli_fetch_assoc($sql_task_templates)) { $task_order = intval($row['task_template_order']); - $task_name = sanitizeInput($row['task_template_name']); + $task_name = escapeSql($row['task_template_name']); mysqli_query($mysqli,"INSERT INTO tasks SET task_name = '$task_name', task_order = $task_order, task_ticket_id = $ticket_id"); } @@ -1743,7 +1743,7 @@ if (isset($_POST['add_ticket_reply'])) { $hours = intval($_POST['hours']); $minutes = intval($_POST['minutes']); $seconds = intval($_POST['seconds']); - $ticket_reply_time_worked = sanitizeInput(sprintf("%02d:%02d:%02d", $hours, $minutes, $seconds)); + $ticket_reply_time_worked = escapeSql(sprintf("%02d:%02d:%02d", $hours, $minutes, $seconds)); // Defaults $send_email = 0; @@ -1792,15 +1792,15 @@ if (isset($_POST['add_ticket_reply'])) { $row = mysqli_fetch_assoc($ticket_sql); - $contact_name = sanitizeInput($row['contact_name']); - $contact_email = sanitizeInput($row['contact_email']); - $ticket_prefix = sanitizeInput($row['ticket_prefix']); + $contact_name = escapeSql($row['contact_name']); + $contact_email = escapeSql($row['contact_email']); + $ticket_prefix = escapeSql($row['ticket_prefix']); $ticket_number = intval($row['ticket_number']); - $ticket_subject = sanitizeInput($row['ticket_subject']); + $ticket_subject = escapeSql($row['ticket_subject']); $ticket_status = intval($row['ticket_status']); - $ticket_status_name = sanitizeInput($row['ticket_status_name']); - $url_key = sanitizeInput($row['ticket_url_key']); - $ticket_first_response_at = sanitizeInput($row['ticket_first_response_at']); + $ticket_status_name = escapeSql($row['ticket_status_name']); + $url_key = escapeSql($row['ticket_url_key']); + $ticket_first_response_at = escapeSql($row['ticket_first_response_at']); $ticket_created_by = intval($row['ticket_created_by']); $ticket_assigned_to = intval($row['ticket_assigned_to']); $client_id = intval($row['ticket_client_id']); @@ -1812,14 +1812,14 @@ if (isset($_POST['add_ticket_reply'])) { } // Sanitize Config vars from get_settings.php - $config_ticket_from_name = sanitizeInput($config_ticket_from_name); - $config_ticket_from_email = sanitizeInput($config_ticket_from_email); - $config_base_url = sanitizeInput($config_base_url); + $config_ticket_from_name = escapeSql($config_ticket_from_name); + $config_ticket_from_email = escapeSql($config_ticket_from_email); + $config_base_url = escapeSql($config_base_url); $sql = mysqli_query($mysqli, "SELECT company_name, company_phone, company_phone_country_code FROM companies WHERE company_id = 1"); $row = mysqli_fetch_assoc($sql); - $company_name = sanitizeInput($row['company_name']); - $company_phone = sanitizeInput(formatPhoneNumber($row['company_phone'], $row['company_phone_country_code'])); + $company_name = escapeSql($row['company_name']); + $company_phone = escapeSql(formatPhoneNumber($row['company_phone'], $row['company_phone_country_code'])); // Send e-mail to client if public update & email is set up if ($ticket_reply_type == 'Public' && $send_email == 1 && (!empty($config_smtp_provider))) { @@ -1856,7 +1856,7 @@ if (isset($_POST['add_ticket_reply'])) { $sql_watchers = mysqli_query($mysqli, "SELECT watcher_email FROM ticket_watchers WHERE watcher_ticket_id = $ticket_id"); $body .= "

----------------------------------------
YOU ARE A COLLABORATOR ON THIS TICKET"; while ($row = mysqli_fetch_assoc($sql_watchers)) { - $watcher_email = sanitizeInput($row['watcher_email']); + $watcher_email = escapeSql($row['watcher_email']); // Queue Mail $data[] = [ @@ -1915,8 +1915,8 @@ if (isset($_POST['edit_ticket_reply'])) { $ticket_reply_id = intval($_POST['ticket_reply_id']); $ticket_reply = mysqli_real_escape_string($mysqli, $_POST['ticket_reply']); - $ticket_reply_type = sanitizeInput($_POST['ticket_reply_type']); - $ticket_reply_time_worked = sanitizeInput($_POST['time']); + $ticket_reply_type = escapeSql($_POST['ticket_reply_type']); + $ticket_reply_time_worked = escapeSql($_POST['time']); $client_id = intval($_POST['client_id']); @@ -1995,7 +1995,7 @@ if (isset($_POST['merge_ticket'])) { $ticket_id = intval($_POST['ticket_id']); // Child ticket ID to be closed $merge_into_ticket_id = intval($_POST['merge_into_ticket_id']); // Parent ticket id - $merge_comment = sanitizeInput($_POST['merge_comment']); // Merge comment + $merge_comment = escapeSql($_POST['merge_comment']); // Merge comment $move_replies = intval($_POST['merge_move_replies']); // Whether to move replies to the new parent ticket $ticket_reply_type = 'Internal'; // Default all replies to internal @@ -2007,11 +2007,11 @@ if (isset($_POST['merge_ticket'])) { } // CURRENT ticket details $row = mysqli_fetch_assoc($sql); - $ticket_prefix = sanitizeInput($row['ticket_prefix']); + $ticket_prefix = escapeSql($row['ticket_prefix']); $ticket_number = intval($row['ticket_number']); - $ticket_subject = sanitizeInput($row['ticket_subject']); + $ticket_subject = escapeSql($row['ticket_subject']); $ticket_details = mysqli_escape_string($mysqli, $row['ticket_details']); - $ticket_first_response_at = sanitizeInput($row['ticket_first_response_at']); + $ticket_first_response_at = escapeSql($row['ticket_first_response_at']); // NEW PARENT ticket details // Get merge into ticket id (as it may differ from the number) @@ -2108,9 +2108,9 @@ if (isset($_GET['resolve_ticket'])) { $sql = mysqli_query($mysqli, "SELECT * FROM tickets WHERE ticket_id = $ticket_id"); $row = mysqli_fetch_assoc($sql); - $ticket_prefix = sanitizeInput($row['ticket_prefix']); + $ticket_prefix = escapeSql($row['ticket_prefix']); $ticket_number = intval($row['ticket_number']); - $ticket_first_response_at = sanitizeInput($row['ticket_first_response_at']); + $ticket_first_response_at = escapeSql($row['ticket_first_response_at']); $client_id = intval($row['ticket_client_id']); // Don't Enforce Client Access if Ticket doesn't have an assigned client @@ -2142,25 +2142,25 @@ if (isset($_GET['resolve_ticket'])) { "); $row = mysqli_fetch_assoc($ticket_sql); - $contact_name = sanitizeInput($row['contact_name']); - $contact_email = sanitizeInput($row['contact_email']); - $ticket_prefix = sanitizeInput($row['ticket_prefix']); + $contact_name = escapeSql($row['contact_name']); + $contact_email = escapeSql($row['contact_email']); + $ticket_prefix = escapeSql($row['ticket_prefix']); $ticket_number = intval($row['ticket_number']); - $ticket_subject = sanitizeInput($row['ticket_subject']); + $ticket_subject = escapeSql($row['ticket_subject']); $ticket_assigned_to = intval($row['ticket_assigned_to']); - $ticket_status = sanitizeInput($row['ticket_status_name']); - $url_key = sanitizeInput($row['ticket_url_key']); + $ticket_status = escapeSql($row['ticket_status_name']); + $url_key = escapeSql($row['ticket_url_key']); // Sanitize Config vars from get_settings.php - $config_ticket_from_name = sanitizeInput($config_ticket_from_name); - $config_ticket_from_email = sanitizeInput($config_ticket_from_email); - $config_base_url = sanitizeInput($config_base_url); + $config_ticket_from_name = escapeSql($config_ticket_from_name); + $config_ticket_from_email = escapeSql($config_ticket_from_email); + $config_base_url = escapeSql($config_base_url); // Get Company Info $sql = mysqli_query($mysqli, "SELECT company_name, company_phone, company_phone_country_code FROM companies WHERE company_id = 1"); $row = mysqli_fetch_assoc($sql); - $company_name = sanitizeInput($row['company_name']); - $company_phone = sanitizeInput(formatPhoneNumber($row['company_phone'], $row['company_phone_country_code'])); + $company_name = escapeSql($row['company_name']); + $company_phone = escapeSql(formatPhoneNumber($row['company_phone'], $row['company_phone_country_code'])); // EMAIL $subject = "Ticket resolved - [$ticket_prefix$ticket_number] - $ticket_subject | (pending closure)"; @@ -2188,7 +2188,7 @@ if (isset($_GET['resolve_ticket'])) { $sql_watchers = mysqli_query($mysqli, "SELECT watcher_email FROM ticket_watchers WHERE watcher_ticket_id = $ticket_id"); $body .= "

----------------------------------------
YOU ARE A COLLABORATOR ON THIS TICKET"; while ($row = mysqli_fetch_assoc($sql_watchers)) { - $watcher_email = sanitizeInput($row['watcher_email']); + $watcher_email = escapeSql($row['watcher_email']); // Queue Mail $data[] = [ @@ -2243,23 +2243,23 @@ if (isset($_GET['close_ticket'])) { "); $row = mysqli_fetch_assoc($ticket_sql); - $contact_name = sanitizeInput($row['contact_name']); - $contact_email = sanitizeInput($row['contact_email']); - $ticket_prefix = sanitizeInput($row['ticket_prefix']); + $contact_name = escapeSql($row['contact_name']); + $contact_email = escapeSql($row['contact_email']); + $ticket_prefix = escapeSql($row['ticket_prefix']); $ticket_number = intval($row['ticket_number']); - $ticket_subject = sanitizeInput($row['ticket_subject']); - $url_key = sanitizeInput($row['ticket_url_key']); + $ticket_subject = escapeSql($row['ticket_subject']); + $url_key = escapeSql($row['ticket_url_key']); // Sanitize Config vars from get_settings.php - $config_ticket_from_name = sanitizeInput($config_ticket_from_name); - $config_ticket_from_email = sanitizeInput($config_ticket_from_email); - $config_base_url = sanitizeInput($config_base_url); + $config_ticket_from_name = escapeSql($config_ticket_from_name); + $config_ticket_from_email = escapeSql($config_ticket_from_email); + $config_base_url = escapeSql($config_base_url); // Get Company Info $sql = mysqli_query($mysqli, "SELECT company_name, company_phone, company_phone_country_code FROM companies WHERE company_id = 1"); $row = mysqli_fetch_assoc($sql); - $company_name = sanitizeInput($row['company_name']); - $company_phone = sanitizeInput(formatPhoneNumber($row['company_phone'], $row['company_phone_country_code'])); + $company_name = escapeSql($row['company_name']); + $company_phone = escapeSql(formatPhoneNumber($row['company_phone'], $row['company_phone_country_code'])); // EMAIL $subject = "Ticket closed - [$ticket_prefix$ticket_number] - $ticket_subject | (do not reply)"; @@ -2287,7 +2287,7 @@ if (isset($_GET['close_ticket'])) { $sql_watchers = mysqli_query($mysqli, "SELECT watcher_email FROM ticket_watchers WHERE watcher_ticket_id = $ticket_id"); $body .= "

----------------------------------------
YOU ARE A COLLABORATOR ON THIS TICKET"; while ($row = mysqli_fetch_assoc($sql_watchers)) { - $watcher_email = sanitizeInput($row['watcher_email']); + $watcher_email = escapeSql($row['watcher_email']); // Queue Mail $data[] = [ @@ -2345,9 +2345,9 @@ if (isset($_POST['add_invoice_from_ticket'])) { $invoice_id = intval($_POST['invoice_id']); $ticket_id = intval($_POST['ticket_id']); - $date = sanitizeInput($_POST['date']); + $date = escapeSql($_POST['date']); $category = intval($_POST['category']); - $scope = sanitizeInput($_POST['scope']); + $scope = escapeSql($_POST['scope']); $sql = mysqli_query( $mysqli, @@ -2366,27 +2366,27 @@ if (isset($_POST['add_invoice_from_ticket'])) { $client_net_terms = $config_default_net_terms; } - $ticket_prefix = sanitizeInput($row['ticket_prefix']); + $ticket_prefix = escapeSql($row['ticket_prefix']); $ticket_number = intval($row['ticket_number']); - $ticket_category = sanitizeInput($row['ticket_category']); - $ticket_subject = sanitizeInput($row['ticket_subject']); - $ticket_created_at = sanitizeInput($row['ticket_created_at']); - $ticket_updated_at = sanitizeInput($row['ticket_updated_at']); - $ticket_closed_at = sanitizeInput($row['ticket_closed_at']); + $ticket_category = escapeSql($row['ticket_category']); + $ticket_subject = escapeSql($row['ticket_subject']); + $ticket_created_at = escapeSql($row['ticket_created_at']); + $ticket_updated_at = escapeSql($row['ticket_updated_at']); + $ticket_closed_at = escapeSql($row['ticket_closed_at']); $contact_id = intval($row['contact_id']); - $contact_name = sanitizeInput($row['contact_name']); - $contact_email = sanitizeInput($row['contact_email']); + $contact_name = escapeSql($row['contact_name']); + $contact_email = escapeSql($row['contact_email']); $asset_id = intval($row['asset_id']); - $location_name = sanitizeInput($row['location_name']); + $location_name = escapeSql($row['location_name']); enforceClientAccess(); if ($invoice_id == 0) { - $invoice_prefix = sanitizeInput($config_invoice_prefix); + $invoice_prefix = escapeSql($config_invoice_prefix); // Atomically increment and get the new invoice number mysqli_query($mysqli, " @@ -2407,13 +2407,13 @@ if (isset($_POST['add_invoice_from_ticket'])) { } else { $sql_invoice = mysqli_query($mysqli, "SELECT invoice_prefix, invoice_number FROM invoices WHERE invoice_id = $invoice_id"); $row = mysqli_fetch_assoc($sql_invoice); - $invoice_prefix = sanitizeInput($row['invoice_prefix']); + $invoice_prefix = escapeSql($row['invoice_prefix']); $invoice_number = intval($row['invoice_number']); } //Add Item - $item_name = sanitizeInput($_POST['item_name']); - $item_description = sanitizeInput($_POST['item_description']); + $item_name = escapeSql($_POST['item_name']); + $item_description = escapeSql($_POST['item_description']); $qty = floatval($_POST['qty']); $price = floatval($_POST['price']); $tax_id = intval($_POST['tax_id']); @@ -2467,8 +2467,8 @@ if (isset($_POST['add_quote_from_ticket'])) { require_once 'quote_model.php'; $ticket_id = intval($_POST['ticket_id']); - $item_name = sanitizeInput($_POST['item_name']); - $item_description = sanitizeInput($_POST['item_description']); + $item_name = escapeSql($_POST['item_name']); + $item_description = escapeSql($_POST['item_description']); $qty = floatval($_POST['qty']); $price = floatval($_POST['price']); $tax_id = intval($_POST['tax_id']); @@ -2490,7 +2490,7 @@ if (isset($_POST['add_quote_from_ticket'])) { "SELECT ticket_prefix, ticket_number, ticket_client_id FROM tickets WHERE ticket_id = $ticket_id LIMIT 1" ); $row = mysqli_fetch_assoc($sql); - $ticket_prefix = sanitizeInput($row['ticket_prefix']); + $ticket_prefix = escapeSql($row['ticket_prefix']); $ticket_number = intval($row['ticket_number']); $client_id = intval($row['ticket_client_id']); @@ -2605,7 +2605,7 @@ if (isset($_POST['edit_ticket_billable_status'])) { // Get ticket details for logging $sql = mysqli_query($mysqli, "SELECT ticket_prefix, ticket_number, ticket_client_id FROM tickets WHERE ticket_id = $ticket_id"); $row = mysqli_fetch_assoc($sql); - $ticket_prefix = sanitizeInput($row['ticket_prefix']); + $ticket_prefix = escapeSql($row['ticket_prefix']); $ticket_number = intval($row['ticket_number']); $client_id = intval($row['ticket_client_id']); @@ -2632,7 +2632,7 @@ if (isset($_POST['edit_ticket_schedule'])) { $ticket_id = intval($_POST['ticket_id']); $onsite = intval($_POST['onsite']); - $schedule = sanitizeInput($_POST['scheduled_date_time']); + $schedule = escapeSql($_POST['scheduled_date_time']); $ticket_link = "client/ticket.php?id=$ticket_id"; $full_ticket_url = "https://$config_base_url/client/ticket.php?id=$ticket_id"; $ticket_link_html = "$ticket_link"; @@ -2669,19 +2669,19 @@ if (isset($_POST['edit_ticket_schedule'])) { $row = mysqli_fetch_assoc($sql); - $client_name = sanitizeInput($row['client_name']); - $ticket_details = sanitizeInput($row['ticket_details']); - $contact_name = sanitizeInput($row['contact_name']); - $contact_email = sanitizeInput($row['contact_email']); - $ticket_prefix = sanitizeInput($row['ticket_prefix']); + $client_name = escapeSql($row['client_name']); + $ticket_details = escapeSql($row['ticket_details']); + $contact_name = escapeSql($row['contact_name']); + $contact_email = escapeSql($row['contact_email']); + $ticket_prefix = escapeSql($row['ticket_prefix']); $ticket_number = intval($row['ticket_number']); - $ticket_subject = sanitizeInput($row['ticket_subject']); - $user_name = sanitizeInput($row['user_name']); - $user_email = sanitizeInput($row['user_email']); + $ticket_subject = escapeSql($row['ticket_subject']); + $user_name = escapeSql($row['user_name']); + $user_email = escapeSql($row['user_email']); $cal_subject = $ticket_number . ": " . $client_name . " - " . $ticket_subject; $ticket_details_truncated = substr($ticket_details, 0, 100); $cal_description = $ticket_details_truncated . " - " . $full_ticket_url; - $cal_location = sanitizeInput($row["location_address"]); + $cal_location = escapeSql($row["location_address"]); $email_datetime = date('l, F j, Y \a\t g:ia', strtotime($schedule)); if ($client_id) { @@ -2691,9 +2691,9 @@ if (isset($_POST['edit_ticket_schedule'])) { } // Sanitize Config Vars - $config_ticket_from_email = sanitizeInput($config_ticket_from_email); - $config_ticket_from_name = sanitizeInput($config_ticket_from_name); - $session_company_name = sanitizeInput($session_company_name); + $config_ticket_from_email = escapeSql($config_ticket_from_email); + $config_ticket_from_name = escapeSql($config_ticket_from_name); + $session_company_name = escapeSql($session_company_name); /// Create iCal event @@ -2746,7 +2746,7 @@ if (isset($_POST['edit_ticket_schedule'])) { $sql_watchers = mysqli_query($mysqli, "SELECT watcher_email FROM ticket_watchers WHERE watcher_ticket_id = $ticket_id"); while ($row = mysqli_fetch_assoc($sql_watchers)) { - $watcher_email = sanitizeInput($row['watcher_email']); + $watcher_email = escapeSql($row['watcher_email']); $data[] = [ 'from' => $config_ticket_from_email, 'from_name' => $config_ticket_from_name, @@ -2814,11 +2814,11 @@ if (isset($_GET['cancel_ticket_schedule'])) { $row = mysqli_fetch_assoc($sql); $client_id = intval($row['ticket_client_id']); - $ticket_prefix = sanitizeInput($row['ticket_prefix']); + $ticket_prefix = escapeSql($row['ticket_prefix']); $ticket_number = intval($row['ticket_number']); - $ticket_subject = sanitizeInput($row['ticket_subject']); - $ticket_schedule = sanitizeInput($row['ticket_schedule']); - $ticket_cal_str = sanitizeInput($row['ticket_cal_str']); + $ticket_subject = escapeSql($row['ticket_subject']); + $ticket_schedule = escapeSql($row['ticket_schedule']); + $ticket_cal_str = escapeSql($row['ticket_cal_str']); // Don't Enforce Client Access if Ticket doesn't have an assigned client if ($client_id) { @@ -2834,9 +2834,9 @@ if (isset($_GET['cancel_ticket_schedule'])) { mysqli_query($mysqli, "UPDATE tickets SET ticket_schedule = NULL WHERE ticket_id = $ticket_id"); // Sanitize Config Vars - $config_ticket_from_email = sanitizeInput($config_ticket_from_email); - $config_ticket_from_name = sanitizeInput($config_ticket_from_name); - $session_company_name = sanitizeInput($session_company_name); + $config_ticket_from_email = escapeSql($config_ticket_from_email); + $config_ticket_from_name = escapeSql($config_ticket_from_name); + $session_company_name = escapeSql($session_company_name); //Create iCal event $cal_str = createiCalStrCancel($ticket_cal_str); @@ -2853,15 +2853,15 @@ if (isset($_GET['cancel_ticket_schedule'])) { $row = mysqli_fetch_assoc($sql); $client_id = intval($row['ticket_client_id']); - $client_name = sanitizeInput($row['client_name']); - $ticket_details = sanitizeInput($row['ticket_details']); - $contact_name = sanitizeInput($row['contact_name']); - $contact_email = sanitizeInput($row['contact_email']); - $ticket_prefix = sanitizeInput($row['ticket_prefix']); + $client_name = escapeSql($row['client_name']); + $ticket_details = escapeSql($row['ticket_details']); + $contact_name = escapeSql($row['contact_name']); + $contact_email = escapeSql($row['contact_email']); + $ticket_prefix = escapeSql($row['ticket_prefix']); $ticket_number = intval($row['ticket_number']); - $ticket_subject = sanitizeInput($row['ticket_subject']); - $user_name = sanitizeInput($row['user_name']); - $user_email = sanitizeInput($row['user_email']); + $ticket_subject = escapeSql($row['ticket_subject']); + $user_name = escapeSql($row['user_name']); + $user_email = escapeSql($row['user_email']); // Notify the agent of the cancellation $data[] = [ @@ -2910,7 +2910,7 @@ if (isset($_GET['cancel_ticket_schedule'])) { // Notify the watchers of the cancellation $sql_watchers = mysqli_query($mysqli, "SELECT watcher_email FROM ticket_watchers WHERE watcher_ticket_id = $ticket_id"); while ($row = mysqli_fetch_assoc($sql_watchers)) { - $watcher_email = sanitizeInput($row['watcher_email']); + $watcher_email = escapeSql($row['watcher_email']); $data[] = [ 'from' => $config_ticket_from_email, 'from_name' => $config_ticket_from_name, diff --git a/agent/post/transfer.php b/agent/post/transfer.php index 170f7e00..fd7a6ee0 100644 --- a/agent/post/transfer.php +++ b/agent/post/transfer.php @@ -17,13 +17,13 @@ if (isset($_POST['add_transfer'])) { // Get Source Account Name for logging $sql = mysqli_query($mysqli,"SELECT account_name, account_currency_code FROM accounts WHERE account_id = $account_from"); $row = mysqli_fetch_assoc($sql); - $source_account_name = sanitizeInput($row['account_name']); - $account_currency_code = sanitizeInput($row['account_currency_code']); + $source_account_name = escapeSql($row['account_name']); + $account_currency_code = escapeSql($row['account_currency_code']); // Get Destination Account Name for logging $sql = mysqli_query($mysqli,"SELECT account_name FROM accounts WHERE account_id = $account_to"); $row = mysqli_fetch_assoc($sql); - $destination_account_name = sanitizeInput($row['account_name']); + $destination_account_name = escapeSql($row['account_name']); mysqli_query($mysqli,"INSERT INTO expenses SET expense_date = '$date', expense_amount = $amount, expense_currency_code = '$session_company_currency', expense_vendor_id = 0, expense_category_id = 0, expense_account_id = $account_from"); $expense_id = mysqli_insert_id($mysqli); diff --git a/agent/post/transfer_model.php b/agent/post/transfer_model.php index 71c55e36..83381867 100644 --- a/agent/post/transfer_model.php +++ b/agent/post/transfer_model.php @@ -1,9 +1,9 @@ "; echo "" . escapeHtml($tax_name_raw) . ""; diff --git a/agent/user/post/profile.php b/agent/user/post/profile.php index 2cba34d2..c5b018e1 100644 --- a/agent/user/post/profile.php +++ b/agent/user/post/profile.php @@ -10,23 +10,23 @@ if (isset($_POST['edit_your_user_details'])) { validateCSRFToken($_POST['csrf_token']); - $name = sanitizeInput($_POST['name']); - $email = sanitizeInput($_POST['email']); + $name = escapeSql($_POST['name']); + $email = escapeSql($_POST['email']); $signature = mysqli_escape_string($mysqli,$_POST['signature']); - $existing_file_name = sanitizeInput(getFieldById('users', $session_user_id, 'user_avatar')); + $existing_file_name = escapeSql(getFieldById('users', $session_user_id, 'user_avatar')); $logout = false; $extended_log_description = ''; // Email notification when password or email is changed $user_old_email_sql = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT user_email FROM users WHERE user_id = $session_user_id")); - $user_old_email = sanitizeInput($user_old_email_sql['user_email']); + $user_old_email = escapeSql($user_old_email_sql['user_email']); // Sanitize Config Vars from get_settings.php and Session Vars from check_login.php - $config_mail_from_name = sanitizeInput($config_mail_from_name); - $config_mail_from_email = sanitizeInput($config_mail_from_email); - $config_app_name = sanitizeInput($config_app_name); + $config_mail_from_name = escapeSql($config_mail_from_name); + $config_mail_from_email = escapeSql($config_mail_from_email); + $config_app_name = escapeSql($config_app_name); if (!empty($config_smtp_host) && ($user_old_email !== $email)) { @@ -96,7 +96,7 @@ if (isset($_GET['clear_your_user_avatar'])) { validateCSRFToken($_GET['csrf_token']); - $user_avatar = sanitizeInput(getFieldById('users', $session_user_id, 'user_avatar')); + $user_avatar = escapeSql(getFieldById('users', $session_user_id, 'user_avatar')); unlink("../../uploads/users/$session_user_id/$user_avatar"); @@ -122,13 +122,13 @@ if (isset($_POST['edit_your_user_password'])) { // Email notification when password or email is changed $user_sql = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT user_name, user_email FROM users WHERE user_id = $session_user_id")); - $name = sanitizeInput($user_sql['user_name']); - $user_email = sanitizeInput($user_sql['user_email']); + $name = escapeSql($user_sql['user_name']); + $user_email = escapeSql($user_sql['user_email']); // Sanitize Config Vars from get_settings.php and Session Vars from check_login.php - $config_mail_from_name = sanitizeInput($config_mail_from_name); - $config_mail_from_email = sanitizeInput($config_mail_from_email); - $config_app_name = sanitizeInput($config_app_name); + $config_mail_from_name = escapeSql($config_mail_from_name); + $config_mail_from_email = escapeSql($config_mail_from_email); + $config_app_name = escapeSql($config_app_name); if (!empty($config_smtp_host)){ @@ -276,9 +276,9 @@ if (isset($_GET['disable_mfa'])){ mysqli_query($mysqli, "DELETE FROM remember_tokens WHERE remember_token_user_id = $session_user_id"); // Sanitize Config Vars from get_settings.php and Session Vars from check_login.php - $config_mail_from_name = sanitizeInput($config_mail_from_name); - $config_mail_from_email = sanitizeInput($config_mail_from_email); - $config_app_name = sanitizeInput($config_app_name); + $config_mail_from_name = escapeSql($config_mail_from_name); + $config_mail_from_email = escapeSql($config_mail_from_email); + $config_app_name = escapeSql($config_app_name); // Email notification if (!empty($config_smtp_host)) { diff --git a/api/v1/assets/asset_model.php b/api/v1/assets/asset_model.php index 60c90081..4d1f4cce 100644 --- a/api/v1/assets/asset_model.php +++ b/api/v1/assets/asset_model.php @@ -2,7 +2,7 @@ // Variable assignment from POST (or: blank/from DB is updating) if (isset($_POST['asset_name'])) { - $name = sanitizeInput($_POST['asset_name']); + $name = escapeSql($_POST['asset_name']); } elseif (isset($asset_row) && isset($asset_row['asset_name'])) { $name = mysqli_real_escape_string($mysqli, $asset_row['asset_name']); } else { @@ -10,7 +10,7 @@ if (isset($_POST['asset_name'])) { } if (isset($_POST['asset_description'])) { - $description = sanitizeInput($_POST['asset_description']); + $description = escapeSql($_POST['asset_description']); } elseif (isset($asset_row) && isset($asset_row['asset_description'])) { $description = mysqli_real_escape_string($mysqli, $asset_row['asset_description']); } else { @@ -18,7 +18,7 @@ if (isset($_POST['asset_description'])) { } if (isset($_POST['asset_type'])) { - $type = sanitizeInput($_POST['asset_type']); + $type = escapeSql($_POST['asset_type']); } elseif (isset($asset_row) && isset($asset_row['asset_type'])) { $type = mysqli_real_escape_string($mysqli, $asset_row['asset_type']); } else { @@ -26,14 +26,14 @@ if (isset($_POST['asset_type'])) { } if (isset($_POST['asset_make'])) { - $make = sanitizeInput($_POST['asset_make']); + $make = escapeSql($_POST['asset_make']); } elseif (isset($asset_row) && isset($asset_row['asset_make'])) { $make = mysqli_real_escape_string($mysqli, $asset_row['asset_make']); } else { $make = ''; } if (isset($_POST['asset_model'])) { - $model = sanitizeInput($_POST['asset_model']); + $model = escapeSql($_POST['asset_model']); } elseif (isset($asset_row) && isset($asset_row['asset_model'])) { $model = mysqli_real_escape_string($mysqli, $asset_row['asset_model']); } else { @@ -41,7 +41,7 @@ if (isset($_POST['asset_model'])) { } if (isset($_POST['asset_serial'])) { - $serial = sanitizeInput($_POST['asset_serial']); + $serial = escapeSql($_POST['asset_serial']); } elseif (isset($asset_row) && isset($asset_row['asset_serial'])) { $serial = mysqli_real_escape_string($mysqli, $asset_row['asset_serial']); } else { @@ -49,7 +49,7 @@ if (isset($_POST['asset_serial'])) { } if (isset($_POST['asset_os'])) { - $os = sanitizeInput($_POST['asset_os']); + $os = escapeSql($_POST['asset_os']); } elseif (isset($asset_row) && isset($asset_row['asset_os'])) { $os = mysqli_real_escape_string($mysqli, $asset_row['asset_os']); } else { @@ -57,7 +57,7 @@ if (isset($_POST['asset_os'])) { } if (isset($_POST['asset_ip'])) { - $ip = sanitizeInput($_POST['asset_ip']); + $ip = escapeSql($_POST['asset_ip']); } elseif (isset($asset_row) && isset($asset_row['interface_ip'])) { $ip = mysqli_real_escape_string($mysqli, $asset_row['interface_ip']); } else { @@ -65,7 +65,7 @@ if (isset($_POST['asset_ip'])) { } if (isset($_POST['asset_mac'])) { - $mac = sanitizeInput($_POST['asset_mac']); + $mac = escapeSql($_POST['asset_mac']); } elseif (isset($asset_row) && isset($asset_row['interface_mac'])) { $mac = mysqli_real_escape_string($mysqli, $asset_row['interface_mac']); } else { @@ -73,7 +73,7 @@ if (isset($_POST['asset_mac'])) { } if (isset($_POST['asset_uri'])) { - $uri = sanitizeInput($_POST['asset_uri']); + $uri = escapeSql($_POST['asset_uri']); } elseif (isset($asset_row) && isset($asset_row['asset_uri'])) { $uri = mysqli_real_escape_string($mysqli, $asset_row['asset_uri']); } else { @@ -81,7 +81,7 @@ if (isset($_POST['asset_uri'])) { } if (isset($_POST['asset_uri_2'])) { - $uri_2 = sanitizeInput($_POST['asset_uri_2']); + $uri_2 = escapeSql($_POST['asset_uri_2']); } elseif (isset($asset_row) && isset($asset_row['asset_uri_2'])) { $uri_2 = mysqli_real_escape_string($mysqli, $asset_row['asset_uri_2']); } else { @@ -89,7 +89,7 @@ if (isset($_POST['asset_uri_2'])) { } if (isset($_POST['asset_status'])) { - $status = sanitizeInput($_POST['asset_status']); + $status = escapeSql($_POST['asset_status']); } elseif (isset($asset_row) && isset($asset_row['asset_status'])) { $status = mysqli_real_escape_string($mysqli, $asset_row['asset_status']); } else { @@ -97,7 +97,7 @@ if (isset($_POST['asset_status'])) { } if (isset($_POST['asset_purchase_date']) && !empty($_POST['asset_purchase_date'])) { - $purchase_date = "'" . sanitizeInput($_POST['asset_purchase_date']) . "'"; + $purchase_date = "'" . escapeSql($_POST['asset_purchase_date']) . "'"; } elseif (isset($asset_row) && isset($asset_row['asset_purchase_date'])) { $purchase_date = "'" . mysqli_real_escape_string($mysqli, $asset_row['asset_purchase_date']) . "'"; } else { @@ -105,7 +105,7 @@ if (isset($_POST['asset_purchase_date']) && !empty($_POST['asset_purchase_date'] } if (isset($_POST['asset_warranty_expire']) && !empty($_POST['asset_warranty_expire'])) { - $warranty_expire = "'" . sanitizeInput($_POST['asset_warranty_expire']) . "'"; + $warranty_expire = "'" . escapeSql($_POST['asset_warranty_expire']) . "'"; } elseif (isset($asset_row) && isset($asset_row['asset_warranty_expire'])) { $warranty_expire = "'" . mysqli_real_escape_string($mysqli, $asset_row['asset_warranty_expire']) . "'"; } else { @@ -113,7 +113,7 @@ if (isset($_POST['asset_warranty_expire']) && !empty($_POST['asset_warranty_expi } if (isset($_POST['asset_install_date']) && !empty($_POST['asset_install_date'])) { - $install_date = "'" . sanitizeInput($_POST['asset_install_date']) . "'"; + $install_date = "'" . escapeSql($_POST['asset_install_date']) . "'"; } elseif (isset($asset_row) && isset($asset_row['asset_install_date'])) { $install_date = "'" . mysqli_real_escape_string($mysqli, $asset_row['asset_install_date']) . "'"; } else { @@ -121,7 +121,7 @@ if (isset($_POST['asset_install_date']) && !empty($_POST['asset_install_date'])) } if (isset($_POST['asset_notes'])) { - $notes = sanitizeInput($_POST['asset_notes']); + $notes = escapeSql($_POST['asset_notes']); } elseif (isset($asset_row) && isset($asset_row['asset_notes'])) { $notes = mysqli_real_escape_string($mysqli, $asset_row['asset_notes']); } else { diff --git a/api/v1/certificates/certificate_model.php b/api/v1/certificates/certificate_model.php index 588ca267..cd66679e 100644 --- a/api/v1/certificates/certificate_model.php +++ b/api/v1/certificates/certificate_model.php @@ -3,7 +3,7 @@ // Variable assignment from POST (or: blank/from DB is updating) if (isset($_POST['certificate_name'])) { - $name = sanitizeInput($_POST['certificate_name']); + $name = escapeSql($_POST['certificate_name']); } elseif ($certificate_row) { $name = $certificate_row['certificate_name']; } else { @@ -11,7 +11,7 @@ if (isset($_POST['certificate_name'])) { } if (isset($_POST['certificate_description'])) { - $description = sanitizeInput($_POST['certificate_description']); + $description = escapeSql($_POST['certificate_description']); } elseif ($certificate_row) { $description = $certificate_row['certificate_description']; } else { @@ -19,7 +19,7 @@ if (isset($_POST['certificate_description'])) { } if (isset($_POST['certificate_domain'])) { - $domain = sanitizeInput($_POST['certificate_domain']); + $domain = escapeSql($_POST['certificate_domain']); } elseif ($certificate_row) { $domain = $certificate_row['certificate_domain']; } else { @@ -27,7 +27,7 @@ if (isset($_POST['certificate_domain'])) { } if (isset($_POST['certificate_issued_by'])) { - $issued_by = sanitizeInput($_POST['certificate_issued_by']); + $issued_by = escapeSql($_POST['certificate_issued_by']); } elseif ($certificate_row) { $issued_by = $certificate_row['certificate_issued_by']; } else { @@ -35,7 +35,7 @@ if (isset($_POST['certificate_issued_by'])) { } if (isset($_POST['certificate_expire'])) { - $expire = sanitizeInput($_POST['certificate_expire']); + $expire = escapeSql($_POST['certificate_expire']); } elseif ($certificate_row) { $expire = $certificate_row['certificate_expire']; } else { @@ -43,7 +43,7 @@ if (isset($_POST['certificate_expire'])) { } if (isset($_POST['certificate_public_key'])) { - $public_key = sanitizeInput($_POST['certificate_public_key']); + $public_key = escapeSql($_POST['certificate_public_key']); } elseif ($certificate_row) { $public_key = $certificate_row['certificate_public_key']; } else { @@ -51,7 +51,7 @@ if (isset($_POST['certificate_public_key'])) { } if (isset($_POST['certificate_notes'])) { - $notes = sanitizeInput($_POST['certificate_notes']); + $notes = escapeSql($_POST['certificate_notes']); } elseif ($certificate_row) { $notes = $certificate_row['certificate_notes']; } else { diff --git a/api/v1/certificates/create.php b/api/v1/certificates/create.php index 4a464a00..d5f740ed 100644 --- a/api/v1/certificates/create.php +++ b/api/v1/certificates/create.php @@ -19,7 +19,7 @@ if (!empty($name) && !empty($domain) && !empty($client_id)) { $public_key_obj = openssl_x509_parse($_POST['certificate_public_key']); if ($public_key_obj) { $expire = date('Y-m-d', $public_key_obj['validTo_time_t']); - $issued_by = sanitizeInput($public_key_obj['issuer']['O']); + $issued_by = escapeSql($public_key_obj['issuer']['O']); } } diff --git a/api/v1/clients/archive.php b/api/v1/clients/archive.php index bfa3b055..2da0d818 100644 --- a/api/v1/clients/archive.php +++ b/api/v1/clients/archive.php @@ -18,7 +18,7 @@ if (!empty($client_id)) { if ($row) { - $client_name = sanitizeInput($row['client_name']); + $client_name = escapeSql($row['client_name']); // Stop recurring invoices $sql_recurring_invoices = mysqli_query($mysqli, "SELECT * FROM recurring_invoices WHERE recurring_invoice_client_id = $client_id AND recurring_invoice_status = 1"); diff --git a/api/v1/clients/client_model.php b/api/v1/clients/client_model.php index 4ab7a9c7..d147f8c7 100644 --- a/api/v1/clients/client_model.php +++ b/api/v1/clients/client_model.php @@ -3,7 +3,7 @@ // Variable assignment from POST (or: blank/from DB is updating) if (isset($_POST['client_name'])) { - $name = sanitizeInput($_POST['client_name']); + $name = escapeSql($_POST['client_name']); } elseif ($client_row) { $name = mysqli_real_escape_string($mysqli, $client_row['client_name']); } else { @@ -11,7 +11,7 @@ if (isset($_POST['client_name'])) { } if (isset($_POST['client_type'])) { - $type = sanitizeInput($_POST['client_type']); + $type = escapeSql($_POST['client_type']); } elseif ($client_row) { $type = mysqli_real_escape_string($mysqli, $client_row['client_type']); } else { @@ -19,7 +19,7 @@ if (isset($_POST['client_type'])) { } if (isset($_POST['client_website'])) { - $website = preg_replace("(^https?://)", "", sanitizeInput($_POST['client_website'])); + $website = preg_replace("(^https?://)", "", escapeSql($_POST['client_website'])); } elseif ($client_row) { $website = mysqli_real_escape_string($mysqli, $client_row['client_website']); } else { @@ -27,7 +27,7 @@ if (isset($_POST['client_website'])) { } if (isset($_POST['client_referral'])) { - $referral = sanitizeInput($_POST['client_referral']); + $referral = escapeSql($_POST['client_referral']); } elseif ($client_row) { $referral = mysqli_real_escape_string($mysqli, $client_row['client_referral']); } else { @@ -43,7 +43,7 @@ if (isset($_POST['client_rate'])) { } if (isset($_POST['client_currency_code'])) { - $currency_code = sanitizeInput($_POST['client_currency_code']); + $currency_code = escapeSql($_POST['client_currency_code']); } elseif ($client_row) { $currency_code = mysqli_real_escape_string($mysqli, $client_row['client_currency_code']); } else { @@ -59,7 +59,7 @@ if (isset($_POST['client_net_terms'])) { } if (isset($_POST['client_tax_id_number'])) { - $tax_id_number = sanitizeInput($_POST['client_tax_id_number']); + $tax_id_number = escapeSql($_POST['client_tax_id_number']); } elseif ($client_row) { $tax_id_number = mysqli_real_escape_string($mysqli, $client_row['client_tax_id_number']); } else { @@ -67,7 +67,7 @@ if (isset($_POST['client_tax_id_number'])) { } if (isset($_POST['client_abbreviation'])) { - $abbreviation = sanitizeInput(substr($_POST['client_abbreviation'], 0, 6)); + $abbreviation = escapeSql(substr($_POST['client_abbreviation'], 0, 6)); } elseif ($client_row) { $abbreviation = mysqli_real_escape_string($mysqli, $client_row['client_abbreviation']); } else { @@ -83,7 +83,7 @@ if (isset($_POST['client_is_lead'])) { } if (isset($_POST['client_notes'])) { - $notes = sanitizeInput($_POST['client_notes']); + $notes = escapeSql($_POST['client_notes']); } elseif ($client_row) { $notes = mysqli_real_escape_string($mysqli, $client_row['client_notes']); } else { diff --git a/api/v1/clients/unarchive.php b/api/v1/clients/unarchive.php index 2a0c38f5..daaa110c 100644 --- a/api/v1/clients/unarchive.php +++ b/api/v1/clients/unarchive.php @@ -18,7 +18,7 @@ if (!empty($client_id)) { if ($row) { - $client_name = sanitizeInput($row['client_name']); + $client_name = escapeSql($row['client_name']); // Un-archive client $update_sql = mysqli_query($mysqli, "UPDATE clients