Merge pull request #1296 from itflow-org/develop

Develop to master for 26.08.2 Release

CHANGELOG.md

@@ -2,6 +2,52 @@
 
 This file documents all notable changes made to ITFlow.
 
+## [26.08.2] Maint Release
+
+### Upgrading to 26.08.2
+
+Update the files from Settings > Update as normal. There is no database change in this release, so nothing else is required.
+
+### Bug Fixes
+- Calendar: fixed the agent calendar showing no events.
+- Calendar: shared calendar feeds set to publish busy blocks only were publishing full event titles, locations and descriptions to anyone holding the subscription link.
+- Cron: fixed Maintenance > Cron failing to load. Scheduled jobs themselves were unaffected and kept running.
+- Exports: restored the missing columns on the ticket, quote, recurring invoice, software and user exports.
+- API: restored the full record on the credentials list endpoint.
+- Mail: switching an existing install from Standard SMTP/IMAP to Microsoft 365 or Google OAuth no longer leaves the old mail server behind, which stopped sending and ticket email fetching from working. The connection settings for OAuth providers are now fixed by the provider and cleared on save.
+
+
+## [26.08.1] Maint Release
+
+### Upgrading to 26.08.1
+
+Update the files from Settings > Update as normal. This release moves the database to 2.6.7 and the web updater completes it for you — the command line step that 26.08 required is not needed again.
+
+### Breaking Changes and Notes
+
+- Client access: agents with restricted client access now see records that have no client assigned. Previously this varied by page — unassigned tickets and projects were visible, unassigned expenses and credentials were not. It is now consistent everywhere.
+
+### Bug Fixes
+- Setup: fixed the wizard closing itself after the first user, which left new 26.08 installs stuck in a redirect loop between `/setup` and `/login.php`.
+- API: tightened client scoping on the expense read and record update endpoints.
+- Income: revenue rows now respect restricted client access.
+- Client PDF Export: fixed the export producing a CSV file, and each section is now gated on the module that owns it.
+- AI: fixed model creation, per-use-case model selection, configurable temperature, and error reporting.
+- Ticket: system-generated replies no longer record time worked that was never worked.
+- Ticket: fixed an error when scheduling a ticket.
+- Ticket: cancelling a schedule now cancels the calendar event on the recipient's calendar.
+- Ticket: history no longer records a status change when the status did not change.
+- Recurring Ticket: bulk priority changes no longer deny access to agents who are not administrators.
+- Contact: deleting a contact now removes the linked portal user, and anonymizing now redacts the phone number.
+- Calendar: fixed event deletion.
+
+### New Features & Updates
+- Performance: queries now select only the columns they use instead of `SELECT *`, cutting memory use and query time across the app and especially in the crons.
+- Performance: removed client joins that were only there for scoping — side nav badge counts are significantly faster.
+- Client scoping: added a `clientScopeSql()` helper so list queries scope on the owning column instead of a joined `clients.client_id`.
+- Contributing: documented the column-selection and client-scoping conventions.
+
+
 ## [26.08]
  
 ### Upgrading to 26.08

CONTRIBUTING.md

@@ -75,6 +75,10 @@ if (isset($_POST['edit_ticket_priority'])) {
  
 Files named `agent/post/*_model.php` hold shared field collection/sanitization logic used by both the create and edit blocks of a module (e.g. `asset_model.php` is included by both `add_asset` and `edit_asset`). If create and edit share more than a couple of fields, use this pattern rather than duplicating. Model files carry the same `FROM_POST_HANDLER` guard and are excluded from the dispatcher's auto-load.
 
+**`_model.php` is a reserved suffix.** The exclusion is a filename match, so a *handler* named `*_model.php` is silently never loaded — its form posts, nothing claims the request, and the user gets a blank page with no error anywhere. This is what happened to `admin/post/ai_model.php`, which is why the AI Models handler is now `admin/post/ai_models.php`. Name entity handlers around the suffix (`ai_models.php`, `users.php`, `api_keys.php`).
+
+A POST that reaches the end of `admin/post.php` or `agent/post.php` without a handler claiming it is logged to App Logs as a `Request` warning, which is the fastest way to spot this class of mistake.
+ 
 ---
  
