From c8dab1a7e5f4f6cb96766a190d7cb54b5e34852c Mon Sep 17 00:00:00 2001
From: johnnyq <johnny@pittpc.com>
Date: Sat, 1 Aug 2026 18:48:07 -0400
Subject: [PATCH] Revert PAyment cleanInput too

---
 admin/post/payment_method.php | 32 ++++++++------------------------
 functions/sanitize.php        | 19 -------------------
 2 files changed, 8 insertions(+), 43 deletions(-)

diff --git a/admin/post/payment_method.php b/admin/post/payment_method.php
index 3327a065..2432e554 100644
--- a/admin/post/payment_method.php
+++ b/admin/post/payment_method.php
@@ -1,7 +1,7 @@
 <?php
 
 /*
- * ITFlow - GET/POST request handler for AI Providers ('ai_providers')
+ * ITFlow - GET/POST request handler for payment methods ('payment_methods')
  */
 
 defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
@@ -10,17 +10,10 @@ if (isset($_POST['add_payment_method'])) {
 
     validateCSRFToken();
 
-    $name = cleanInput($_POST['name']);
-    $description = cleanInput($_POST['description']);
+    $name = escapeSql($_POST['name']);
+    $description = escapeSql($_POST['description']);
 
-    $query = mysqli_prepare(
-        $mysqli, "INSERT INTO payment_methods
-        SET payment_method_name = ?, payment_method_description = ?"
-    );
-
-    mysqli_stmt_bind_param($query, "ss", $name, $description);
-
-    mysqli_stmt_execute($query);
+    mysqli_query($mysqli, "INSERT INTO payment_methods SET payment_method_name = '$name', payment_method_description = '$description'");
 
     logAudit("Payment Method", "Create", "$session_name created Payment Method $name");
 
@@ -35,19 +28,10 @@ if (isset($_POST['edit_payment_method'])) {
     validateCSRFToken();
 
     $payment_method_id = intval($_POST['payment_method_id']);
-    $name = cleanInput($_POST['name']);
-    $description = cleanInput($_POST['description']);
+    $name = escapeSql($_POST['name']);
+    $description = escapeSql($_POST['description']);
 
-    $query = mysqli_prepare(
-        $mysqli,
-        "UPDATE payment_methods
-         SET payment_method_name = ?, payment_method_description = ?
-         WHERE payment_method_id = ?"
-    );
-
-    mysqli_stmt_bind_param($query, "ssi", $name, $description, $payment_method_id);
-
-    mysqli_stmt_execute($query);
+    mysqli_query($mysqli, "UPDATE payment_methods SET payment_method_name = '$name', payment_method_description = '$description' WHERE payment_method_id = $payment_method_id");
 
     logAudit("Payment Method", "Edit", "$session_name edited Payment Method $name");
 
@@ -63,7 +47,7 @@ if (isset($_GET['delete_payment_method'])) {
 
     $payment_method_id = intval($_GET['delete_payment_method']);
 
-    $payment_method_name = escapeSql(getFieldById('payment_methods', $payment_method_is, 'payment_method_name'));
+    $payment_method_name = escapeSql(getFieldById('payment_methods', $payment_method_id, 'payment_method_name'));
 
     mysqli_query($mysqli,"DELETE FROM payment_methods WHERE payment_method_id = $payment_method_id");
 
diff --git a/functions/sanitize.php b/functions/sanitize.php
index 409aa058..3de2139e 100644
--- a/functions/sanitize.php
+++ b/functions/sanitize.php
@@ -32,25 +32,6 @@ function escapeSql($input) {
     return $input;
 }
 
-function cleanInput($input) {
-    // Only process non-empty input
-    if (!empty($input)) {
-        // Normalize encoding to UTF-8 if it’s not valid
-        if (!mb_check_encoding($input, 'UTF-8')) {
-            // Convert from Windows-1252 as a safe fallback
-            $input = mb_convert_encoding($input, 'UTF-8', 'Windows-1252');
-        }
-    }
-
-    // Remove HTML and PHP tags
-    $input = strip_tags((string) $input);
-
-    // Trim whitespace
-    $input = trim($input);
-
-    return $input;
-}
-
 function toAlphanumeric($string) {
     // Gets rid of non-alphanumerics
     return preg_replace('/[^A-Za-z0-9_-]/', '', $string);