SET client_archived_at = NULL WHERE client_id = $client_id"); diff --git a/api/v1/contacts/archive.php b/api/v1/contacts/archive.php index 831df469..7cf2d052 100644 --- a/api/v1/contacts/archive.php +++ b/api/v1/contacts/archive.php @@ -21,7 +21,7 @@ if (!empty($contact_id)) { if ($row) { - $contact_name = sanitizeInput($row['contact_name']); + $contact_name = escapeSql($row['contact_name']); $contact_user_id = intval($row['contact_user_id']); // Archive associated user if applicable diff --git a/api/v1/contacts/contact_model.php b/api/v1/contacts/contact_model.php index e92f4246..b4cd38f8 100644 --- a/api/v1/contacts/contact_model.php +++ b/api/v1/contacts/contact_model.php @@ -3,7 +3,7 @@ define('number_regex', '/[^0-9]/'); // Variable assignment from POST (or: blank/from DB is updating) if (isset($_POST['contact_name'])) { - $name = sanitizeInput($_POST['contact_name']); + $name = escapeSql($_POST['contact_name']); } elseif ($contact_row) { $name = mysqli_real_escape_string($mysqli, $contact_row['contact_name']); } else { @@ -11,7 +11,7 @@ if (isset($_POST['contact_name'])) { } if (isset($_POST['contact_title'])) { - $title = sanitizeInput($_POST['contact_title']); + $title = escapeSql($_POST['contact_title']); } elseif ($contact_row) { $title = mysqli_real_escape_string($mysqli, $contact_row['contact_title']); } else { @@ -19,7 +19,7 @@ if (isset($_POST['contact_title'])) { } if (isset($_POST['contact_department'])) { - $department = sanitizeInput($_POST['contact_department']); + $department = escapeSql($_POST['contact_department']); } elseif ($contact_row) { $department = mysqli_real_escape_string($mysqli, $contact_row['contact_department']); } else { @@ -27,7 +27,7 @@ if (isset($_POST['contact_department'])) { } if (isset($_POST['contact_email'])) { - $email = sanitizeInput($_POST['contact_email']); + $email = escapeSql($_POST['contact_email']); } elseif ($contact_row) { $email = mysqli_real_escape_string($mysqli, $contact_row['contact_email']); } else { @@ -59,7 +59,7 @@ if (isset($_POST['contact_mobile'])) { } if (isset($_POST['contact_notes'])) { - $notes = sanitizeInput($_POST['contact_notes']); + $notes = escapeSql($_POST['contact_notes']); } elseif ($contact_row) { $notes = mysqli_real_escape_string($mysqli, $contact_row['contact_notes']); } else { diff --git a/api/v1/contacts/unarchive.php b/api/v1/contacts/unarchive.php index adc57d60..66bd3470 100644 --- a/api/v1/contacts/unarchive.php +++ b/api/v1/contacts/unarchive.php @@ -21,7 +21,7 @@ if (!empty($contact_id)) { if ($row) { - $contact_name = sanitizeInput($row['contact_name']); + $contact_name = escapeSql($row['contact_name']); $contact_user_id = intval($row['contact_user_id']); // Un-archive associated user if applicable diff --git a/api/v1/credentials/credential_model.php b/api/v1/credentials/credential_model.php index 04531727..8d37b09b 100644 --- a/api/v1/credentials/credential_model.php +++ b/api/v1/credentials/credential_model.php @@ -9,7 +9,7 @@ if (isset($_POST['api_key_decrypt_password'])) { } if (isset($_POST['credential_name'])) { - $name = sanitizeInput($_POST['credential_name']); + $name = escapeSql($_POST['credential_name']); } elseif (isset($credential_row) && isset($credential_row['credential_name'])) { $name = mysqli_real_escape_string($mysqli, $credential_row['credential_name']); } else { @@ -17,7 +17,7 @@ if (isset($_POST['credential_name'])) { } if (isset($_POST['credential_description'])) { - $description = sanitizeInput($_POST['credential_description']); + $description = escapeSql($_POST['credential_description']); } elseif (isset($credential_row) && isset($credential_row['credential_description'])) { $description = mysqli_real_escape_string($mysqli, $credential_row['credential_description']); } else { @@ -25,7 +25,7 @@ if (isset($_POST['credential_description'])) { } if (isset($_POST['credential_uri'])) { - $uri = sanitizeInput($_POST['credential_uri']); + $uri = escapeSql($_POST['credential_uri']); } elseif (isset($credential_row) && isset($credential_row['credential_uri'])) { $uri = mysqli_real_escape_string($mysqli, $credential_row['credential_uri']); } else { @@ -33,7 +33,7 @@ if (isset($_POST['credential_uri'])) { } if (isset($_POST['credential_uri_2'])) { - $uri_2 = sanitizeInput($_POST['credential_uri_2']); + $uri_2 = escapeSql($_POST['credential_uri_2']); } elseif (isset($credential_row) && isset($credential_row['credential_uri_2'])) { $uri_2 = mysqli_real_escape_string($mysqli, $credential_row['credential_uri_2']); } else { @@ -62,7 +62,7 @@ if (isset($_POST['credential_password'])) { } if (isset($_POST['credential_otp_secret'])) { - $otp_secret = sanitizeInput($_POST['credential_otp_secret']); + $otp_secret = escapeSql($_POST['credential_otp_secret']); } elseif (isset($credential_row) && isset($credential_row['credential_otp_secret'])) { $otp_secret = mysqli_real_escape_string($mysqli, $credential_row['credential_otp_secret']); } else { @@ -70,7 +70,7 @@ if (isset($_POST['credential_otp_secret'])) { } if (isset($_POST['credential_note'])) { - $note = sanitizeInput($_POST['credential_note']); + $note = escapeSql($_POST['credential_note']); } elseif (isset($credential_row) && isset($credential_row['credential_note'])) { $note = mysqli_real_escape_string($mysqli, $credential_row['credential_note']); } else { diff --git a/api/v1/documents/document_model.php b/api/v1/documents/document_model.php index 47d5962f..ea1d34d1 100644 --- a/api/v1/documents/document_model.php +++ b/api/v1/documents/document_model.php @@ -2,7 +2,7 @@ // Variable assignment from POST (or: blank/from DB is updating) if (isset($_POST['document_name'])) { - $name = sanitizeInput($_POST['document_name']); + $name = escapeSql($_POST['document_name']); } elseif (isset($document_row) && isset($document_row['document_name'])) { $name = mysqli_real_escape_string($mysqli, $document_row['document_name']); } else { @@ -10,7 +10,7 @@ if (isset($_POST['document_name'])) { } if (isset($_POST['document_description'])) { - $description = sanitizeInput($_POST['document_description']); + $description = escapeSql($_POST['document_description']); } elseif (isset($document_row) && isset($document_row['document_description'])) { $description = mysqli_real_escape_string($mysqli, $document_row['document_description']); } else { @@ -27,7 +27,7 @@ if (isset($_POST['document_content'])) { // Raw content (used for FULL INDEX searching) if (isset($_POST['document_content'])) { - $content_raw = sanitizeInput($_POST['document_name'] . $_POST['document_description'] . " " . str_replace("<", " <", $_POST['document_content'])); + $content_raw = escapeSql($_POST['document_name'] . $_POST['document_description'] . " " . str_replace("<", " <", $_POST['document_content'])); } elseif (isset($document_row) && isset($document_row['document_content_raw'])) { $content_raw = mysqli_real_escape_string($mysqli, $document_row['document_content_raw']); } else { diff --git a/api/v1/documents/update.php b/api/v1/documents/update.php index 4c690c7c..6cb158e7 100644 --- a/api/v1/documents/update.php +++ b/api/v1/documents/update.php @@ -25,13 +25,13 @@ if (!empty($document_id)) { $row = mysqli_fetch_assoc($sql_original_document); // Pull original fields for versioning - $original_document_name = sanitizeInput($row['document_name']); - $original_document_description = sanitizeInput($row['document_description']); + $original_document_name = escapeSql($row['document_name']); + $original_document_description = escapeSql($row['document_description']); $original_document_content = mysqli_real_escape_string($mysqli, $row['document_content']); $original_document_created_by = intval($row['document_created_by']); $original_document_updated_by = intval($row['document_updated_by']); - $original_document_created_at = sanitizeInput($row['document_created_at']); - $original_document_updated_at = sanitizeInput($row['document_updated_at']); + $original_document_created_at = escapeSql($row['document_created_at']); + $original_document_updated_at = escapeSql($row['document_updated_at']); // Determine who/when created the version (same logic as app) if (!empty($original_document_updated_at)) { @@ -89,7 +89,7 @@ if (!empty($document_id)) { $content_db = mysqli_real_escape_string($mysqli, $processed_html); // Rebuild content_raw for full-text search (same technique as app) - $content_raw = sanitizeInput($name . " " . str_replace("<", " <", $processed_html)); + $content_raw = escapeSql($name . " " . str_replace("<", " <", $processed_html)); $content_raw = mysqli_real_escape_string($mysqli, $content_raw); // Escape name/description too (document_model.php may already sanitize; do DB escaping here regardless) diff --git a/api/v1/locations/location_model.php b/api/v1/locations/location_model.php index b177a4e5..f7246f2a 100644 --- a/api/v1/locations/location_model.php +++ b/api/v1/locations/location_model.php @@ -3,7 +3,7 @@ // Variable assignment from POST (or: blank/from DB is updating) if (isset($_POST['location_name'])) { - $name = sanitizeInput($_POST['location_name']); + $name = escapeSql($_POST['location_name']); } elseif ($location_row) { $name = mysqli_real_escape_string($mysqli, $location_row['location_name']); } else { @@ -11,7 +11,7 @@ if (isset($_POST['location_name'])) { } if (isset($_POST['location_description'])) { - $description = sanitizeInput($_POST['location_description']); + $description = escapeSql($_POST['location_description']); } elseif ($location_row) { $description = mysqli_real_escape_string($mysqli, $location_row['location_description']); } else { @@ -19,7 +19,7 @@ if (isset($_POST['location_description'])) { } if (isset($_POST['location_country'])) { - $country = sanitizeInput($_POST['location_country']); + $country = escapeSql($_POST['location_country']); } elseif ($location_row) { $country = mysqli_real_escape_string($mysqli, $location_row['location_country']); } else { @@ -27,7 +27,7 @@ if (isset($_POST['location_country'])) { } if (isset($_POST['location_address'])) { - $address = sanitizeInput($_POST['location_address']); + $address = escapeSql($_POST['location_address']); } elseif ($location_row) { $address = mysqli_real_escape_string($mysqli, $location_row['location_address']); } else { @@ -35,7 +35,7 @@ if (isset($_POST['location_address'])) { } if (isset($_POST['location_city'])) { - $city = sanitizeInput($_POST['location_city']); + $city = escapeSql($_POST['location_city']); } elseif ($location_row) { $city = mysqli_real_escape_string($mysqli, $location_row['location_city']); } else { @@ -43,7 +43,7 @@ if (isset($_POST['location_city'])) { } if (isset($_POST['location_state'])) { - $state = sanitizeInput($_POST['location_state']); + $state = escapeSql($_POST['location_state']); } elseif ($location_row) { $state = mysqli_real_escape_string($mysqli, $location_row['location_state']); } else { @@ -51,7 +51,7 @@ if (isset($_POST['location_state'])) { } if (isset($_POST['location_zip'])) { - $zip = sanitizeInput($_POST['location_zip']); + $zip = escapeSql($_POST['location_zip']); } elseif ($location_row) { $zip = mysqli_real_escape_string($mysqli, $location_row['location_zip']); } else { @@ -59,7 +59,7 @@ if (isset($_POST['location_zip'])) { } if (isset($_POST['location_hours'])) { - $hours = sanitizeInput($_POST['location_hours']); + $hours = escapeSql($_POST['location_hours']); } elseif ($location_row) { $hours = mysqli_real_escape_string($mysqli, $location_row['location_hours']); } else { @@ -67,7 +67,7 @@ if (isset($_POST['location_hours'])) { } if (isset($_POST['location_notes'])) { - $notes = sanitizeInput($_POST['location_notes']); + $notes = escapeSql($_POST['location_notes']); } elseif ($location_row) { $notes = mysqli_real_escape_string($mysqli, $location_row['location_notes']); } else { diff --git a/api/v1/tickets/resolve.php b/api/v1/tickets/resolve.php index 1079bbce..3bc8b82a 100644 --- a/api/v1/tickets/resolve.php +++ b/api/v1/tickets/resolve.php @@ -19,9 +19,9 @@ if (!empty($ticket_id)) { // Grab what we need, not using the model $ticket_id = intval($ticket_row['ticket_id']); // Override so things fail if this is bad - $ticket_prefix = sanitizeInput($ticket_row['ticket_prefix']); + $ticket_prefix = escapeSql($ticket_row['ticket_prefix']); $ticket_number = intval($ticket_row['ticket_number']); - $ticket_first_response_at = sanitizeInput($ticket_row['ticket_first_response_at']); + $ticket_first_response_at = escapeSql($ticket_row['ticket_first_response_at']); // Mark FR (if not) if (empty($ticket_first_response_at)) { diff --git a/api/v1/tickets/ticket_model.php b/api/v1/tickets/ticket_model.php index d6bd2c5d..9cbb9568 100644 --- a/api/v1/tickets/ticket_model.php +++ b/api/v1/tickets/ticket_model.php @@ -19,7 +19,7 @@ if (isset($_POST['ticket_asset_id'])) { } if (isset($_POST['ticket_subject'])) { - $subject = sanitizeInput($_POST['ticket_subject']); + $subject = escapeSql($_POST['ticket_subject']); } elseif ($ticket_row) { $subject = mysqli_real_escape_string($mysqli, $ticket_row['ticket_subject']); } else { @@ -28,7 +28,7 @@ if (isset($_POST['ticket_subject'])) { if (isset($_POST['ticket_priority'])) { - $priority = sanitizeInput($_POST['ticket_priority']); + $priority = escapeSql($_POST['ticket_priority']); } elseif ($ticket_row) { $priority = mysqli_real_escape_string($mysqli, $ticket_row['ticket_priority']); } else { diff --git a/api/v1/validate_api_key.php b/api/v1/validate_api_key.php index 80b52e71..2945a321 100644 --- a/api/v1/validate_api_key.php +++ b/api/v1/validate_api_key.php @@ -17,8 +17,8 @@ header('Content-Type: application/json'); $_POST = json_decode(file_get_contents('php://input'), true); // Get IP & UA -$ip = sanitizeInput(getIP()); -$user_agent = sanitizeInput($_SERVER['HTTP_USER_AGENT']); +$ip = escapeSql(getIP()); +$user_agent = escapeSql($_SERVER['HTTP_USER_AGENT']); // Temp Added this to work with the new logAction function $session_ip = $ip; @@ -60,15 +60,15 @@ if (!isset($_GET['api_key']) && !isset($_POST['api_key'])) { // Set API key variable if (isset($_GET['api_key'])) { - $api_key = sanitizeInput($_GET['api_key']); + $api_key = escapeSql($_GET['api_key']); } if (isset($_POST['api_key'])) { - $api_key = sanitizeInput($_POST['api_key']); + $api_key = escapeSql($_POST['api_key']); } // Validate API key if (isset($api_key)) { - $api_key = sanitizeInput($api_key); + $api_key = escapeSql($api_key); $sql = mysqli_query($mysqli, "SELECT * FROM api_keys WHERE api_key_secret = '$api_key' AND api_key_expire > NOW() LIMIT 1"); @@ -76,7 +76,7 @@ if (isset($api_key)) { if (mysqli_num_rows($sql) !== 1) { // Invalid Key - $url_path = sanitizeInput(parse_url($_SERVER["REQUEST_URI"], PHP_URL_PATH)); + $url_path = escapeSql(parse_url($_SERVER["REQUEST_URI"], PHP_URL_PATH)); mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'API', log_action = 'Failed', log_description = 'Incorrect or expired key (endpoint: $url_path)', log_ip = '$ip', log_user_agent = '$user_agent'"); $return_arr['success'] = "False"; diff --git a/client/includes/check_login.php b/client/includes/check_login.php index ddc42a8b..8aababd4 100644 --- a/client/includes/check_login.php +++ b/client/includes/check_login.php @@ -23,8 +23,8 @@ if (!isset($_SESSION['client_logged_in']) || !$_SESSION['client_logged_in']) { require_once $_SERVER['DOCUMENT_ROOT'] . '/includes/inc_set_timezone.php'; // User IP & UA -$session_ip = sanitizeInput(getIP()); -$session_user_agent = sanitizeInput($_SERVER['HTTP_USER_AGENT']); +$session_ip = escapeSql(getIP()); +$session_user_agent = escapeSql($_SERVER['HTTP_USER_AGENT']); // Get info from session @@ -78,12 +78,12 @@ $session_company_logo = $row['company_logo']; $contact_sql = mysqli_query($mysqli, "SELECT * FROM contacts WHERE contact_id = $session_contact_id AND contact_client_id = $session_client_id"); $contact = mysqli_fetch_assoc($contact_sql); -$session_contact_name = sanitizeInput($contact['contact_name']); +$session_contact_name = escapeSql($contact['contact_name']); $session_contact_initials = initials($session_contact_name); -$session_contact_title = sanitizeInput($contact['contact_title']); -$session_contact_email = sanitizeInput($contact['contact_email']); -$session_contact_photo = sanitizeInput($contact['contact_photo']); -$session_contact_pin = sanitizeInput($contact['contact_pin']); +$session_contact_title = escapeSql($contact['contact_title']); +$session_contact_email = escapeSql($contact['contact_email']); +$session_contact_photo = escapeSql($contact['contact_photo']); +$session_contact_pin = escapeSql($contact['contact_pin']); $session_contact_primary = intval($contact['contact_primary']); $session_contact_is_technical_contact = false; diff --git a/client/login_microsoft.php b/client/login_microsoft.php index bb5c59f1..89724467 100644 --- a/client/login_microsoft.php +++ b/client/login_microsoft.php @@ -20,8 +20,8 @@ if (!isset($_SESSION)) { // Set Timezone after session starts require_once "../includes/inc_set_timezone.php"; -$session_ip = sanitizeInput(getIP()); -$session_user_agent = sanitizeInput($_SERVER['HTTP_USER_AGENT']); +$session_ip = escapeSql(getIP()); +$session_user_agent = escapeSql($_SERVER['HTTP_USER_AGENT']); $sql_settings = mysqli_query($mysqli, "SELECT config_azure_client_id, config_azure_client_secret FROM settings WHERE company_id = 1"); $settings = mysqli_fetch_assoc($sql_settings); @@ -115,8 +115,8 @@ if (isset($_POST['code']) && $_POST['state'] == session_id()) { $user_id = intval($row['user_id']); $session_user_id = $user_id; // to pass the user_id to logAction function $contact_id = intval($row['contact_id']); - $user_email = sanitizeInput($row['user_email']); - $user_auth_method = sanitizeInput($row['user_auth_method']); + $user_email = escapeSql($row['user_email']); + $user_auth_method = escapeSql($row['user_auth_method']); if ($user_auth_method == 'azure') { diff --git a/client/login_reset.php b/client/login_reset.php index a75bd11e..fc18d6e3 100644 --- a/client/login_reset.php +++ b/client/login_reset.php @@ -35,22 +35,22 @@ if (!isset($_SESSION)) { // Set Timezone after session require_once "../includes/inc_set_timezone.php"; -$ip = sanitizeInput(getIP()); -$user_agent = sanitizeInput($_SERVER['HTTP_USER_AGENT']); +$ip = escapeSql(getIP()); +$user_agent = escapeSql($_SERVER['HTTP_USER_AGENT']); // Get Company Info $company_sql = mysqli_query($mysqli, "SELECT company_name, company_phone FROM companies WHERE company_id = 1"); $company_results = mysqli_fetch_assoc($company_sql); -$company_name = sanitizeInput($company_results['company_name']); -$company_phone = sanitizeInput(formatPhoneNumber($company_results['company_phone'])); +$company_name = escapeSql($company_results['company_name']); +$company_phone = escapeSql(formatPhoneNumber($company_results['company_phone'])); $company_name_display = $company_results['company_name']; // Get settings from load_global_settings.php and sanitize them -$config_ticket_from_name = sanitizeInput($config_ticket_from_name); -$config_ticket_from_email = sanitizeInput($config_ticket_from_email); -$config_mail_from_name = sanitizeInput($config_mail_from_name); -$config_mail_from_email = sanitizeInput($config_mail_from_email); -$config_base_url = sanitizeInput($config_base_url); +$config_ticket_from_name = escapeSql($config_ticket_from_name); +$config_ticket_from_email = escapeSql($config_ticket_from_email); +$config_mail_from_name = escapeSql($config_mail_from_name); +$config_mail_from_email = escapeSql($config_mail_from_email); +$config_base_url = escapeSql($config_base_url); DEFINE("WORDING_ERROR", "Something went wrong! Your link may have expired. Please request a new password reset e-mail."); @@ -61,7 +61,7 @@ if ($_SERVER['REQUEST_METHOD'] == "POST") { */ if (isset($_POST['password_reset_email_request'])) { - $email = sanitizeInput($_POST['email']); + $email = escapeSql($_POST['email']); $sql = mysqli_query($mysqli, "SELECT contact_id, contact_name, user_email, contact_client_id, user_id FROM users LEFT JOIN contacts ON user_id = contact_user_id WHERE user_email = '$email' AND user_auth_method = 'local' AND user_type = 2 AND user_status = 1 AND user_archived_at IS NULL LIMIT 1"); $row = mysqli_fetch_assoc($sql); @@ -69,7 +69,7 @@ if ($_SERVER['REQUEST_METHOD'] == "POST") { if ($row['user_email'] == $email) { $id = intval($row['contact_id']); $user_id = intval($row['user_id']); - $name = sanitizeInput($row['contact_name']); + $name = escapeSql($row['contact_name']); $client = intval($row['contact_client_id']); $token = randomString(32); @@ -112,8 +112,8 @@ if ($_SERVER['REQUEST_METHOD'] == "POST") { $_SESSION['login_message'] = WORDING_ERROR; } - $token = sanitizeInput($_POST['token']); - $email = sanitizeInput($_POST['email']); + $token = escapeSql($_POST['token']); + $email = escapeSql($_POST['email']); $client = intval($_POST['client']); // Query user @@ -121,7 +121,7 @@ if ($_SERVER['REQUEST_METHOD'] == "POST") { $user_row = mysqli_fetch_assoc($sql); $contact_id = intval($user_row['contact_id']); $user_id = intval($user_row['user_id']); - $name = sanitizeInput($user_row['contact_name']); + $name = escapeSql($user_row['contact_name']); // Ensure the token is correct if (sha1($user_row['user_password_reset_token']) == sha1($token)) { @@ -211,8 +211,8 @@ if ($_SERVER['REQUEST_METHOD'] == "POST") { */ if (isset($_GET['token']) && isset($_GET['email']) && isset($_GET['client'])) { - $token = sanitizeInput($_GET['token']); - $email = sanitizeInput($_GET['email']); + $token = escapeSql($_GET['token']); + $email = escapeSql($_GET['email']); $client = intval($_GET['client']); $sql = mysqli_query($mysqli, "SELECT * FROM users LEFT JOIN contacts ON user_id = contact_user_id WHERE user_email = '$email' AND user_password_reset_token = '$token' AND contact_client_id = $client LIMIT 1"); diff --git a/client/post.php b/client/post.php index ca174465..991ac86c 100644 --- a/client/post.php +++ b/client/post.php @@ -14,16 +14,16 @@ if (isset($_POST['add_ticket'])) { validateCSRFToken($_POST['csrf_token']); - $subject = sanitizeInput($_POST['subject']); + $subject = escapeSql($_POST['subject']); $details = mysqli_real_escape_string($mysqli, ($_POST['details'])); $category = intval($_POST['category']); $asset = intval($_POST['asset']); // Get settings from load_global_settings.php - $config_ticket_prefix = sanitizeInput($config_ticket_prefix); - $config_ticket_from_name = sanitizeInput($config_ticket_from_name); - $config_ticket_from_email = sanitizeInput($config_ticket_from_email); - $config_base_url = sanitizeInput($config_base_url); + $config_ticket_prefix = escapeSql($config_ticket_prefix); + $config_ticket_from_name = escapeSql($config_ticket_from_name); + $config_ticket_from_email = escapeSql($config_ticket_from_email); + $config_base_url = escapeSql($config_base_url); $config_ticket_new_ticket_notification_email = filter_var($config_ticket_new_ticket_notification_email, FILTER_VALIDATE_EMAIL); //Generate a unique URL key for clients to access @@ -33,7 +33,7 @@ if (isset($_POST['add_ticket'])) { if ($_POST['priority'] !== "Low" && $_POST['priority'] !== "Medium" && $_POST['priority'] !== "High") { $priority = "Low"; } else { - $priority = sanitizeInput($_POST['priority']); + $priority = escapeSql($_POST['priority']); } // Atomically increment and get the new ticket number @@ -53,7 +53,7 @@ if (isset($_POST['add_ticket'])) { // Notify agent DL of the new ticket, if populated with a valid email if ($config_ticket_new_ticket_notification_email) { - $client_name = sanitizeInput($session_client_name); + $client_name = escapeSql($session_client_name); $details = removeEmoji($details); $email_subject = "ITFlow - New Ticket - $client_name: $subject"; @@ -112,15 +112,15 @@ if (isset($_POST['add_ticket_comment'])) { $ticket_number = intval($ticket_details['ticket_number']); $ticket_assigned_to = intval($ticket_details['ticket_assigned_to']); - $ticket_subject = sanitizeInput($ticket_details['ticket_subject']); - $client_name = sanitizeInput($ticket_details['client_name']); + $ticket_subject = escapeSql($ticket_details['ticket_subject']); + $client_name = escapeSql($ticket_details['client_name']); if ($ticket_details && $ticket_assigned_to !== 0) { // Get tech details $tech_details = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT user_email, user_name FROM users WHERE user_id = $ticket_assigned_to LIMIT 1")); - $tech_email = sanitizeInput($tech_details['user_email']); - $tech_name = sanitizeInput($tech_details['user_name']); + $tech_email = escapeSql($tech_details['user_email']); + $tech_name = escapeSql($tech_details['user_name']); $subject = "$config_app_name Ticket updated - [$config_ticket_prefix$ticket_number] $ticket_subject"; $body = "Hello $tech_name,

A new reply has been added to the below ticket, check ITFlow for full details.

Client: $client_name
Ticket: $config_ticket_prefix$ticket_number
Subject: $ticket_subject

https://$config_base_url/agent/ticket.php?ticket_id=$ticket_id&client_id=$session_client_id"; @@ -162,9 +162,9 @@ if (isset($_POST['add_ticket_comment'])) { $file_tmp_path = $_FILES['file']['tmp_name'][$i]; - $file_name = sanitizeInput($_FILES['file']['name'][$i]); + $file_name = escapeSql($_FILES['file']['name'][$i]); $extarr = explode('.', $_FILES['file']['name'][$i]); - $file_extension = sanitizeInput(strtolower(end($extarr))); + $file_extension = escapeSql(strtolower(end($extarr))); // Define destination file path $dest_path = $upload_file_dir . $ticket_attachment_ref_name; @@ -195,7 +195,7 @@ if (isset($_GET['approve_ticket_task'])) { $task_id = intval($_GET['approve_ticket_task']); $approval_id = intval($_GET['approval_id']); - $url_key = sanitizeInput($_GET['approval_url_key']); + $url_key = escapeSql($_GET['approval_url_key']); $approval_row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT * FROM task_approvals LEFT JOIN tasks on task_id = approval_task_id WHERE approval_id = $approval_id AND approval_task_id = $task_id AND approval_url_key = '$url_key' AND approval_status = 'pending' AND approval_scope = 'client'")); @@ -233,7 +233,7 @@ if (isset($_POST['add_ticket_feedback'])) { validateCSRFToken($_POST['csrf_token']); $ticket_id = intval($_POST['ticket_id']); - $feedback = sanitizeInput($_POST['add_ticket_feedback']); + $feedback = escapeSql($_POST['add_ticket_feedback']); // Verify the contact has access to the provided ticket ID if (verifyContactTicketAccess($ticket_id, "Closed")) { @@ -269,7 +269,7 @@ if (isset($_GET['resolve_ticket'])) { // Get ticket details for logging $row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT * FROM tickets WHERE ticket_id = $ticket_id LIMIT 1")); - $ticket_prefix = sanitizeInput($row['ticket_prefix']); + $ticket_prefix = escapeSql($row['ticket_prefix']); $ticket_number = intval($row['ticket_number']); // Verify the contact has access to the provided ticket ID @@ -304,7 +304,7 @@ if (isset($_GET['reopen_ticket'])) { // Get ticket details for logging $row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT * FROM tickets WHERE ticket_id = $ticket_id LIMIT 1")); - $ticket_prefix = sanitizeInput($row['ticket_prefix']); + $ticket_prefix = escapeSql($row['ticket_prefix']); $ticket_number = intval($row['ticket_number']); // Verify the contact has access to the provided ticket ID @@ -339,7 +339,7 @@ if (isset($_GET['close_ticket'])) { // Get ticket details for logging $row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT * FROM tickets WHERE ticket_id = $ticket_id LIMIT 1")); - $ticket_prefix = sanitizeInput($row['ticket_prefix']); + $ticket_prefix = escapeSql($row['ticket_prefix']); $ticket_number = intval($row['ticket_number']); // Verify the contact has access to the provided ticket ID @@ -402,11 +402,11 @@ if (isset($_POST['add_contact'])) { redirect("post.php?logout"); } - $contact_name = sanitizeInput($_POST['contact_name']); - $contact_email = sanitizeInput($_POST['contact_email']); + $contact_name = escapeSql($_POST['contact_name']); + $contact_email = escapeSql($_POST['contact_email']); $contact_technical = intval($_POST['contact_technical'] ?? 0); $contact_billing = intval($_POST['contact_billing'] ?? 0); - $contact_auth_method = sanitizeInput($_POST['contact_auth_method']); + $contact_auth_method = escapeSql($_POST['contact_auth_method']); // Check the email isn't already in use $sql = mysqli_query($mysqli, "SELECT user_id FROM users WHERE user_email = '$contact_email'"); @@ -452,11 +452,11 @@ if (isset($_POST['edit_contact'])) { } $contact_id = intval($_POST['contact_id']); - $contact_name = sanitizeInput($_POST['contact_name']); - $contact_email = sanitizeInput($_POST['contact_email']); + $contact_name = escapeSql($_POST['contact_name']); + $contact_email = escapeSql($_POST['contact_email']); $contact_technical = intval($_POST['contact_technical'] ?? 0); $contact_billing = intval($_POST['contact_billing'] ?? 0); - $contact_auth_method = sanitizeInput($_POST['contact_auth_method']); + $contact_auth_method = escapeSql($_POST['contact_auth_method']); // Get the existing contact_user_id - we look it up ourselves so the user can't just overwrite random users $sql = mysqli_query($mysqli,"SELECT contact_user_id FROM contacts WHERE contact_id = $contact_id AND contact_client_id = $session_client_id"); @@ -510,51 +510,51 @@ if (isset($_GET['add_payment_by_provider'])) { ); $row = mysqli_fetch_assoc($sql); $invoice_number = intval($row['invoice_number']); - $invoice_status = sanitizeInput($row['invoice_status']); + $invoice_status = escapeSql($row['invoice_status']); $invoice_amount = floatval($row['invoice_amount']); - $invoice_prefix = sanitizeInput($row['invoice_prefix']); + $invoice_prefix = escapeSql($row['invoice_prefix']); $invoice_number = intval($row['invoice_number']); - $invoice_url_key = sanitizeInput($row['invoice_url_key']); - $invoice_currency_code = sanitizeInput($row['invoice_currency_code']); + $invoice_url_key = escapeSql($row['invoice_url_key']); + $invoice_currency_code = escapeSql($row['invoice_currency_code']); $client_id = intval($row['client_id']); - $client_name = sanitizeInput($row['client_name']); - $contact_name = sanitizeInput($row['contact_name']); - $contact_email = sanitizeInput($row['contact_email']); - $contact_phone = sanitizeInput(formatPhoneNumber($row['contact_phone'], $row['contact_phone_country_code'])); + $client_name = escapeSql($row['client_name']); + $contact_name = escapeSql($row['contact_name']); + $contact_email = escapeSql($row['contact_email']); + $contact_phone = escapeSql(formatPhoneNumber($row['contact_phone'], $row['contact_phone_country_code'])); $contact_extension = preg_replace("/[^0-9]/", '',$row['contact_extension']); - $contact_mobile = sanitizeInput(formatPhoneNumber($row['contact_mobile'], $row['contact_mobile_country_code'])); + $contact_mobile = escapeSql(formatPhoneNumber($row['contact_mobile'], $row['contact_mobile_country_code'])); // Get ITFlow company details $sql = mysqli_query($mysqli,"SELECT * FROM companies WHERE company_id = 1"); $row = mysqli_fetch_assoc($sql); - $company_name = sanitizeInput($row['company_name']); - $company_country = sanitizeInput($row['company_country']); - $company_address = sanitizeInput($row['company_address']); - $company_city = sanitizeInput($row['company_city']); - $company_state = sanitizeInput($row['company_state']); - $company_zip = sanitizeInput($row['company_zip']); - $company_phone = sanitizeInput(formatPhoneNumber($row['company_phone'], $row['company_phone_country_code'])); - $company_email = sanitizeInput($row['company_email']); - $company_website = sanitizeInput($row['company_website']); + $company_name = escapeSql($row['company_name']); + $company_country = escapeSql($row['company_country']); + $company_address = escapeSql($row['company_address']); + $company_city = escapeSql($row['company_city']); + $company_state = escapeSql($row['company_state']); + $company_zip = escapeSql($row['company_zip']); + $company_phone = escapeSql(formatPhoneNumber($row['company_phone'], $row['company_phone_country_code'])); + $company_email = escapeSql($row['company_email']); + $company_website = escapeSql($row['company_website']); // Sanitize Config vars from get_settings.php - $config_invoice_from_name = sanitizeInput($config_invoice_from_name); - $config_invoice_from_email = sanitizeInput($config_invoice_from_email); + $config_invoice_from_name = escapeSql($config_invoice_from_name); + $config_invoice_from_email = escapeSql($config_invoice_from_email); // Get Client Payment Details $sql = mysqli_query($mysqli, "SELECT * FROM client_saved_payment_methods LEFT JOIN payment_providers ON saved_payment_provider_id = payment_provider_id LEFT JOIN client_payment_provider ON saved_payment_client_id = client_id WHERE saved_payment_id = $saved_payment_id AND saved_payment_client_id = $session_client_id LIMIT 1"); $row = mysqli_fetch_assoc($sql); - $public_key = sanitizeInput($row['payment_provider_public_key']); - $private_key = sanitizeInput($row['payment_provider_private_key']); + $public_key = escapeSql($row['payment_provider_public_key']); + $private_key = escapeSql($row['payment_provider_private_key']); $account_id = intval($row['payment_provider_account']); $expense_category_id = intval($row['payment_provider_expense_category']); $expense_vendor_id = intval($row['payment_provider_expense_vendor']); $expense_percentage_fee = floatval($row['payment_provider_expense_percentage_fee']); $expense_flat_fee = floatval($row['payment_provider_expense_flat_fee']); - $payment_provider_client = sanitizeInput($row['payment_provider_client']); - $saved_payment_method = sanitizeInput($row['saved_payment_provider_method']); - $saved_payment_description = sanitizeInput($row['saved_payment_description']); + $payment_provider_client = escapeSql($row['payment_provider_client']); + $saved_payment_method = escapeSql($row['saved_payment_provider_method']); + $saved_payment_description = escapeSql($row['saved_payment_description']); $payment_client_id = intval($row['saved_payment_client_id']); // Sanity checks @@ -602,10 +602,10 @@ if (isset($_GET['add_payment_by_provider'])) { ]); // Get details from PI - $pi_id = sanitizeInput($payment_intent->id); + $pi_id = escapeSql($payment_intent->id); $pi_date = date('Y-m-d', $payment_intent->created); $pi_amount_paid = floatval(($payment_intent->amount_received / 100)); - $pi_currency = strtoupper(sanitizeInput($payment_intent->currency)); + $pi_currency = strtoupper(escapeSql($payment_intent->currency)); $pi_livemode = $payment_intent->livemode; } catch (Exception $e) { @@ -750,7 +750,7 @@ if (isset($_POST['create_stripe_customer'])) { ] ]); - $stripe_customer_id = sanitizeInput($customer->id); + $stripe_customer_id = escapeSql($customer->id); // Insert customer into client_payment_provider mysqli_query($mysqli, " @@ -894,7 +894,7 @@ if (isset($_GET['stripe_save_card'])) { LIMIT 1 "); $client_provider = mysqli_fetch_assoc($client_provider_query); - $stripe_customer_id = sanitizeInput($client_provider['payment_provider_client'] ?? ''); + $stripe_customer_id = escapeSql($client_provider['payment_provider_client'] ?? ''); if (empty($stripe_customer_id)) { flash_alert("Stripe customer ID not found for client.", 'danger'); @@ -902,7 +902,7 @@ if (isset($_GET['stripe_save_card'])) { } // Get session ID from URL - $checkout_session_id = sanitizeInput($_GET['session_id']); + $checkout_session_id = escapeSql($_GET['session_id']); try { require_once '../libs/stripe-php/init.php'; @@ -912,17 +912,17 @@ if (isset($_GET['stripe_save_card'])) { $checkout_session = $stripe->checkout->sessions->retrieve($checkout_session_id, []); $setup_intent_id = $checkout_session->setup_intent; $setup_intent = $stripe->setupIntents->retrieve($setup_intent_id, []); - $payment_method_id = sanitizeInput($setup_intent->payment_method); + $payment_method_id = escapeSql($setup_intent->payment_method); // Attach the payment method to the Stripe customer $stripe->paymentMethods->attach($payment_method_id, ['customer' => $stripe_customer_id]); // Retrieve PM details for logging and UI $payment_method_details = $stripe->paymentMethods->retrieve($payment_method_id, []); - $card_brand = sanitizeInput($payment_method_details->card->brand); - $last4 = sanitizeInput($payment_method_details->card->last4); - $exp_month = sanitizeInput($payment_method_details->card->exp_month); - $exp_year = sanitizeInput($payment_method_details->card->exp_year); + $card_brand = escapeSql($payment_method_details->card->brand); + $last4 = escapeSql($payment_method_details->card->last4); + $exp_month = escapeSql($payment_method_details->card->exp_month); + $exp_year = escapeSql($payment_method_details->card->exp_year); $saved_payment_description = "$card_brand - $last4 | Exp $exp_month/$exp_year"; @@ -954,10 +954,10 @@ if (isset($_GET['stripe_save_card'])) { "); $row = mysqli_fetch_assoc($sql_settings); - $company_name = sanitizeInput($row['company_name']); - $company_phone = sanitizeInput(formatPhoneNumber($row['company_phone'], $row['company_phone_country_code'])); - $config_invoice_from_email = sanitizeInput($row['config_invoice_from_email']); - $config_invoice_from_name = sanitizeInput($row['config_invoice_from_name']); + $company_name = escapeSql($row['company_name']); + $company_phone = escapeSql(formatPhoneNumber($row['company_phone'], $row['company_phone_country_code'])); + $config_invoice_from_email = escapeSql($row['config_invoice_from_email']); + $config_invoice_from_name = escapeSql($row['config_invoice_from_name']); if (!empty($row['config_smtp_host'])) { $subject = "Payment method saved"; @@ -1034,7 +1034,7 @@ if (isset($_GET['delete_saved_payment'])) { redirect("saved_payment_methods.php"); } - $payment_method_id = sanitizeInput($saved_payment['saved_payment_provider_method']); + $payment_method_id = escapeSql($saved_payment['saved_payment_provider_method']); $saved_payment_id = intval($saved_payment['saved_payment_id']); $saved_payment_description = escapeHtml($saved_payment['saved_payment_description']); @@ -1100,9 +1100,9 @@ if (isset($_POST['set_recurring_payment'])) { // Get Recurring Invoice Info for logging and alerting $sql = mysqli_query($mysqli, "SELECT * FROM recurring_invoices WHERE