 ## Cron
@@ -171,7 +175,25 @@ Everywhere else — anything under `agent/post/` — the call belongs in the blo
  
 ### 4. Client scoping is enforced, not assumed.
  
-After loading a record, call `enforceClientAccess()` (optionally with the record's client ID) so technicians restricted to specific clients cannot touch other clients' data by editing an ID in the URL. Look at how `resolve_ticket` does it — including the "skip if the record has no client" case.
+A user can be restricted to a subset of clients through `user_client_permissions`. Enforcing that has two halves, and a page usually needs both.
+
+**One record — `enforceClientAccess()`.** After loading a record, call it (optionally with the record's client ID) so technicians restricted to specific clients cannot touch other clients' data by editing an ID in the URL. Look at how `resolve_ticket` does it.
+
+**A list — `clientScopeSql()`.** Any query returning more than one row appends the fragment for that resource's own client column:
+
+```php
+$sql = mysqli_query($mysqli, "SELECT expense_id, expense_date, expense_amount, expense_description
+    FROM expenses
+    WHERE expense_archived_at IS NULL
+    " . clientScopeSql('expense_client_id') . "
+    ORDER BY expense_date DESC");
+```
+
+It returns `" AND ..."` or `""`, so it needs a `WHERE` to hang off — add `WHERE 1=1` if the query has no other condition. It is column-aware and takes an alias fine (`clientScopeSql('t.ticket_client_id')`). The API calls the same helper through the `apiClientScopeSql()` wrapper.
+
+Scope on the resource's **own** column, not on a joined `clients.client_id`. Joining `clients` just to scope makes the filter depend on the join: with a `LEFT JOIN`, a row whose client column is `0` produces `NULL`, and `NULL IN (...)` is neither true nor false, so the row silently vanishes. If the query joins `clients` for `client_name`, keep the join for that — but still scope on the owning column.
+
+**Records with no client (`0`) stay visible to restricted users.** `clientScopeSql()` emits `IN (0,...)` deliberately. Client restrictions partition *client* data, and a record belonging to no client is not any client's data to withhold. Do not hand-roll a variant that drops the `0` — the tree had accumulated several before this helper existed, disagreeing with each other, and reconciling them is what surfaced the inconsistency.
  
 ### 5. Escape on output.
  
@@ -207,7 +229,28 @@ Per [SECURITY.md](SECURITY.md) — never in a public issue.
  
 ## Conventions
 
-**Database naming.** Every column is prefixed with the singular name of the entity it belongs to: `tickets.ticket_id`, `tickets.ticket_subject`, `clients.client_name`. This makes JOIN results unambiguous and is why queries can `SELECT *` across joins safely. New tables must follow it.
+**Only technician-entered time is time worked.** `ticket_replies.ticket_reply_time_worked` is billable labour and feeds ticket totals, the technician and client time reports, project totals, invoicing and the API. A reply the *system* writes — assignment, priority change, merge, close, invoice/quote created, schedule edited, task completed or reopened — is an audit trail, not work, and records `'00:00:00'`. Only a value the technician actually typed goes in that column. Task completion estimates are planning information and stay on the task; they are never converted into time worked. `agent/ticket.php` hides the clock badge on a reply whose time is exactly `00:00:00`, so a zero renders as no time rather than as "0m".
+
+**Database naming.** Every column is prefixed with the singular name of the entity it belongs to: `tickets.ticket_id`, `tickets.ticket_subject`, `clients.client_name`. This makes JOIN results unambiguous, so a `SELECT *` across joins is never *wrong*. New tables must follow it.
+
+**Select the columns you use, not `*`.** Unambiguous is not the same as cheap. `SELECT *` across three joined tables fetches every column of all three, including the `*_notes` and `*_details` TEXT columns, and throws away whatever the page never renders. A search result list that shows five fields was pulling sixty. List the columns instead:
+
+```php
+$sql = mysqli_query($mysqli, "SELECT ticket_id, ticket_prefix, ticket_number, ticket_subject, client_name
+    FROM tickets
+    LEFT JOIN clients ON ticket_client_id = client_id
+    WHERE ticket_archived_at IS NULL
+    " . clientScopeSql('ticket_client_id') . "");
+```
+
+Two things follow from that:
+
+- A query whose result only feeds `mysqli_num_rows()` needs no columns at all — write `SELECT 1`. Do not select a primary key "just in case": if the query joins two tables that both carry that column name, an unqualified `SELECT ticket_template_id` is an ambiguous-column error.
+- Keep the join even when no column of the joined table survives into the `SELECT`, if the join is doing work — supplying a `WHERE` term, an `ORDER BY`, or the client column you scope on. Dropping a join is a separate decision from trimming the column list.
+
+The trade is real and worth stating: `SELECT *` picks up new columns for free, an explicit list does not. Add a column to a table and every query that needs it must be updated by hand, and the failure mode is a blank field or a PHP 8 undefined-key warning rather than an error. That is the price of not fetching data nobody reads, and the project has decided to pay it on anything that loops or touches a TEXT column.
+
+The exception is `api/v1/*/read.php`. Those endpoints hand the whole row to `read_output.php`, which serialises it straight into the JSON response — there the row *is* the output contract, so `SELECT *` is correct and trimming it would silently drop fields from every consumer.
 