recurring_invoice_id = $recurring_invoice_id AND recurring_invoice_client_id = $session_client_id"); $row = mysqli_fetch_assoc($sql); - $recurring_invoice_prefix = sanitizeInput($row['recurring_invoice_prefix']); + $recurring_invoice_prefix = escapeSql($row['recurring_invoice_prefix']); $recurring_invoice_number = intval($row['recurring_invoice_number']); - $recurring_invoice_currency_code = sanitizeInput($row['recurring_invoice_currency_code']); + $recurring_invoice_currency_code = escapeSql($row['recurring_invoice_currency_code']); $recurring_invoice_amount = floatval($row['recurring_invoice_amount']); if ($saved_payment_id) { @@ -1119,9 +1119,9 @@ if (isset($_POST['set_recurring_payment'])) { $row = mysqli_fetch_assoc($sql); $provider_id = intval($row['payment_provider_id']); - $provider_name = sanitizeInput($row['payment_provider_name']); + $provider_name = escapeSql($row['payment_provider_name']); $account_id = intval($row['payment_provider_account']); - $saved_payment_description = sanitizeInput($row['saved_payment_description']); + $saved_payment_description = escapeSql($row['saved_payment_description']); mysqli_query($mysqli, "DELETE FROM recurring_payments WHERE recurring_payment_recurring_invoice_id = $recurring_invoice_id"); mysqli_query($mysqli,"INSERT INTO recurring_payments SET recurring_payment_currency_code = '$recurring_invoice_currency_code', recurring_payment_account_id = $account_id, recurring_payment_method = 'Credit Card', recurring_payment_recurring_invoice_id = $recurring_invoice_id, recurring_payment_saved_payment_id = $saved_payment_id"); @@ -1153,9 +1153,9 @@ if (isset($_POST['client_add_document'])) { redirect("post.php?logout"); } - $document_name = sanitizeInput($_POST['document_name']); - $document_description = sanitizeInput($_POST['document_description']); - $document_content_raw = sanitizeInput($document_name . " " . strip_tags($_POST['document_content'])); + $document_name = escapeSql($_POST['document_name']); + $document_description = escapeSql($_POST['document_description']); + $document_content_raw = escapeSql($document_name . " " . strip_tags($_POST['document_content'])); // Create document mysqli_query($mysqli, "INSERT INTO documents SET @@ -1199,8 +1199,8 @@ if (isset($_POST['client_upload_document'])) { redirect("post.php?logout"); } - $document_name = sanitizeInput($_POST['document_name']); - $document_description = sanitizeInput($_POST['document_description']); + $document_name = escapeSql($_POST['document_name']); + $document_description = escapeSql($_POST['document_description']); $client_dir = "../uploads/clients/$session_client_id"; // Create client directory if it doesn't exist @@ -1218,10 +1218,10 @@ if (isset($_POST['client_upload_document'])) { if ($file_reference_name = checkFileUpload($_FILES['document_file'], $allowedExtensions)) { $file_tmp_path = $_FILES['document_file']['tmp_name']; - $file_name = sanitizeInput($_FILES['document_file']['name']); + $file_name = escapeSql($_FILES['document_file']['name']); $extParts = explode('.', $file_name); $file_extension = strtolower(end($extParts)); - $file_mime_type = sanitizeInput($_FILES['document_file']['type']); + $file_mime_type = escapeSql($_FILES['document_file']['type']); $file_size = intval($_FILES['document_file']['size']); // Define destination path and move the uploaded file diff --git a/client/saved_payment_methods.php b/client/saved_payment_methods.php index 10205995..700a246a 100644 --- a/client/saved_payment_methods.php +++ b/client/saved_payment_methods.php @@ -36,7 +36,7 @@ $stripe_customer_query = mysqli_query($mysqli, " LIMIT 1 "); $stripe_customer = mysqli_fetch_assoc($stripe_customer_query); -$stripe_customer_id = $stripe_customer ? sanitizeInput($stripe_customer['payment_provider_client']) : null; +$stripe_customer_id = $stripe_customer ? escapeSql($stripe_customer['payment_provider_client']) : null; // Get saved payment methods $saved_methods_query = mysqli_query($mysqli, " diff --git a/client/ticket_add.php b/client/ticket_add.php index c2bc0e0b..0c0e0ebc 100644 --- a/client/ticket_add.php +++ b/client/ticket_add.php @@ -92,8 +92,8 @@ $sql_assets = mysqli_query($mysqli, "SELECT asset_id, asset_name, asset_type FRO while ($row = mysqli_fetch_assoc($sql_assets)) { $asset_id = intval($row['asset_id']); - $asset_name = sanitizeInput($row['asset_name']); - $asset_type = sanitizeInput($row['asset_type']); + $asset_name = escapeSql($row['asset_name']); + $asset_type = escapeSql($row['asset_type']); ?> $old_value) { $new_value = $new_certificate_info[$column]; if ($old_value != $new_value && !in_array($column, $ignored_columns)) { - $column = sanitizeInput($column); - $old_value = sanitizeInput($old_value); - $new_value = sanitizeInput($new_value); + $column = escapeSql($column); + $old_value = escapeSql($old_value); + $new_value = escapeSql($new_value); mysqli_query($mysqli,"INSERT INTO certificate_history SET certificate_history_column = '$column', certificate_history_old_value = '$old_value', certificate_history_new_value = '$new_value', certificate_history_certificate_id = $certificate_id"); } } diff --git a/cron/cron.php b/cron/cron.php index f14e9bcd..305a1763 100644 --- a/cron/cron.php +++ b/cron/cron.php @@ -19,43 +19,43 @@ $sql_companies = mysqli_query($mysqli, "SELECT * FROM companies, settings WHERE $row = mysqli_fetch_assoc($sql_companies); // Company Details -$company_name = sanitizeInput($row['company_name']); -$company_phone = sanitizeInput(formatPhoneNumber($row['company_phone'], $row['company_phone_country_code'])); -$company_email = sanitizeInput($row['company_email']); -$company_website = sanitizeInput($row['company_website']); -$company_city = sanitizeInput($row['company_city']); -$company_state = sanitizeInput($row['company_state']); -$company_country = sanitizeInput($row['company_country']); -$company_locale = sanitizeInput($row['company_locale']); -$company_currency = sanitizeInput($row['company_currency']); +$company_name = escapeSql($row['company_name']); +$company_phone = escapeSql(formatPhoneNumber($row['company_phone'], $row['company_phone_country_code'])); +$company_email = escapeSql($row['company_email']); +$company_website = escapeSql($row['company_website']); +$company_city = escapeSql($row['company_city']); +$company_state = escapeSql($row['company_state']); +$company_country = escapeSql($row['company_country']); +$company_locale = escapeSql($row['company_locale']); +$company_currency = escapeSql($row['company_currency']); // Company Settings $config_enable_cron = intval($row['config_enable_cron']); $config_invoice_overdue_reminders = $row['config_invoice_overdue_reminders']; -$config_invoice_prefix = sanitizeInput($row['config_invoice_prefix']); -$config_invoice_from_email = sanitizeInput($row['config_invoice_from_email']); -$config_invoice_from_name = sanitizeInput($row['config_invoice_from_name']); +$config_invoice_prefix = escapeSql($row['config_invoice_prefix']); +$config_invoice_from_email = escapeSql($row['config_invoice_from_email']); +$config_invoice_from_name = escapeSql($row['config_invoice_from_name']); $config_invoice_late_fee_enable = intval($row['config_invoice_late_fee_enable']); $config_invoice_late_fee_percent = floatval($row['config_invoice_late_fee_percent']); // Mail Settings -$config_smtp_provider = sanitizeInput($row['config_smtp_provider']); +$config_smtp_provider = escapeSql($row['config_smtp_provider']); $config_smtp_host = $row['config_smtp_host']; $config_smtp_username = $row['config_smtp_username']; $config_smtp_password = $row['config_smtp_password']; $config_smtp_port = intval($row['config_smtp_port']); $config_smtp_encryption = $row['config_smtp_encryption']; -$config_mail_from_email = sanitizeInput($row['config_mail_from_email']); -$config_mail_from_name = sanitizeInput($row['config_mail_from_name']); +$config_mail_from_email = escapeSql($row['config_mail_from_email']); +$config_mail_from_name = escapeSql($row['config_mail_from_name']); $config_recurring_auto_send_invoice = intval($row['config_recurring_auto_send_invoice']); // Tickets -$config_ticket_prefix = sanitizeInput($row['config_ticket_prefix']); -$config_ticket_from_name = sanitizeInput($row['config_ticket_from_name']); -$config_ticket_from_email = sanitizeInput($row['config_ticket_from_email']); +$config_ticket_prefix = escapeSql($row['config_ticket_prefix']); +$config_ticket_from_name = escapeSql($row['config_ticket_from_name']); +$config_ticket_from_email = escapeSql($row['config_ticket_from_email']); $config_ticket_client_general_notifications = intval($row['config_ticket_client_general_notifications']); $config_ticket_autoclose_hours = intval($row['config_ticket_autoclose_hours']); -$config_ticket_new_ticket_notification_email = sanitizeInput($row['config_ticket_new_ticket_notification_email']); +$config_ticket_new_ticket_notification_email = escapeSql($row['config_ticket_new_ticket_notification_email']); // Get Config for Telemetry $config_theme = $row['config_theme']; @@ -186,10 +186,10 @@ if ($config_enable_alert_domain_expire == 1) { while ($row = mysqli_fetch_assoc($sql)) { $domain_id = intval($row['domain_id']); - $domain_name = sanitizeInput($row['domain_name']); - $domain_expire = sanitizeInput($row['domain_expire']); + $domain_name = escapeSql($row['domain_name']); + $domain_expire = escapeSql($row['domain_expire']); $client_id = intval($row['client_id']); - $client_name = sanitizeInput($row['client_name']); + $client_name = escapeSql($row['client_name']); appNotify("Domain Expiring", "Domain $domain_name for $client_name will expire in $day Days on $domain_expire", "/agent/domains.php?client_id=$client_id", $client_id); @@ -216,12 +216,12 @@ foreach ($certificateAlertArray as $day) { while ($row = mysqli_fetch_assoc($sql)) { $certificate_id = intval($row['certificate_id']); - $certificate_name = sanitizeInput($row['certificate_name']); - $certificate_domain = sanitizeInput($row['certificate_domain']); - $certificate_expire = sanitizeInput($row['certificate_expire']); + $certificate_name = escapeSql($row['certificate_name']); + $certificate_domain = escapeSql($row['certificate_domain']); + $certificate_expire = escapeSql($row['certificate_expire']); $certificate_public_key = $row['certificate_public_key']; // Sanitize input breaks parsing $client_id = intval($row['client_id']); - $client_name = sanitizeInput($row['client_name']); + $client_name = escapeSql($row['client_name']); // Calculate the validity period if (!empty($certificate_public_key)) { @@ -266,10 +266,10 @@ foreach ($warranty_alert_array as $day) { while ($row = mysqli_fetch_assoc($sql)) { $asset_id = intval($row['asset_id']); - $asset_name = sanitizeInput($row['asset_name']); - $asset_warranty_expire = sanitizeInput($row['asset_warranty_expire']); + $asset_name = escapeSql($row['asset_name']); + $asset_warranty_expire = escapeSql($row['asset_warranty_expire']); $client_id = intval($row['client_id']); - $client_name = sanitizeInput($row['client_name']); + $client_name = escapeSql($row['client_name']); appNotify("Asset Warranty Expiring", "Asset $asset_name warranty for $client_name will expire in $day Days on $asset_warranty_expire", "/agent/assets.php?client_id=$client_id", $client_id); @@ -302,10 +302,10 @@ if (mysqli_num_rows($sql_recurring_tickets) > 0) { while ($row = mysqli_fetch_assoc($sql_recurring_tickets)) { $recurring_ticket_id = intval($row['recurring_ticket_id']); - $subject = sanitizeInput($row['recurring_ticket_subject']); + $subject = escapeSql($row['recurring_ticket_subject']); $details = mysqli_real_escape_string($mysqli, $row['recurring_ticket_details']); - $priority = sanitizeInput($row['recurring_ticket_priority']); - $frequency = sanitizeInput(strtolower($row['recurring_ticket_frequency'])); + $priority = escapeSql($row['recurring_ticket_priority']); + $frequency = escapeSql(strtolower($row['recurring_ticket_frequency'])); $billable = intval($row['recurring_ticket_billable']); $created_id = intval($row['recurring_ticket_created_by']); $assigned_id = intval($row['recurring_ticket_assigned_to']); @@ -363,15 +363,15 @@ if (mysqli_num_rows($sql_recurring_tickets) > 0) { ); $row = mysqli_fetch_assoc($sql); - $contact_name = sanitizeInput($row['contact_name']); - $contact_email = sanitizeInput($row['contact_email']); - $client_name = sanitizeInput($row['client_name']); - $contact_name = sanitizeInput($row['contact_name']); - $contact_email = sanitizeInput($row['contact_email']); - $ticket_prefix = sanitizeInput($row['ticket_prefix']); + $contact_name = escapeSql($row['contact_name']); + $contact_email = escapeSql($row['contact_email']); + $client_name = escapeSql($row['client_name']); + $contact_name = escapeSql($row['contact_name']); + $contact_email = escapeSql($row['contact_email']); + $ticket_prefix = escapeSql($row['ticket_prefix']); $ticket_number = intval($row['ticket_number']); - $ticket_priority = sanitizeInput($row['ticket_priority']); - $ticket_subject = sanitizeInput($row['ticket_subject']); + $ticket_priority = escapeSql($row['ticket_priority']); + $ticket_subject = escapeSql($row['ticket_subject']); $ticket_details = mysqli_real_escape_string($mysqli, $row['ticket_details']); $data = []; @@ -450,7 +450,7 @@ if (mysqli_num_rows($sql_recurring_tickets) > 0) { // Flag any active recurring "next run" dates that are in the past $sql_invalid_recurring_tickets = mysqli_query($mysqli, "SELECT * FROM recurring_tickets WHERE recurring_ticket_next_run < CURDATE()"); while ($row = mysqli_fetch_assoc($sql_invalid_recurring_tickets)) { - $subject = sanitizeInput($row['recurring_ticket_subject']); + $subject = escapeSql($row['recurring_ticket_subject']); appNotify("Ticket", "Recurring ticket $subject next run date is in the past!", "/agent/recurring_tickets.php"); } @@ -471,11 +471,11 @@ $sql_resolved_tickets_to_close = mysqli_query( while ($row = mysqli_fetch_assoc($sql_resolved_tickets_to_close)) { $ticket_id = $row['ticket_id']; - $ticket_prefix = sanitizeInput($row['ticket_prefix']); + $ticket_prefix = escapeSql($row['ticket_prefix']); $ticket_number = intval($row['ticket_number']); - $ticket_subject = sanitizeInput($row['ticket_subject']); - $ticket_status = sanitizeInput($row['ticket_status']); - $ticket_assigned_to = sanitizeInput($row['ticket_assigned_to']); + $ticket_subject = escapeSql($row['ticket_subject']); + $ticket_status = escapeSql($row['ticket_status']); + $ticket_assigned_to = escapeSql($row['ticket_assigned_to']); $client_id = intval($row['ticket_client_id']); mysqli_query($mysqli,"UPDATE tickets SET ticket_status = 5, ticket_closed_at = NOW(), ticket_closed_by = $ticket_assigned_to WHERE ticket_id = $ticket_id"); @@ -511,18 +511,18 @@ if ($config_send_invoice_reminders == 1) { while ($row = mysqli_fetch_assoc($sql)) { $invoice_id = intval($row['invoice_id']); - $invoice_prefix = sanitizeInput($row['invoice_prefix']); + $invoice_prefix = escapeSql($row['invoice_prefix']); $invoice_number = intval($row['invoice_number']); - $invoice_status = sanitizeInput($row['invoice_status']); - $invoice_date = sanitizeInput($row['invoice_date']); - $invoice_due = sanitizeInput($row['invoice_due']); - $invoice_url_key = sanitizeInput($row['invoice_url_key']); + $invoice_status = escapeSql($row['invoice_status']); + $invoice_date = escapeSql($row['invoice_date']); + $invoice_due = escapeSql($row['invoice_due']); + $invoice_url_key = escapeSql($row['invoice_url_key']); $invoice_amount = floatval($row['invoice_amount']); - $invoice_currency_code = sanitizeInput($row['invoice_currency_code']); + $invoice_currency_code = escapeSql($row['invoice_currency_code']); $client_id = intval($row['client_id']); - $client_name = sanitizeInput($row['client_name']); - $contact_name = sanitizeInput($row['contact_name']); - $contact_email = sanitizeInput($row['contact_email']); + $client_name = escapeSql($row['client_name']); + $contact_name = escapeSql($row['contact_name']); + $contact_email = escapeSql($row['contact_email']); // Sum payments already applied, derive the real balance owed $sql_paid = mysqli_query($mysqli, "SELECT SUM(payment_amount) AS amount_paid FROM payments WHERE payment_invoice_id = $invoice_id"); @@ -610,24 +610,24 @@ $sql_recurring_invoices = mysqli_query($mysqli, "SELECT * FROM recurring_invoice while ($row = mysqli_fetch_assoc($sql_recurring_invoices)) { $recurring_invoice_id = intval($row['recurring_invoice_id']); - $recurring_invoice_scope = sanitizeInput($row['recurring_invoice_scope']); - $recurring_invoice_frequency = sanitizeInput($row['recurring_invoice_frequency']); - $recurring_invoice_status = sanitizeInput($row['recurring_invoice_status']); - $recurring_invoice_last_sent = sanitizeInput($row['recurring_invoice_last_sent']); - $recurring_invoice_next_date = sanitizeInput($row['recurring_invoice_next_date']); + $recurring_invoice_scope = escapeSql($row['recurring_invoice_scope']); + $recurring_invoice_frequency = escapeSql($row['recurring_invoice_frequency']); + $recurring_invoice_status = escapeSql($row['recurring_invoice_status']); + $recurring_invoice_last_sent = escapeSql($row['recurring_invoice_last_sent']); + $recurring_invoice_next_date = escapeSql($row['recurring_invoice_next_date']); $recurring_invoice_discount_amount = floatval($row['recurring_invoice_discount_amount']); $recurring_invoice_amount = floatval($row['recurring_invoice_amount']); - $recurring_invoice_currency_code = sanitizeInput($row['recurring_invoice_currency_code']); - $recurring_invoice_note = sanitizeInput($row['recurring_invoice_note']); + $recurring_invoice_currency_code = escapeSql($row['recurring_invoice_currency_code']); + $recurring_invoice_note = escapeSql($row['recurring_invoice_note']); $recurring_invoice_email_notify = intval($row['recurring_invoice_email_notify']); $category_id = intval($row['recurring_invoice_category_id']); $client_id = intval($row['recurring_invoice_client_id']); - $client_name = sanitizeInput($row['client_name']); + $client_name = escapeSql($row['client_name']); $client_net_terms = intval($row['client_net_terms']); $recurring_payment_recurring_invoice_id = intval($row['recurring_payment_recurring_invoice_id']); - $recurring_payment_currency_code = sanitizeInput($row['recurring_payment_currency_code']); - $recurring_payment_method = sanitizeInput($row['recurring_payment_method']); + $recurring_payment_currency_code = escapeSql($row['recurring_payment_currency_code']); + $recurring_payment_method = escapeSql($row['recurring_payment_method']); $recurring_payment_account_id = intval($row['recurring_payment_account_id']); // Atomically increment and get the new invoice number @@ -653,8 +653,8 @@ while ($row = mysqli_fetch_assoc($sql_recurring_invoices)) { while ($row = mysqli_fetch_assoc($sql_invoice_items)) { $item_id = intval($row['item_id']); - $item_name = sanitizeInput($row['item_name']); //SQL Escape incase of , - $item_description = sanitizeInput($row['item_description']); //SQL Escape incase of , + $item_name = escapeSql($row['item_name']); //SQL Escape incase of , + $item_description = escapeSql($row['item_description']); //SQL