 The prefix is the entity name, which is usually but not always the singular of the table name. Where a table is named for its container rather than its row, the prefix follows the row: `calendar_events` → `event_*`, `asset_interfaces` → `interface_*`, `invoice_items` / `quote_items` → `item_*`, `rack_units` → `unit_*`, `user_roles` → `role_*`, `product_stock` → `stock_*`. Pick the prefix your columns will read best as and use it for every column in the table.
 
@@ -225,6 +268,8 @@ A single update run applies every pending migration in order, stopping at the fi
 
 **Function names (post-rename).** Helpers were renamed for clarity in 2026; the old names **no longer exist** — code calling them fatals. If you're rebasing an old PR or following an old tutorial, translate: `sanitizeInput` → `escapeSql`, `nullable_htmlentities` → `escapeHtml`, `logAction` → `logAudit`, `flash_alert` → `flashAlert`, `customAction` → `triggerCustomAction`, `encryptLoginEntry`/`decryptLoginEntry` → `encryptCredentialEntry`/`decryptCredentialEntry`, `strtoAZaz09` → `toAlphanumeric`, `fetchUpdates` → `checkForUpdates`, `sanitize_url` → `escapeUrl`.
 
+One removed **variable** deserves its own warning: the old `$access_permission_query` global is gone, replaced by `clientScopeSql()` (security rule 4). Unlike a removed function, it does not fatal — an undefined variable interpolates as an empty string, so a rebased query keeps running with **no client scoping at all**. Grep for it before rebasing anything that touches a list query.
+ 
 **Helpers that fetch data return it raw.** If you add a `getXById()`-style helper, return the column value untouched and let callers escape it (security rule 1). Validating what the helper interpolates into its *own* query — table and column names, the id — is still the helper's job; that is query construction, not output escaping, and the two are not the same thing.
 
 **Bulk vs. single actions.** If you change the behavior of a single action (e.g. resolving a ticket), check whether a `bulk_*` counterpart exists and update it too. They are currently parallel implementations and drift between them is a known bug source.

admin/ai_models.php

@@ -6,7 +6,8 @@ $order = "ASC";
 
 require_once "includes/inc_all_admin.php";
 
-$sql = mysqli_query($mysqli, "SELECT * FROM ai_models LEFT JOIN ai_providers ON ai_model_ai_provider_id = ai_provider_id ORDER BY $sort $order");
+$sql = mysqli_query($mysqli, "SELECT ai_model_id, ai_model_name, ai_model_prompt, ai_model_use_case, ai_provider_id,
+    ai_provider_name FROM ai_models LEFT JOIN ai_providers ON ai_model_ai_provider_id = ai_provider_id ORDER BY $sort $order");
 
 $num_rows = mysqli_num_rows($sql);
 

admin/ai_providers.php

@@ -6,7 +6,7 @@ $order = "ASC";
 
 require_once "includes/inc_all_admin.php";
 
-$sql = mysqli_query($mysqli, "SELECT * FROM ai_providers ORDER BY $sort $order");
+$sql = mysqli_query($mysqli, "SELECT ai_provider_api_key, ai_provider_api_url, ai_provider_id, ai_provider_name FROM ai_providers ORDER BY $sort $order");
 
 $num_rows = mysqli_num_rows($sql);
 

admin/api_keys.php

@@ -8,7 +8,7 @@ require_once "includes/inc_all_admin.php";
 