Escape incase of , $item_quantity = floatval($row['item_quantity']); $item_price = floatval($row['item_price']); $item_subtotal = floatval($row['item_subtotal']); @@ -687,17 +687,17 @@ while ($row = mysqli_fetch_assoc($sql_recurring_invoices)) { WHERE invoice_id = $new_invoice_id" ); $row = mysqli_fetch_assoc($sql); - $invoice_prefix = sanitizeInput($row['invoice_prefix']); + $invoice_prefix = escapeSql($row['invoice_prefix']); $invoice_number = intval($row['invoice_number']); - $invoice_scope = sanitizeInput($row['invoice_scope']); - $invoice_date = sanitizeInput($row['invoice_date']); - $invoice_due = sanitizeInput($row['invoice_due']); + $invoice_scope = escapeSql($row['invoice_scope']); + $invoice_date = escapeSql($row['invoice_date']); + $invoice_due = escapeSql($row['invoice_due']); $invoice_amount = floatval($row['invoice_amount']); - $invoice_url_key = sanitizeInput($row['invoice_url_key']); + $invoice_url_key = escapeSql($row['invoice_url_key']); $client_id = intval($row['client_id']); - $client_name = sanitizeInput($row['client_name']); - $contact_name = sanitizeInput($row['contact_name']); - $contact_email = sanitizeInput($row['contact_email']); + $client_name = escapeSql($row['client_name']); + $contact_name = escapeSql($row['contact_name']); + $contact_email = escapeSql($row['contact_email']); if ($config_recurring_auto_send_invoice == 1 && $recurring_invoice_email_notify == 1) { @@ -737,8 +737,8 @@ while ($row = mysqli_fetch_assoc($sql_recurring_invoices)) { ); while ($billing_contact = mysqli_fetch_assoc($sql_billing_contacts)) { - $billing_contact_name = sanitizeInput($billing_contact['contact_name']); - $billing_contact_email = sanitizeInput($billing_contact['contact_email']); + $billing_contact_name = escapeSql($billing_contact['contact_name']); + $billing_contact_email = escapeSql($billing_contact['contact_email']); $data = [ [ @@ -761,7 +761,7 @@ while ($row = mysqli_fetch_assoc($sql_recurring_invoices)) { // Start Flag any active recurring "next run" dates that are in the past $sql_invalid_recurring_invoices = mysqli_query($mysqli, "SELECT * FROM recurring_invoices WHERE recurring_invoice_next_date < CURDATE() AND recurring_invoice_status = 1"); while ($row = mysqli_fetch_assoc($sql_invalid_recurring_invoices)) { - $invoice_prefix = sanitizeInput($row['recurring_invoice_prefix']); + $invoice_prefix = escapeSql($row['recurring_invoice_prefix']); $invoice_number = intval($row['recurring_invoice_number']); appNotify("Invoice", "Recurring invoice $invoice_prefix$invoice_number next run date is in the past!", "/agent/recurring_invoices.php"); } @@ -780,22 +780,22 @@ $sql_recurring_payments = mysqli_query($mysqli, " while ($row = mysqli_fetch_assoc($sql_recurring_payments)) { $invoice_id = intval($row['invoice_id']); - $invoice_prefix = sanitizeInput($row['invoice_prefix']); + $invoice_prefix = escapeSql($row['invoice_prefix']); $invoice_number = intval($row['invoice_number']); - $invoice_scope = sanitizeInput($row['invoice_scope']); - $invoice_date = sanitizeInput($row['invoice_date']); - $invoice_due = sanitizeInput($row['invoice_due']); + $invoice_scope = escapeSql($row['invoice_scope']); + $invoice_date = escapeSql($row['invoice_date']); + $invoice_due = escapeSql($row['invoice_due']); $invoice_amount = floatval($row['invoice_amount']); - $invoice_url_key = sanitizeInput($row['invoice_url_key']); - $invoice_currency_code = sanitizeInput($row['invoice_currency_code']); + $invoice_url_key = escapeSql($row['invoice_url_key']); + $invoice_currency_code = escapeSql($row['invoice_currency_code']); $recurring_payment_account_id = intval($row['recurring_payment_account_id']); - $recurring_payment_method = sanitizeInput($row['recurring_payment_method']); - $recurring_payment_currency_code = sanitizeInput($row['recurring_payment_currency_code']); + $recurring_payment_method = escapeSql($row['recurring_payment_method']); + $recurring_payment_currency_code = escapeSql($row['recurring_payment_currency_code']); $recurring_payment_saved_payment_id = intval($row['recurring_payment_saved_payment_id']); $client_id = intval($row['client_id']); - $client_name = sanitizeInput($row['client_name']); - $contact_name = sanitizeInput($row['contact_name']); - $contact_email = sanitizeInput($row['contact_email']); + $client_name = escapeSql($row['client_name']); + $contact_name = escapeSql($row['contact_name']); + $contact_email = escapeSql($row['contact_email']); // Only attempt autopay if a saved payment method is set if ($recurring_payment_saved_payment_id) { @@ -815,14 +815,14 @@ while ($row = mysqli_fetch_assoc($sql_recurring_payments)) { } $provider_id = intval($saved_payment['payment_provider_id']); - $provider_name = sanitizeInput($saved_payment['payment_provider_name']); + $provider_name = escapeSql($saved_payment['payment_provider_name']); $provider_private_key = $saved_payment['payment_provider_private_key']; $account_id = intval($saved_payment['payment_provider_account']); $expense_category_id = intval($saved_payment['payment_provider_expense_category']); $expense_vendor_id = intval($saved_payment['payment_provider_expense_vendor']); $expense_percentage_fee = floatval($saved_payment['payment_provider_expense_percentage_fee']); $expense_flat_fee = floatval($saved_payment['payment_provider_expense_flat_fee']); - $saved_payment_description = sanitizeInput($saved_payment['saved_payment_description']); + $saved_payment_description = escapeSql($saved_payment['saved_payment_description']); $stripe_payment_method_id = $saved_payment['saved_payment_provider_method']; // NEW: Get the payment_provider_client (Stripe Customer ID) from client_payment_provider @@ -833,7 +833,7 @@ while ($row = mysqli_fetch_assoc($sql_recurring_payments)) { LIMIT 1 "); $cpp_row = mysqli_fetch_assoc($cpp_query); - $stripe_customer_id = $cpp_row ? sanitizeInput($cpp_row['payment_provider_client']) : ''; + $stripe_customer_id = $cpp_row ? escapeSql($cpp_row['payment_provider_client']) : ''; // Stripe if ($provider_name === "Stripe") { @@ -861,10 +861,10 @@ while ($row = mysqli_fetch_assoc($sql_recurring_payments)) { ] ]); - $pi_id = sanitizeInput($payment_intent->id); + $pi_id = escapeSql($payment_intent->id); $pi_date = date('Y-m-d', $payment_intent->created); $pi_amount_paid = floatval($payment_intent->amount_received / 100); - $pi_currency = strtoupper(sanitizeInput($payment_intent->currency)); + $pi_currency = strtoupper(escapeSql($payment_intent->currency)); $pi_livemode = $payment_intent->livemode; } catch (Exception $e) { @@ -957,11 +957,11 @@ while ($row = mysqli_fetch_assoc($sql_recurring_expenses)) { $recurring_expense_frequency = intval($row['recurring_expense_frequency']); $recurring_expense_month = intval($row['recurring_expense_month']); $recurring_expense_day = intval($row['recurring_expense_day']); - $recurring_expense_description = sanitizeInput($row['recurring_expense_description']); + $recurring_expense_description = escapeSql($row['recurring_expense_description']); $recurring_expense_amount = floatval($row['recurring_expense_amount']); - $recurring_expense_payment_method = sanitizeInput($row['recurring_expense_payment_method']); - $recurring_expense_reference = sanitizeInput($row['recurring_expense_reference']); - $recurring_expense_currency_code = sanitizeInput($row['recurring_expense_currency_code']); + $recurring_expense_payment_method = escapeSql($row['recurring_expense_payment_method']); + $recurring_expense_reference = escapeSql($row['recurring_expense_reference']); + $recurring_expense_currency_code = escapeSql($row['recurring_expense_currency_code']); $recurring_expense_vendor_id = intval($row['recurring_expense_vendor_id']); $recurring_expense_category_id = intval($row['recurring_expense_category_id']); $recurring_expense_account_id = intval($row['recurring_expense_account_id']); @@ -993,7 +993,7 @@ while ($row = mysqli_fetch_assoc($sql_recurring_expenses)) { // Flag any active recurring "next run" dates that are in the past $sql_invalid_recurring_expenses = mysqli_query($mysqli, "SELECT * FROM recurring_expenses WHERE recurring_expense_next_date < CURDATE() AND recurring_expense_status = 1"); while ($row = mysqli_fetch_assoc($sql_invalid_recurring_expenses)) { - $recurring_expense_description = sanitizeInput($row['recurring_expense_description']); + $recurring_expense_description = escapeSql($row['recurring_expense_description']); appNotify("Expense", "Recurring expense $recurring_expense_description next run date is in the past!", "/agent/recurring_expenses.php"); } diff --git a/cron/domain_refresher.php b/cron/domain_refresher.php index 93fa7043..93ea62ee 100644 --- a/cron/domain_refresher.php +++ b/cron/domain_refresher.php @@ -41,8 +41,8 @@ if ($row) { // Get current data in database $domain_id = intval($row['domain_id']); - $domain_name = sanitizeInput($row['domain_name']); - $current_expire = sanitizeInput($row['domain_expire']); + $domain_name = escapeSql($row['domain_name']); + $current_expire = escapeSql($row['domain_expire']); // Touch the record we're refreshing to ensure we don't loop mysqli_query($mysqli, "UPDATE domains SET domain_updated_at = NOW() WHERE domain_id = $domain_id"); @@ -50,11 +50,11 @@ if ($row) { // Lookup fresh info $expire = getDomainExpirationDate($domain_name); $records = getDomainRecords($domain_name); - $a = sanitizeInput($records['a']); - $ns = sanitizeInput($records['ns']); - $mx = sanitizeInput($records['mx']); - $txt = sanitizeInput($records['txt']); - $whois = sanitizeInput($records['whois']); + $a = escapeSql($records['a']); + $ns = escapeSql($records['ns']); + $mx = escapeSql($records['mx']); + $txt = escapeSql($records['txt']); + $whois = escapeSql($records['whois']); // Handle expiry date if (strtotime($expire)) { @@ -108,9 +108,9 @@ if ($row) { foreach ($original_domain_info as $column => $old_value) { $new_value = $new_domain_info[$column]; if ($old_value != $new_value && !in_array($column, $ignored_columns)) { - $column = sanitizeInput($column); - $old_value = sanitizeInput($old_value); - $new_value = sanitizeInput($new_value); + $column = escapeSql($column); + $old_value = escapeSql($old_value); + $new_value = escapeSql($new_value); mysqli_query($mysqli,"INSERT INTO domain_history SET domain_history_column = '$column', domain_history_old_value = '$old_value', domain_history_new_value = '$new_value', domain_history_domain_id = $domain_id"); } } diff --git a/cron/mail_queue.php b/cron/mail_queue.php index 41cb0ffe..112935aa 100644 --- a/cron/mail_queue.php +++ b/cron/mail_queue.php @@ -319,7 +319,7 @@ if (mysqli_num_rows($sql_queue) > 0) { // Check sender if (!filter_var($email_from, FILTER_VALIDATE_EMAIL)) { - $email_from_logging = sanitizeInput($rowq['email_from']); + $email_from_logging = escapeSql($rowq['email_from']); mysqli_query($mysqli, "UPDATE email_queue SET email_status = 2, email_attempts = 99 WHERE email_id = $email_id"); logApp("Cron-Mail-Queue", "Error", "Failed to send email #$email_id due to invalid sender address: $email_from_logging - check configuration in settings."); appNotify("Mail", "Failed to send email #$email_id due to invalid sender address"); @@ -331,19 +331,19 @@ if (mysqli_num_rows($sql_queue) > 0) { // Basic recipient syntax check if (!filter_var($email_recipient, FILTER_VALIDATE_EMAIL)) { mysqli_query($mysqli, "UPDATE email_queue SET email_status = 2, email_attempts = 99 WHERE email_id = $email_id"); - $email_to_logging = sanitizeInput($email_recipient); - $email_subject_logging = sanitizeInput($rowq['email_subject']); + $email_to_logging = escapeSql($email_recipient); + $email_subject_logging = escapeSql($rowq['email_subject']); logApp("Cron-Mail-Queue", "Error", "Failed to send email: $email_id to $email_to_logging due to invalid recipient address. Email subject was: $email_subject_logging"); appNotify("Mail", "Failed to send email #$email_id to $email_to_logging due to invalid recipient address: Email subject was: $email_subject_logging"); continue; } // More intelligent recipient MX check (if not disabled with --no-mx-validation) - $domain = sanitizeInput(substr($email_recipient, strpos($email_recipient, '@') + 1)); + $domain = escapeSql(substr($email_recipient, strpos($email_recipient, '@') + 1)); if (!in_array('--no-mx-validation', $argv) && !checkdnsrr($domain, 'MX')) { mysqli_query($mysqli, "UPDATE email_queue SET email_status = 2, email_attempts = 99 WHERE email_id = $email_id"); - $email_to_logging = sanitizeInput($email_recipient); - $email_subject_logging = sanitizeInput($rowq['email_subject']); + $email_to_logging = escapeSql($email_recipient); + $email_subject_logging = escapeSql($rowq['email_subject']); logApp("Cron-Mail-Queue", "Error", "Failed to send email: $email_id to $email_to_logging due to invalid recipient domain (no MX). Email subject was: $email_subject_logging"); appNotify("Mail", "Failed to send email #$email_id to $email_to_logging due to invalid recipient domain (no MX): Email subject was: $email_subject_logging"); continue; @@ -377,8 +377,8 @@ if (mysqli_num_rows($sql_queue) > 0) { } catch (Exception $e) { mysqli_query($mysqli, "UPDATE email_queue SET email_status = 2, email_failed_at = NOW(), email_attempts = 1 WHERE email_id = $email_id"); - $email_recipient_logging = sanitizeInput($rowq['email_recipient']); - $email_subject_logging = sanitizeInput($rowq['email_subject']); + $email_recipient_logging = escapeSql($rowq['email_recipient']); + $email_subject_logging = escapeSql($rowq['email_subject']); $err = substr("Mailer Error: " . $e->getMessage(), 0, 100) . "..."; appNotify("Cron-Mail-Queue", "Failed to send email #$email_id to $email_recipient_logging"); @@ -447,8 +447,8 @@ if (mysqli_num_rows($sql_failed_queue) > 0) { } catch (Exception $e) { mysqli_query($mysqli, "UPDATE email_queue SET email_status = 2, email_failed_at = NOW(), email_attempts = $email_attempts WHERE email_id = $email_id"); - $email_recipient_logging = sanitizeInput($rowf['email_recipient']); - $email_subject_logging = sanitizeInput($rowf['email_subject']); + $email_recipient_logging = escapeSql($rowf['email_recipient']); + $email_subject_logging = escapeSql($rowf['email_subject']); $err = substr("Mailer Error: " . $e->getMessage(), 0, 100) . "..."; logApp("Cron-Mail-Queue", "Error", "Failed to re-send email #$email_id to $email_recipient_logging regarding $email_subject_logging. $err"); diff --git a/cron/ticket_email_parser.php b/cron/ticket_email_parser.php index 07c2338d..484ab8d8 100644 --- a/cron/ticket_email_parser.php +++ b/cron/ticket_email_parser.php @@ -28,15 +28,15 @@ require_once "../functions.php"; // Get settings for the "default" company require_once "../includes/load_global_settings.php"; -$config_ticket_prefix = sanitizeInput($config_ticket_prefix); -$config_ticket_from_name = sanitizeInput($config_ticket_from_name); +$config_ticket_prefix = escapeSql($config_ticket_prefix); +$config_ticket_from_name = escapeSql($config_ticket_from_name); $config_ticket_email_parse_unknown_senders = intval($row['config_ticket_email_parse_unknown_senders']); // Get company name & phone & timezone $sql = mysqli_query($mysqli, "SELECT * FROM companies, settings WHERE companies.company_id = settings.company_id AND companies.company_id = 1"); $row = mysqli_fetch_assoc($sql); -$company_name = sanitizeInput($row['company_name']); -$company_phone = sanitizeInput(formatPhoneNumber($row['company_phone'], $row['company_phone_country_code'])); +$company_name = escapeSql($row['company_name']); +$company_phone = escapeSql(formatPhoneNumber($row['company_phone'], $row['company_phone_country_code'])); // Check setting enabled if ($config_ticket_email_parse == 0) { @@ -143,8 +143,8 @@ function addTicket($contact_id, $contact_name, $contact_email, $client_id, $date $att_saved_path = $att_dir . $att_saved_filename; file_put_contents($att_saved_path, $attachment['content']); - $ticket_attachment_name = sanitizeInput($att_name); - $ticket_attachment_reference_name = sanitizeInput($att_saved_filename); + $ticket_attachment_name = escapeSql($att_name); + $ticket_attachment_reference_name = escapeSql($att_saved_filename); $ticket_attachment_name_esc = mysqli_real_escape_string($mysqli, $ticket_attachment_name); $ticket_attachment_reference_name_esc = mysqli_real_escape_string($mysqli, $ticket_attachment_reference_name); @@ -191,7 +191,7 @@ function addTicket($contact_id, $contact_name, $contact_email, $client_id, $date } else { $client_sql = mysqli_query($mysqli, "SELECT client_name FROM clients WHERE client_id = $client_id"); $client_row = mysqli_fetch_assoc($client_sql); - $client_name = sanitizeInput($client_row['client_name']); + $client_name = escapeSql($client_row['client_name']); $client_uri = "&client_id=$client_id"; } $email_subject = "$config_app_name - New Ticket - $client_name: $subject"; @@ -260,17 +260,17 @@ function addReply($from_email, $date, $subject, $ticket_number, $message, $attac if ($row) { $ticket_id = intval($row['ticket_id']); - $ticket_subject = sanitizeInput($row['ticket_subject']); - $ticket_status = sanitizeInput($row['ticket_status']); + $ticket_subject = escapeSql($row['ticket_subject']); + $ticket_status = escapeSql($row['ticket_status']); $ticket_reply_contact = intval($row['ticket_contact_id']); - $ticket_contact_email = sanitizeInput($row['contact_email']); + $ticket_contact_email = escapeSql($row['contact_email']); $client_id = intval($row['ticket_client_id']); if ($client_id) { $client_uri = "&client_id=$client_id"; } else { $client_uri = ''; } - $client_name = sanitizeInput($row['client_name']); + $client_name = escapeSql($row['client_name']); if ($ticket_status == 5) { $config_ticket_prefix_esc = mysqli_real_escape_string($mysqli, $config_ticket_prefix); @@ -324,8 +324,8 @@ function addReply($from_email, $date, $subject, $ticket_number, $message, $attac $att_saved_path = $ticket_dir . $att_saved_filename; file_put_contents($att_saved_path, $attachment['content']); - $ticket_attachment_name = sanitizeInput($att_name); - $ticket_attachment_reference_name = sanitizeInput($att_saved_filename); + $ticket_attachment_name = escapeSql($att_name); + $ticket_attachment_reference_name = escapeSql($att_saved_filename); $ticket_attachment_name_esc = mysqli_real_escape_string($mysqli, $ticket_attachment_name); $ticket_attachment_reference_name_esc = mysqli_real_escape_string($mysqli, $ticket_attachment_reference_name); @@ -344,8 +344,8 @@ function addReply($from_email, $date, $subject, $ticket_number, $message, $attac if ($ticket_assigned_to) { $tech_sql = mysqli_query($mysqli, "SELECT user_email, user_name FROM users WHERE user_id = $ticket_assigned_to LIMIT 1"); $tech_row = mysqli_fetch_assoc($tech_sql); - $tech_email = sanitizeInput($tech_row['user_email']); - $tech_name = sanitizeInput($tech_row['user_name']); + $tech_email = escapeSql($tech_row['user_email']); + $tech_name = escapeSql($tech_row['user_name']); $email_subject = "$config_app_name - Ticket updated - [$config_ticket_prefix$ticket_number] $ticket_subject"; $email_body = "Hello $tech_name,

A new reply has been added to the below ticket.