 $sql = mysqli_query(
     $mysqli,
-    "SELECT SQL_CALC_FOUND_ROWS * FROM api_keys
+    "SELECT SQL_CALC_FOUND_ROWS api_key_created_at, api_key_expire, api_key_id, api_key_name, api_key_secret, user_name FROM api_keys
     LEFT JOIN users on api_key_user_id = user_id
     WHERE (api_key_name LIKE '%$q%')
     ORDER BY $sort $order LIMIT $record_from, $record_to"

admin/app_logs.php

@@ -28,7 +28,7 @@ if (isset($_GET['category']) & !empty($_GET['catergory'])) {
 
 $sql = mysqli_query(
     $mysqli,
-    "SELECT SQL_CALC_FOUND_ROWS * FROM app_logs
+    "SELECT SQL_CALC_FOUND_ROWS app_log_category, app_log_created_at, app_log_details, app_log_id, app_log_type FROM app_logs
     WHERE (app_log_type LIKE '%$q%' OR app_log_category LIKE '%$q%' OR app_log_details LIKE '%$q%')
     AND DATE(app_log_created_at) BETWEEN '$dtf' AND '$dtt'
     $log_type_query

admin/audit_logs.php

@@ -48,7 +48,8 @@ if (isset($_GET['action']) & !empty($_GET['action'])) {
 
 $sql = mysqli_query(
     $mysqli,
-    "SELECT SQL_CALC_FOUND_ROWS * FROM logs
+    "SELECT SQL_CALC_FOUND_ROWS client_id, client_name, log_action, log_created_at, log_description, log_entity_id, log_id,
+        log_ip, log_type, log_user_agent, user_id, user_name FROM logs
     LEFT JOIN users ON log_user_id = user_id
     LEFT JOIN clients ON log_client_id = client_id
     WHERE (log_type LIKE '%$q%' OR log_action LIKE '%$q%' OR log_description LIKE '%$q%' OR log_ip LIKE '%$q%' OR log_user_agent LIKE '%$q%' OR user_name LIKE '%$q%' OR client_name LIKE '%$q%')
@@ -87,7 +88,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                                 <option value="">- All Clients -</option>
 
                                 <?php
-                                $sql_clients_filter = mysqli_query($mysqli, "SELECT * FROM clients ORDER BY client_name ASC");
+                                $sql_clients_filter = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients ORDER BY client_name ASC");
                                 while ($row = mysqli_fetch_assoc($sql_clients_filter)) {
                                     $client_id = intval($row['client_id']);
                                     $client_name = escapeHtml($row['client_name']);
@@ -107,7 +108,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                                 <option value="">- All Users -</option>
 
                                 <?php
-                                $sql_users_filter = mysqli_query($mysqli, "SELECT * FROM users ORDER BY user_name ASC");
+                                $sql_users_filter = mysqli_query($mysqli, "SELECT user_id, user_name FROM users ORDER BY user_name ASC");
                                 while ($row = mysqli_fetch_assoc($sql_users_filter)) {
                                     $user_id = intval($row['user_id']);
                                     $user_name = escapeHtml($row['user_name']);

admin/backup.php

@@ -19,7 +19,8 @@ $cron_is_running = $cron_last_dispatch_at !== null && (time() - strtotime($cron_
 
 $backup_job = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT cron_job_enabled, cron_job_daily_at FROM cron_jobs WHERE cron_job_name = 'backup'"));
 
-$backups = mysqli_query($mysqli, "SELECT * FROM backups ORDER BY backup_created_at DESC LIMIT 100");
+$backups = mysqli_query($mysqli, "SELECT backup_created_at, backup_error, backup_id, backup_size, backup_source, backup_status,
+    backup_type FROM backups ORDER BY backup_created_at DESC LIMIT 100");
 
 $pending_count = intval(mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT(*) AS c FROM backups WHERE backup_status IN ('Pending','Running')"))['c']);
 

admin/backup_download.php

@@ -23,7 +23,7 @@ if (!isset($_GET['backup_id'])) {
 
 $backup_id = intval($_GET['backup_id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM backups WHERE backup_id = $backup_id AND backup_status = 'Complete' LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT backup_file_name FROM backups WHERE backup_id = $backup_id AND backup_status = 'Complete' LIMIT 1");
 
 if (mysqli_num_rows($sql) !== 1) {
     http_response_code(404);

admin/categories.php

@@ -15,7 +15,7 @@ if (isset($_GET['category'])) {
 
 $sql = mysqli_query(
     $mysqli,
-    "SELECT SQL_CALC_FOUND_ROWS * FROM categories
+    "SELECT SQL_CALC_FOUND_ROWS category_color, category_description, category_id, category_name FROM categories
     WHERE category_name LIKE '%$q%'
     AND category_type = '$category'
     AND category_$archive_query

admin/contract_templates.php

@@ -63,15 +63,15 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                             $id = intval($row['contract_template_id']);
                             $name = escapeHtml($row['contract_template_name']);
                             $type = escapeHtml($row['contract_template_type']);
-                            $freq = escapeHtml($row['contract_template_update_frequency']);
-                            $sla_low_resp = escapeHtml($row['sla_low_response_time']);
-                            $sla_med_resp = escapeHtml($row['sla_medium_response_time']);
-                            $sla_high_resp = escapeHtml($row['sla_high_response_time']);
-                            $sla_low_res = escapeHtml($row['sla_low_resolution_time']);
-                            $sla_med_res = escapeHtml($row['sla_medium_resolution_time']);
-                            $sla_high_res = escapeHtml($row['sla_high_resolution_time']);
-                            $hourly_rate = escapeHtml($row['contract_template_hourly_rate']);
-                            $after_hours = escapeHtml($row['contract_template_after_hours_hourly_rate']);
+                            $freq = escapeHtml($row['contract_template_renewal_frequency']);
+                            $sla_low_resp = escapeHtml($row['contract_template_sla_low_response_time']);
+                            $sla_med_resp = escapeHtml($row['contract_template_sla_medium_response_time']);
+                            $sla_high_resp = escapeHtml($row['contract_template_sla_high_response_time']);
+                            $sla_low_res = escapeHtml($row['contract_template_sla_low_resolution_time']);
+                            $sla_med_res = escapeHtml($row['contract_template_sla_medium_resolution_time']);
+                            $sla_high_res = escapeHtml($row['contract_template_sla_high_resolution_time']);
+                            $hourly_rate = escapeHtml($row['contract_template_rate_standard']);
+                            $after_hours = escapeHtml($row['contract_template_rate_after_hours']);
                             $support_hours = escapeHtml($row['contract_template_support_hours']);
                             $net_terms = escapeHtml($row['contract_template_net_terms']);
                             $created = escapeHtml($row['contract_template_created_at']);

admin/cron.php

@@ -22,7 +22,9 @@ foreach (cronJobRegistry() as $job) {
     $cron_jobs[$job['name']]['row'] = null;
 }
 
-$sql = mysqli_query($mysqli, "SELECT * FROM cron_jobs");
+$sql = mysqli_query($mysqli, "SELECT cron_job_daily_at, cron_job_enabled, cron_job_id, cron_job_interval_minutes,
+    cron_job_last_duration, cron_job_last_error, cron_job_last_error_at, cron_job_last_run_at, cron_job_last_status,
+    cron_job_name, cron_job_run_now, cron_job_schedule FROM cron_jobs");
 while ($job_row = mysqli_fetch_assoc($sql)) {
     if (isset($cron_jobs[$job_row['cron_job_name']])) {
         $cron_jobs[$job_row['cron_job_name']]['row'] = $job_row;

admin/custom_links.php

@@ -8,7 +8,8 @@ require_once "includes/inc_all_admin.php";
 
 $sql = mysqli_query(
     $mysqli,
-    "SELECT SQL_CALC_FOUND_ROWS * FROM custom_links
+    "SELECT SQL_CALC_FOUND_ROWS custom_link_icon, custom_link_id, custom_link_location, custom_link_name,
+        custom_link_new_tab, custom_link_order, custom_link_uri FROM custom_links
     WHERE custom_link_name LIKE '%$q%'
     ORDER BY $sort $order LIMIT $record_from, $record_to"
 );

admin/database_updates/2.3.1.php

@@ -8,7 +8,7 @@
 defined('FROM_DB_UPDATER') || die("Direct file access is not allowed");
 