Client: $client_name
Ticket: $config_ticket_prefix$ticket_number
Subject: $ticket_subject
Link: https://$config_base_url/agent/ticket.php?ticket_id=$ticket_id$client_uri

--------------------------------
$message_esc"; @@ -686,14 +686,14 @@ foreach ($messages as $message) { // From $from_addr = $message->from(); // ?Address - $from_email = sanitizeInput($from_addr?->email() ?: 'itflow-guest@example.com'); - $from_name = sanitizeInput($from_addr?->name() ?: 'Unknown'); + $from_email = escapeSql($from_addr?->email() ?: 'itflow-guest@example.com'); + $from_name = escapeSql($from_addr?->name() ?: 'Unknown'); $from_domain = explode("@", $from_email); - $from_domain = sanitizeInput(end($from_domain)); + $from_domain = escapeSql(end($from_domain)); // Subject - $subject = sanitizeInput((string)$message->subject() ?: 'No Subject'); + $subject = escapeSql((string)$message->subject() ?: 'No Subject'); // Skip vacation/out-of-office auto-responders to prevent mail loops (RFC 3834) // NDRs use "auto-generated" and are still handled by the NDR logic below @@ -724,7 +724,7 @@ foreach ($messages as $message) { // Date (string) $dateObj = $message->date(); // ?CarbonInterface - $date = sanitizeInput($dateObj ? $dateObj->setTimezone(date_default_timezone_get())->format('Y-m-d H:i:s') : date('Y-m-d H:i:s')); + $date = escapeSql($dateObj ? $dateObj->setTimezone(date_default_timezone_get())->format('Y-m-d H:i:s') : date('Y-m-d H:i:s')); // Body (prefer HTML) $message_body_html = $message->html(); @@ -751,7 +751,7 @@ foreach ($messages as $message) { // Skip oversized attachments entirely if ($size > $max_attachment_bytes) { - logApp("Cron-Email-Parser", "warning", "Email parser skipped oversized attachment " . sanitizeInput($name) . " (" . round($size / 1048576, 1) . " MB) from $from_email ($subject)"); + logApp("Cron-Email-Parser", "warning", "Email parser skipped oversized attachment " . escapeSql($name) . " (" . round($size / 1048576, 1) . " MB) from $from_email ($subject)"); continue; } @@ -831,9 +831,9 @@ foreach ($messages as $message) { $rowc = mysqli_fetch_assoc($any_contact_sql); if ($rowc) { - $contact_name = sanitizeInput($rowc['contact_name']); + $contact_name = escapeSql($rowc['contact_name']); $contact_id = intval($rowc['contact_id']); - $contact_email = sanitizeInput($rowc['contact_email']); + $contact_email = escapeSql($rowc['contact_email']); $client_id = intval($rowc['contact_client_id']); $email_processed = addTicket($contact_id, $contact_name, $contact_email, $client_id, $date, $subject, $message_body, $attachments, $original_message_file, $ccs); @@ -889,15 +889,15 @@ foreach ($messages as $message) { if (strpos($ctype, 'delivery-status') !== false) { if (preg_match('/Final-Recipient:\s*rfc822;\s*(.+)/i', $body, $m)) { - $failed_recipient = sanitizeInput(trim($m[1])); + $failed_recipient = escapeSql(trim($m[1])); } if (preg_match('/Diagnostic-Code:\s*(.+)/i', $body, $m)) { - $diagnostic_code = sanitizeInput(trim($m[1])); + $diagnostic_code = escapeSql(trim($m[1])); } if (preg_match('/Status:\s*([0-9\.]+)/i', $body, $m)) { - $status_code = sanitizeInput(trim($m[1])); + $status_code = escapeSql(trim($m[1])); } } @@ -905,11 +905,11 @@ foreach ($messages as $message) { if (strpos($ctype, 'message/rfc822') !== false) { if (preg_match('/^To:\s*(.+)$/mi', $body, $m)) { - $original_to = sanitizeInput(trim($m[1])); + $original_to = escapeSql(trim($m[1])); } if (preg_match('/^Subject:\s*(.+)$/mi', $body, $m)) { - $original_subject = sanitizeInput(trim($m[1])); + $original_subject = escapeSql(trim($m[1])); } } } @@ -920,7 +920,7 @@ foreach ($messages as $message) { // Exim puts diagnostics on an indented line if (preg_match('/\n\s{2,}(.+)/', $text, $m)) { - $diagnostic_code = sanitizeInput(trim($m[1])); + $diagnostic_code = escapeSql(trim($m[1])); } } diff --git a/functions/app.php b/functions/app.php index f8a60a10..d7af3f79 100644 --- a/functions/app.php +++ b/functions/app.php @@ -160,7 +160,7 @@ function getFieldById($table, $id, $field, $escape_method = 'sql') { if (stripos($columns[$field]['type'], 'int') !== false) { return (int)$value; } else { - return sanitizeInput($value); // Escape for SQL using a custom function + return escapeSql($value); // Escape for SQL using a custom function } } } @@ -271,7 +271,7 @@ function addToMailQueue($data) { // Check if 'email_queued_at' is set and not empty if (isset($email['queued_at']) && !empty($email['queued_at'])) { - $queued_at = "'" . sanitizeInput($email['queued_at']) . "'"; + $queued_at = "'" . escapeSql($email['queued_at']) . "'"; } else { // Use the current date and time if 'email_queued_at' is not set or empty $queued_at = 'CURRENT_TIMESTAMP()'; diff --git a/functions/auth.php b/functions/auth.php index 4ebe43f8..b7f7a897 100644 --- a/functions/auth.php +++ b/functions/auth.php @@ -11,7 +11,7 @@ function lookupUserPermission($module) { return 3; } - $module = sanitizeInput($module); + $module = escapeSql($module); $sql = mysqli_query( $mysqli, diff --git a/functions/sanitize.php b/functions/sanitize.php index bd6e9a05..02fbf757 100644 --- a/functions/sanitize.php +++ b/functions/sanitize.php @@ -9,7 +9,7 @@ function escapeHtml($unsanitizedInput) { return htmlspecialchars($unsanitizedInput ?? '', ENT_QUOTES, 'UTF-8'); } -function sanitizeInput($input) { +function escapeSql($input) { global $mysqli; if (!empty($input)) { diff --git a/guest/guest_ajax.php b/guest/guest_ajax.php index 07076906..2f06b7c5 100644 --- a/guest/guest_ajax.php +++ b/guest/guest_ajax.php @@ -26,7 +26,7 @@ if (isset($_GET['stripe_create_pi'])) { $jsonStr = file_get_contents('php://input'); $jsonObj = json_decode($jsonStr, true); $invoice_id = intval($jsonObj['invoice_id']); - $url_key = sanitizeInput($jsonObj['url_key']); + $url_key = escapeSql($jsonObj['url_key']); // Query invoice details $invoice_sql = mysqli_query( diff --git a/guest/guest_approve_ticket_task.php b/guest/guest_approve_ticket_task.php index 854870cb..8307403c 100644 --- a/guest/guest_approve_ticket_task.php +++ b/guest/guest_approve_ticket_task.php @@ -35,7 +35,7 @@ $company_phone = escapeHtml(formatPhoneNumber($company_sql_row['company_phone'], $company_website = escapeHtml($company_sql_row['company_website']); $approval_id = intval($_GET['task_approval_id']); -$url_key = sanitizeInput($_GET['url_key']); +$url_key = escapeSql($_GET['url_key']); $task_row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT * FROM task_approvals diff --git a/guest/guest_download_file.php b/guest/guest_download_file.php index fab2260e..2a5f043b 100644 --- a/guest/guest_download_file.php +++ b/guest/guest_download_file.php @@ -8,18 +8,18 @@ require_once "../includes/inc_set_timezone.php"; require_once "../functions.php"; -$session_ip = sanitizeInput(getIP()); -$session_user_agent = sanitizeInput($_SERVER['HTTP_USER_AGENT']); +$session_ip = escapeSql(getIP()); +$session_user_agent = escapeSql($_SERVER['HTTP_USER_AGENT']); if (isset($_GET['id']) && isset($_GET['key'])) { $item_id = intval($_GET['id']); - $item_key = sanitizeInput($_GET['key']); + $item_key = escapeSql($_GET['key']); $sql = mysqli_query($mysqli, "SELECT * FROM shared_items WHERE item_id = $item_id AND item_key = '$item_key' AND item_expire_at > NOW() LIMIT 1"); $row = mysqli_fetch_assoc($sql); $item_active = intval($row['item_active']); - $item_type = sanitizeInput($row['item_type']); + $item_type = escapeSql($row['item_type']); $item_views = intval($row['item_views']); $item_view_limit = intval($row['item_view_limit']); $item_related_id = intval($row['item_related_id']); @@ -56,8 +56,8 @@ if (isset($_GET['id']) && isset($_GET['key'])) { exit("Item cannot be viewed at this time (No file, may have been deleted)."); } - $file_name = sanitizeInput($file_row['file_name']); - $file_reference_name = sanitizeInput($file_row['file_reference_name']); + $file_name = escapeSql($file_row['file_name']); + $file_reference_name = escapeSql($file_row['file_reference_name']); $client_id = intval($file_row['file_client_id']); $file_path = "../uploads/clients/$client_id/$file_reference_name"; diff --git a/guest/guest_pay_invoice_stripe.php b/guest/guest_pay_invoice_stripe.php index 6ee062bf..d1a1dd5c 100644 --- a/guest/guest_pay_invoice_stripe.php +++ b/guest/guest_pay_invoice_stripe.php @@ -20,7 +20,7 @@ $stripe_flat_fee = floatval($stripe_provider['payment_provider_expense_f // Show payment form if (isset($_GET['invoice_id'], $_GET['url_key']) && !isset($_GET['payment_intent'])) { - $invoice_url_key = sanitizeInput($_GET['url_key']); + $invoice_url_key = escapeSql($_GET['url_key']); $invoice_id = intval($_GET['invoice_id']); // Query invoice details @@ -158,7 +158,7 @@ if (isset($_GET['invoice_id'], $_GET['url_key']) && !isset($_GET['payment_intent // Payment result processing } elseif (isset($_GET['payment_intent'], $_GET['payment_intent_client_secret'])) { - $pi_id = sanitizeInput($_GET['payment_intent']); + $pi_id = escapeSql($_GET['payment_intent']); $pi_cs = $_GET['payment_intent_client_secret']; require_once '../libs/stripe-php/init.php'; @@ -181,7 +181,7 @@ if (isset($_GET['invoice_id'], $_GET['url_key']) && !isset($_GET['payment_intent $pi_invoice_id = intval($pi_obj->metadata->itflow_invoice_id); $pi_client_id = intval($pi_obj->metadata->itflow_client_id); $pi_amount_paid = floatval(($pi_obj->amount_received / 100)); - $pi_currency = strtoupper(sanitizeInput($pi_obj->currency)); + $pi_currency = strtoupper(escapeSql($pi_obj->currency)); $pi_livemode = $pi_obj->livemode; // Get/Check invoice (& client/primary contact) @@ -201,21 +201,21 @@ if (isset($_GET['invoice_id'], $_GET['url_key']) && !isset($_GET['payment_intent $row = mysqli_fetch_assoc($invoice_sql); $invoice_id = intval($row['invoice_id']); - $invoice_prefix = sanitizeInput($row['invoice_prefix']); + $invoice_prefix = escapeSql($row['invoice_prefix']); $invoice_number = intval($row['invoice_number']); $invoice_amount = floatval($row['invoice_amount']); - $invoice_currency_code = sanitizeInput($row['invoice_currency_code']); - $invoice_url_key = sanitizeInput($row['invoice_url_key']); + $invoice_currency_code = escapeSql($row['invoice_currency_code']); + $invoice_url_key = escapeSql($row['invoice_url_key']); $client_id = intval($row['client_id']); - $client_name = sanitizeInput($row['client_name']); - $contact_name = sanitizeInput($row['contact_name']); - $contact_email = sanitizeInput($row['contact_email']); + $client_name = escapeSql($row['client_name']); + $contact_name = escapeSql($row['contact_name']); + $contact_email = escapeSql($row['contact_email']); $sql_company = mysqli_query($mysqli, "SELECT * FROM companies WHERE company_id = 1"); $row = mysqli_fetch_assoc($sql_company); - $company_name = sanitizeInput($row['company_name']); - $company_phone = sanitizeInput(formatPhoneNumber($row['company_phone'])); - $company_locale = sanitizeInput($row['company_locale']); + $company_name = escapeSql($row['company_name']); + $company_phone = escapeSql(formatPhoneNumber($row['company_phone'])); + $company_locale = escapeSql($row['company_locale']); $currency_format = numfmt_create($company_locale, NumberFormatter::CURRENCY); @@ -257,9 +257,9 @@ if (isset($_GET['invoice_id'], $_GET['url_key']) && !isset($_GET['payment_intent $settings = mysqli_fetch_assoc($sql_settings); $config_smtp_host = $settings['config_smtp_host']; - $config_invoice_from_name = sanitizeInput($settings['config_invoice_from_name']); - $config_invoice_from_email = sanitizeInput($settings['config_invoice_from_email']); - $config_invoice_paid_notification_email = sanitizeInput($settings['config_invoice_paid_notification_email']); + $config_invoice_from_name = escapeSql($settings['config_invoice_from_name']); + $config_invoice_from_email = escapeSql($settings['config_invoice_from_email']); + $config_invoice_paid_notification_email = escapeSql($settings['config_invoice_paid_notification_email']); if (!empty($config_smtp_host)) { $subject = "Payment Received - Invoice $invoice_prefix$invoice_number"; diff --git a/guest/guest_post.php b/guest/guest_post.php index fe8f6194..d8a30b5b 100644 --- a/guest/guest_post.php +++ b/guest/guest_post.php @@ -11,16 +11,16 @@ require_once "../includes/inc_set_timezone.php"; // Must be included after sessi if (isset($_GET['accept_quote'], $_GET['url_key'])) { $quote_id = intval($_GET['accept_quote']); - $url_key = sanitizeInput($_GET['url_key']); + $url_key = escapeSql($_GET['url_key']); // Select only the necessary fields $sql = mysqli_query($mysqli, "SELECT quote_prefix, quote_number, client_name, client_id FROM quotes LEFT JOIN clients ON quote_client_id = client_id WHERE quote_id = $quote_id AND quote_url_key = '$url_key'"); if (mysqli_num_rows($sql) == 1) { $row = mysqli_fetch_assoc($sql); - $quote_prefix = sanitizeInput($row['quote_prefix']); + $quote_prefix = escapeSql($row['quote_prefix']); $quote_number = intval($row['quote_number']); - $client_name = sanitizeInput($row['client_name']); + $client_name = escapeSql($row['client_name']); $client_id = intval($row['client_id']); mysqli_query($mysqli, "UPDATE quotes SET quote_status = 'Accepted' WHERE quote_id = $quote_id"); @@ -34,7 +34,7 @@ if (isset($_GET['accept_quote'], $_GET['url_key'])) { $sql_company = mysqli_query($mysqli, "SELECT company_name FROM companies WHERE company_id = 1"); $row = mysqli_fetch_assoc($sql_company); - $company_name = sanitizeInput($row['company_name']); + $company_name = escapeSql($row['company_name']); $sql_settings = mysqli_query($mysqli, "SELECT * FROM settings WHERE company_id = 1"); $row = mysqli_fetch_assoc($sql_settings); @@ -43,10 +43,10 @@ if (isset($_GET['accept_quote'], $_GET['url_key'])) { $config_smtp_encryption = $row['config_smtp_encryption']; $config_smtp_username = $row['config_smtp_username']; $config_smtp_password = $row['config_smtp_password']; - $config_quote_from_name = sanitizeInput($row['config_quote_from_name']); - $config_quote_from_email = sanitizeInput($row['config_quote_from_email']); - $config_quote_notification_email = sanitizeInput($row['config_quote_notification_email']); - $config_base_url = sanitizeInput($config_base_url); + $config_quote_from_name = escapeSql($row['config_quote_from_name']); + $config_quote_from_email = escapeSql($row['config_quote_from_email']); + $config_quote_notification_email = escapeSql($row['config_quote_notification_email']); + $config_base_url = escapeSql($config_base_url); if (!empty($config_smtp_host) && !empty($config_quote_notification_email)) { $subject = "Quote Accepted - $client_name - Quote $quote_prefix$quote_number"; @@ -76,16 +76,16 @@ if (isset($_GET['accept_quote'], $_GET['url_key'])) { if (isset($_GET['decline_quote'], $_GET['url_key'])) { $quote_id = intval($_GET['decline_quote']); - $url_key = sanitizeInput($_GET['url_key']); + $url_key = escapeSql($_GET['url_key']); // Select only the necessary fields $sql = mysqli_query($mysqli, "SELECT quote_prefix, quote_number, client_name, client_id FROM quotes LEFT JOIN clients ON quote_client_id = client_id WHERE quote_id = $quote_id AND quote_url_key = '$url_key'"); if (mysqli_num_rows($sql) == 1) { $row = mysqli_fetch_assoc($sql); - $quote_prefix = sanitizeInput($row['quote_prefix']); + $quote_prefix = escapeSql($row['quote_prefix']); $quote_number = intval($row['quote_number']); - $client_name = sanitizeInput($row['client_name']); + $client_name = escapeSql($row['client_name']); $client_id = intval($row['client_id']); mysqli_query($mysqli, "UPDATE quotes SET quote_status = 'Declined' WHERE quote_id = $quote_id"); @@ -99,7 +99,7 @@ if (isset($_GET['decline_quote'], $_GET['url_key'])) { $sql_company = mysqli_query($mysqli, "SELECT company_name FROM companies WHERE company_id = 1"); $row = mysqli_fetch_assoc($sql_company); - $company_name = sanitizeInput($row['company_name']); + $company_name = escapeSql($row['company_name']); $sql_settings = mysqli_query($mysqli, "SELECT * FROM settings WHERE company_id = 1"); $row = mysqli_fetch_assoc($sql_settings); @@ -108,10 +108,10 @@ if (isset($_GET['decline_quote'], $_GET['url_key'])) { $config_smtp_encryption = $row['config_smtp_encryption']; $config_smtp_username = $row['config_smtp_username']; $config_smtp_password = $row['config_smtp_password']; - $config_quote_from_name = sanitizeInput($row['config_quote_from_name']); - $config_quote_from_email = sanitizeInput($row['config_quote_from_email']); - $config_quote_notification_email = sanitizeInput($row['config_quote_notification_email']); - $config_base_url = sanitizeInput($config_base_url); + $config_quote_from_name = escapeSql($row['config_quote_from_name']); + $config_quote_from_email = escapeSql($row['config_quote_from_email']); + $config_quote_notification_email = escapeSql($row['config_quote_notification_email']); + $config_base_url = escapeSql($config_base_url); if (!empty($config_smtp_host) && !empty($config_quote_notification_email)) { $subject = "Quote Declined - $client_name - Quote $quote_prefix$quote_number"; @@ -140,7 +140,7 @@ if (isset($_GET['decline_quote'], $_GET['url_key'])) { if (isset($_GET['reopen_ticket'], $_GET['url_key'])) { $ticket_id = intval($_GET['ticket_id']); - $url_key = sanitizeInput($_GET['url_key']); + $url_key = escapeSql($_GET['url_key']); // Select only the necessary fields $sql = mysqli_query($mysqli, "SELECT ticket_id FROM tickets WHERE ticket_id = $ticket_id AND ticket_url_key = '$url_key' AND ticket_resolved_at IS NOT NULL AND ticket_closed_at IS NULL"); @@ -167,7 +167,7 @@ if (isset($_GET['reopen_ticket'], $_GET['url_key'])) { if (isset($_GET['close_ticket'], $_GET['url_key'])) { $ticket_id = intval($_GET['ticket_id']); - $url_key = sanitizeInput($_GET['url_key']); + $url_key = escapeSql($_GET['url_key']); // Select only the necessary fields $sql = mysqli_query($mysqli, "SELECT ticket_id FROM tickets WHERE ticket_id = $ticket_id AND ticket_url_key = '$url_key' AND ticket_resolved_at IS NOT NULL AND ticket_closed_at IS NULL"); @@ -194,8 +194,8 @@ if (isset($_GET['close_ticket'], $_GET['url_key'])) { if (isset($_GET['add_ticket_feedback'], $_GET['url_key'])) { $ticket_id = intval($_GET['ticket_id']); - $url_key = sanitizeInput($_GET['url_key']); - $feedback = sanitizeInput($_GET['feedback']); + $url_key = escapeSql($_GET['url_key']); + $feedback = escapeSql($_GET['feedback']); // Select only the necessary fields $sql = mysqli_query($mysqli, "SELECT ticket_id FROM tickets WHERE ticket_id = $ticket_id AND ticket_url_key = '$url_key' AND ticket_closed_at IS NOT NULL"); @@ -207,7 +207,7 @@ if (isset($_GET['add_ticket_feedback'], $_GET['url_key'])) { // Notify on bad feedback if ($feedback == "Bad") { $ticket_details = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT ticket_prefix, ticket_number FROM tickets WHERE ticket_id = $ticket_id LIMIT 1")); - $ticket_prefix = sanitizeInput($ticket_details['ticket_prefix']); + $ticket_prefix = escapeSql($ticket_details['ticket_prefix']); $ticket_number = intval($ticket_details['ticket_number']); appNotify("Feedback", "Guest rated ticket number $ticket_prefix$ticket_number (ID: $ticket_id) as bad", "/agent/ticket.php?ticket_id=$ticket_id"); @@ -229,7 +229,7 @@ if (isset($_GET['approve_ticket_task'])) { $task_id = intval($_GET['approve_ticket_task']); $approval_id = intval($_GET['approval_id']); - $url_key = sanitizeInput($_GET['approval_url_key']); + $url_key = escapeSql($_GET['approval_url_key']); $approval_row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT * FROM task_approvals LEFT JOIN tasks on task_id = approval_task_id WHERE approval_id = $approval_id AND approval_task_id = $task_id AND approval_url_key = '$url_key' AND approval_status = 'pending'")); @@ -261,7 +261,7 @@ if (isset($_GET['approve_ticket_task'])) { if (isset($_GET['export_quote_pdf'])) { $quote_id = intval($_GET['export_quote_pdf']); - $url_key = sanitizeInput($_GET['url_key']); + $url_key = escapeSql($_GET['url_key']); $sql = mysqli_query( $mysqli, @@ -462,7 +462,7 @@ if (isset($_GET['export_quote_pdf'])) { if (isset($_GET['export_invoice_pdf'])) { $invoice_id = intval($_GET['export_invoice_pdf']); - $url_key = sanitizeInput($_GET['url_key']); + $url_key = escapeSql($_GET['url_key']); $sql = mysqli_query( $mysqli, @@ -691,14 +691,14 @@ if (isset($_GET['export_invoice_pdf'])) { if (isset($_POST['guest_quote_upload_file'])) { $quote_id = intval($_POST['quote_id']); - $url_key = sanitizeInput($_POST['url_key']); + $url_key = escapeSql($_POST['url_key']); // Select only the necessary fields $sql = mysqli_query($mysqli, "SELECT quote_prefix, quote_number, client_id FROM quotes LEFT JOIN clients ON quote_client_id = client_id WHERE quote_id = $quote_id AND quote_url_key = '$url_key'"); if (mysqli_num_rows($sql) == 1) { $row = mysqli_fetch_assoc($sql); - $quote_prefix = sanitizeInput($row['quote_prefix']); + $quote_prefix = escapeSql($row['quote_prefix']); $quote_number = intval($row['quote_number']); $client_id = intval($row['client_id']); @@ -723,12 +723,12 @@ if (isset($_POST['guest_quote_upload_file'])) { $file_tmp_path = $_FILES['file']['tmp_name'][$i]; - $file_name = sanitizeInput($_FILES['file']['name'][$i]); + $file_name = escapeSql($_FILES['file']['name'][$i]); $extarr = explode('.', $_FILES['file']['name'][$i]); - $file_extension = sanitizeInput(strtolower(end($extarr))); + $file_extension = escapeSql(strtolower(end($extarr))); // Extract the file mime type and size - $file_mime_type = sanitizeInput($single_file['type']); + $file_mime_type = escapeSql($single_file['type']); $file_size = intval($single_file['size']); // Define destination file path diff --git a/guest/guest_view_invoice.php b/guest/guest_view_invoice.php index 5f80408c..fe56b549 100644 --- a/guest/guest_view_invoice.php +++ b/guest/guest_view_invoice.php @@ -9,7 +9,7 @@ if (!isset($_GET['invoice_id'], $_GET['url_key'])) { exit(); } -$url_key = sanitizeInput($_GET['url_key']); +$url_key = escapeSql($_GET['url_key']); $invoice_id = intval($_GET['invoice_id']); $sql = mysqli_query( @@ -45,7 +45,7 @@ $invoice_note = escapeHtml($row['invoice_note']); $invoice_category_id = intval($row['invoice_category_id']); $client_id = intval($row['client_id']); $client_name = escapeHtml($row['client_name']); -$client_name_escaped = sanitizeInput($row['client_name']); +$client_name_escaped = escapeSql($row['client_name']); $location_address = escapeHtml($row['location_address']); $location_city = escapeHtml($row['location_city']); $location_state = escapeHtml($row['location_state']); diff --git a/guest/guest_view_item.php b/guest/guest_view_item.php index ba2ededa..5dcb1ccb 100644 --- a/guest/guest_view_item.php +++ b/guest/guest_view_item.php @@ -45,7 +45,7 @@ if (!isset($_GET['id']) || !isset($_GET['key'])) { } $item_id = intval($_GET['id']); -$item_key = sanitizeInput($_GET['key']); +$item_key = escapeSql($_GET['key']); $sql = mysqli_query($mysqli, "SELECT * FROM shared_items WHERE item_id = $item_id AND item_key = '$item_key' AND item_expire_at > NOW() LIMIT 1"); $row = mysqli_fetch_assoc($sql); @@ -80,8 +80,8 @@ $item_expire = date('Y-m-d h:i A', strtotime($row['item_expire_at'])); $client_id = intval($row['item_client_id']); // Create in-app notification -$item_type_sql_escaped = sanitizeInput($row['item_type']); -$item_recipient_sql_escaped = sanitizeInput($row['item_recipient']); +$item_type_sql_escaped = escapeSql($row['item_type']); +$item_recipient_sql_escaped = escapeSql($row['item_recipient']); appNotify("Share Viewed", "$item_type_sql_escaped has been viewed by $item_recipient_sql_escaped", "/agent/client_overview.php?client_id=$client_id", $client_id); @@ -129,7 +129,7 @@ if ($item_type == "Document") { } $doc_title = escapeHtml($doc_row['document_name']); - $doc_title_escaped = sanitizeInput($doc_row['document_name']); + $doc_title_escaped = escapeSql($doc_row['document_name']); $doc_content = $purifier->purify($doc_row['document_content']); echo "

$doc_title

"; @@ -256,7 +256,7 @@ if ($item_type == "Document") { mysqli_query($mysqli, "UPDATE shared_items SET item_views = $new_item_views WHERE item_id = $item_id"); // Logging - $name = sanitizeInput($credential_row['credential_name']); + $name = escapeSql($credential_row['credential_name']); logAction("Share", "View", "Viewed shared $item_type $name via link", $client_id); } diff --git a/guest/guest_view_quote.php b/guest/guest_view_quote.php index bb7bea2b..19e60d71 100644 --- a/guest/guest_view_quote.php +++ b/guest/guest_view_quote.php @@ -11,7 +11,7 @@ if (!isset($_GET['quote_id'], $_GET['url_key'])) { } -$url_key = sanitizeInput($_GET['url_key']); +$url_key = escapeSql($_GET['url_key']); $quote_id = intval($_GET['quote_id']); $sql = mysqli_query( @@ -46,7 +46,7 @@ $quote_currency_code = escapeHtml($row['quote_currency_code']); $quote_note = escapeHtml($row['quote_note']); $client_id = intval($row['client_id']); $client_name = escapeHtml($row['client_name']); -$client_name_escaped = sanitizeInput($row['client_name']); +$client_name_escaped = escapeSql($row['client_name']); $location_address = escapeHtml($row['location_address']); $location_city = escapeHtml($row['location_city']); $location_state = escapeHtml($row['location_state']); diff --git a/guest/guest_view_ticket.php b/guest/guest_view_ticket.php index 04482751..b52a395e 100644 --- a/guest/guest_view_ticket.php +++ b/guest/guest_view_ticket.php @@ -34,7 +34,7 @@ $company_phone_country_code = escapeHtml($company_sql_row['company_phone_country $company_phone = escapeHtml(formatPhoneNumber($company_sql_row['company_phone'], $company_phone_country_code)); $company_website = escapeHtml($company_sql_row['company_website']); -$url_key = sanitizeInput($_GET['url_key']); +$url_key = escapeSql($_GET['url_key']); $ticket_id = intval($_GET['ticket_id']); $ticket_sql = mysqli_query($mysqli, diff --git a/guest/includes/inc_all_guest.php b/guest/includes/inc_all_guest.php index f474396b..3a4bdcef 100644 --- a/guest/includes/inc_all_guest.php +++ b/guest/includes/inc_all_guest.php @@ -9,10 +9,10 @@ require_once $_SERVER['DOCUMENT_ROOT'] . '/includes/session_init.php'; // Set Timezone require_once $_SERVER['DOCUMENT_ROOT'] . '/includes/inc_set_timezone.php'; -$ip = sanitizeInput(getIP()); -$user_agent = sanitizeInput($_SERVER['HTTP_USER_AGENT']); -$os = sanitizeInput(getOS($user_agent)); -$browser = sanitizeInput(getWebBrowser($user_agent)); +$ip = escapeSql(getIP()); +$user_agent = escapeSql($_SERVER['HTTP_USER_AGENT']); +$os = escapeSql(getOS($user_agent)); +$browser = escapeSql(getWebBrowser($user_agent)); // Get Company Name $sql = mysqli_query($mysqli, "SELECT company_name FROM companies WHERE company_id = 1"); diff --git a/includes/filter_header.php b/includes/filter_header.php index cc31ef9c..d60e0e06 100644 --- a/includes/filter_header.php +++ b/includes/filter_header.php @@ -47,7 +47,7 @@ if(isset($order) && $order == "ASC") { // Search if (isset($_GET['q'])) { - $q = sanitizeInput($_GET['q']); + $q = escapeSql($_GET['q']); //Phone Numbers $phone_query = preg_replace("/[^0-9]/", '', $q); if (empty($phone_query)) { @@ -60,7 +60,7 @@ if (isset($_GET['q'])) { // Sortby if (!empty($_GET['sort'])) { - $sort = sanitizeInput(preg_replace('/[^a-z_]/', '', $_GET['sort'])); // JQ 2023-05-09 - See issue #673 on GitHub to see the reasoning why we used preg_replace technically sanitizeInput() should have been enough to escape SQL Commands + $sort = escapeSql(preg_replace('/[^a-z_]/', '', $_GET['sort'])); // JQ 2023-05-09 - See issue #673 on GitHub to see the reasoning why we used preg_replace technically escapeSql() should have been enough to escape SQL Commands } // Date Handling @@ -72,8 +72,8 @@ if (empty($_GET['canned_date'])) { // Date Filter if ($_GET['canned_date'] == "custom" && !empty($_GET['dtf'])) { - $dtf = sanitizeInput($_GET['dtf']); - $dtt = sanitizeInput($_GET['dtt']); + $dtf = escapeSql($_GET['dtf']); + $dtt = escapeSql($_GET['dtt']); } elseif ($_GET['canned_date'] == "today") { $dtf = date('Y-m-d'); $dtt = date('Y-m-d'); diff --git a/includes/load_user_session.php b/includes/load_user_session.php index e6f04fc2..d308dbe6 100644 --- a/includes/load_user_session.php +++ b/includes/load_user_session.php @@ -1,7 +1,7 @@ "; } else { - $email = sanitizeInput($sess['email'] ?? ''); + $email = escapeSql($sess['email'] ?? ''); } } @@ -152,7 +152,7 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST' && (isset($_POST['login']) || isset($_ Your MFA session expired. Please sign in again. "; } else { - $email = sanitizeInput($sess['email'] ?? ''); + $email = escapeSql($sess['email'] ?? ''); $role_choice = 'agent'; } } @@ -161,7 +161,7 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST' && (isset($_POST['login']) || isset($_ // STEP 1: INITIAL CREDENTIALS // ----------------------------------- if ($is_login_step && empty($response)) { - $email = sanitizeInput($_POST['email'] ?? ''); + $email = escapeSql($_POST['email'] ?? ''); $password = $_POST['password'] ?? ''; if (empty($email) || empty($password) || !filter_var($email, FILTER_VALIDATE_EMAIL)) { @@ -313,7 +313,7 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST' && (isset($_POST['login']) || isset($_ // NOTE: do NOT unset pending_dual_login here anymore; we may still need agent_master_key for MFA or role-step agent login $user_id = intval($selectedRow['user_id']); - $user_email = sanitizeInput($selectedRow['user_email']); + $user_email = escapeSql($selectedRow['user_email']); // ========================= // AGENT FLOW @@ -326,8 +326,8 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST' && (isset($_POST['login']) || isset($_ } } - $user_name = sanitizeInput($selectedRow['user_name']); - $token = sanitizeInput($selectedRow['user_token']); + $user_name = escapeSql($selectedRow['user_name']); + $token = escapeSql($selectedRow['user_token']); $force_mfa = intval($selectedRow['user_config_force_mfa']); $user_encryption_ciphertext = $selectedRow['user_specific_encryption_ciphertext']; @@ -390,7 +390,7 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST' && (isset($_POST['login']) || isset($_ AND log_ip = '$session_ip' AND log_user_id = $user_id ")); - $ip_previous_logins = sanitizeInput($sql_ip_prev_logins['ip_previous_logins']); + $ip_previous_logins = escapeSql($sql_ip_prev_logins['ip_previous_logins']); $sql_ua_prev_logins = mysqli_fetch_assoc(mysqli_query($mysqli, " SELECT COUNT(log_id) AS ua_previous_logins @@ -400,7 +400,7 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST' && (isset($_POST['login']) || isset($_ AND log_user_agent = '$session_user_agent' AND log_user_id = $user_id ")); - $ua_prev_logins = sanitizeInput($sql_ua_prev_logins['ua_previous_logins']); + $ua_prev_logins = escapeSql($sql_ua_prev_logins['ua_previous_logins']); if (!empty($config_smtp_provider) && $ip_previous_logins == 0 && $ua_prev_logins == 0) { $subject = "$config_app_name new login for $user_name"; @@ -563,7 +563,7 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST' && (isset($_POST['login']) || isset($_ $client_id = intval($selectedRow['contact_client_id'] ?? 0); $contact_id = intval($selectedRow['contact_id'] ?? 0); - $user_auth_method = sanitizeInput($selectedRow['user_auth_method'] ?? ''); + $user_auth_method = escapeSql($selectedRow['user_auth_method'] ?? ''); if ($client_id && $contact_id && $user_auth_method === 'local') { diff --git a/post/misc.php b/post/misc.php index 36511d67..42a014f9 100644 --- a/post/misc.php +++ b/post/misc.php @@ -45,7 +45,7 @@ if (isset($_GET['dismiss_all_notifications'])) { while($row = mysqli_fetch_assoc($sql)) { $notification_id = intval($row['notification_id']); - $notification_dismissed_at = sanitizeInput($row['notification_dismissed_at']); + $notification_dismissed_at = escapeSql($row['notification_dismissed_at']); mysqli_query($mysqli,"UPDATE notifications SET notification_dismissed_at = NOW(), notification_dismissed_by = $session_user_id WHERE notification_id = $notification_id"); @@ -70,7 +70,7 @@ if (isset($_GET['deactivate_shared_item'])) { // Get details of the shared link $sql = mysqli_query($mysqli, "SELECT item_type, item_related_id, item_client_id FROM shared_items WHERE item_id = $item_id"); $row = mysqli_fetch_assoc($sql); - $item_type = sanitizeInput($row['item_type']); + $item_type = escapeSql($row['item_type']); $item_related_id = intval($row['item_related_id']); $client_id = intval($row['item_client_id']); diff --git a/setup/index.php b/setup/index.php index 0bc61e78..194710f8 100644 --- a/setup/index.php +++ b/setup/index.php @@ -371,8 +371,8 @@ if (isset($_POST['add_user'])) { exit; } - $name = sanitizeInput($_POST['name']); - $email = sanitizeInput($_POST['email']); + $name = escapeSql($_POST['name']); + $email = escapeSql($_POST['email']); $password = password_hash(trim($_POST['password']), PASSWORD_DEFAULT); //Generate master encryption key @@ -440,16 +440,16 @@ if (isset($_POST['add_user'])) { if (isset($_POST['add_company_settings'])) { - $name = sanitizeInput($_POST['name']); - $country = sanitizeInput($_POST['country']); - $address = sanitizeInput($_POST['address']); - $city = sanitizeInput($_POST['city']); - $state = sanitizeInput($_POST['state']); - $zip = sanitizeInput($_POST['zip']); + $name = escapeSql($_POST['name']); + $country = escapeSql($_POST['country']); + $address = escapeSql($_POST['address']); + $city = escapeSql($_POST['city']); + $state = escapeSql($_POST['state']); + $zip = escapeSql($_POST['zip']); $phone = preg_replace("/[^0-9]/", '',$_POST['phone']); - $email = sanitizeInput($_POST['email']); - $website = sanitizeInput($_POST['website']); - $tax_id = sanitizeInput($_POST['tax_id']); + $email = escapeSql($_POST['email']); + $website = escapeSql($_POST['website']); + $tax_id = escapeSql($_POST['tax_id']); mysqli_query($mysqli,"INSERT INTO companies SET company_name = '$name', company_address = '$address', company_city = '$city', company_state = '$state', company_zip = '$zip', company_country = '$country', company_phone = '$phone', company_email = '$email', company_website = '$website', company_tax_id = '$tax_id'"); @@ -635,9 +635,9 @@ if (isset($_POST['add_company_settings'])) { if (isset($_POST['add_localization_settings'])) { - $locale = sanitizeInput($_POST['locale']); - $currency_code = sanitizeInput($_POST['currency_code']); - $timezone = sanitizeInput($_POST['timezone']); + $locale = escapeSql($_POST['locale']); + $currency_code = escapeSql($_POST['currency_code']); + $timezone = escapeSql($_POST['timezone']); mysqli_query($mysqli,"UPDATE companies SET company_locale = '$locale', company_currency = '$currency_code' WHERE company_id = 1"); @@ -659,7 +659,7 @@ if (isset($_POST['add_telemetry'])) { mysqli_query($mysqli,"UPDATE settings SET config_telemetry = 2"); - $comments = sanitizeInput($_POST['comments']); + $comments = escapeSql($_POST['comments']); $sql = mysqli_query($mysqli,"SELECT * FROM companies WHERE company_id = 1"); $row = mysqli_fetch_assoc($sql);