     // Migrate Payment Methods from Categories Table to new payment_methods table
-    $sql_categories = mysqli_query($mysqli, "SELECT * FROM categories WHERE category_type = 'Payment Method' AND category_name != 'Stripe' AND category_archived_at IS NULL");
+    $sql_categories = mysqli_query($mysqli, "SELECT category_name FROM categories WHERE category_type = 'Payment Method' AND category_name != 'Stripe' AND category_archived_at IS NULL");
 
     while ($row = mysqli_fetch_assoc($sql_categories)) {
         $category_name = escapeSql($row['category_name']);

admin/database_updates/2.6.7.php

@@ -0,0 +1,18 @@
+<?php
+
+/*
+ * ITFlow - Database update to version 2.6.7 (from 2.6.6)
+ * Included by admin/database_updates.php - do not access directly
+ */
+
+defined('FROM_DB_UPDATER') || die("Direct file access is not allowed");
+
+    // The AI endpoints used to send a hardcoded temperature (0.5, or 0.3 for ticket
+    // summaries). Newer OpenAI models accept nothing but their own default and reject
+    // the request outright, which surfaced as "Failed to get a response from the AI API".
+    //
+    // Temperature is now per-model and optional: NULL means don't send the parameter
+    // at all, which is the setting that works on every provider. Existing rows get
+    // NULL so they stop sending it.
+
+    mysqli_query($mysqli, "ALTER TABLE `ai_models` ADD COLUMN IF NOT EXISTS `ai_model_temperature` decimal(3,2) DEFAULT NULL AFTER `ai_model_use_case`");

admin/document_template.php

@@ -15,7 +15,8 @@ if (isset($_GET['document_template_id'])) {
     $document_template_id = intval($_GET['document_template_id']);
 }
 
-$sql_document = mysqli_query($mysqli, "SELECT * FROM document_templates WHERE document_template_id = $document_template_id LIMIT 1");
+$sql_document = mysqli_query($mysqli, "SELECT document_template_content, document_template_created_at, document_template_description,
+    document_template_name, document_template_updated_at FROM document_templates WHERE document_template_id = $document_template_id LIMIT 1");
 
 if (mysqli_num_rows($sql_document) == 0) {
     echo "<center><h1 class='text-secondary mt-5'>Nothing to see here</h1><a class='btn btn-lg btn-secondary mt-3' href='javascript:history.back()'><i class='fa fa-fw fa-arrow-left'></i> Go Back</a></center>";

admin/document_templates.php

@@ -8,7 +8,8 @@
 
     $sql = mysqli_query(
         $mysqli,
-        "SELECT SQL_CALC_FOUND_ROWS * FROM document_templates
+        "SELECT SQL_CALC_FOUND_ROWS document_template_content, document_template_created_at, document_template_description,
+            document_template_id, document_template_name, document_template_updated_at, user_name FROM document_templates
         LEFT JOIN users ON document_template_created_by = user_id
         WHERE user_name LIKE '%$q%' OR document_template_name LIKE '%$q%'
         ORDER BY $sort $order LIMIT $record_from, $record_to"

admin/includes/side_nav.php

@@ -314,7 +314,7 @@
                 </li>
 
                 <?php
-                $sql_custom_links = mysqli_query($mysqli, "SELECT * FROM custom_links
+                $sql_custom_links = mysqli_query($mysqli, "SELECT custom_link_icon, custom_link_name, custom_link_new_tab, custom_link_uri FROM custom_links
                     WHERE custom_link_location = 4 AND custom_link_archived_at IS NULL
                     ORDER BY custom_link_order ASC, custom_link_name ASC"
                 );

admin/mail_queue.php

@@ -8,7 +8,8 @@ require_once "includes/inc_all_admin.php";
 
 $sql = mysqli_query(
     $mysqli,
-    "SELECT SQL_CALC_FOUND_ROWS * FROM email_queue
+    "SELECT SQL_CALC_FOUND_ROWS email_attempts, email_failed_at, email_from, email_from_name, email_id, email_queued_at,
+        email_recipient, email_recipient_name, email_sent_at, email_status, email_subject FROM email_queue
     WHERE (email_id LIKE '%$q%' OR email_from LIKE '%$q%' OR email_from_name LIKE '%$q%' OR email_recipient LIKE '%$q%' OR email_recipient_name LIKE '%$q%' OR email_subject LIKE '%$q%')
     AND DATE(email_queued_at) BETWEEN '$dtf' AND '$dtt'
     ORDER BY $sort $order LIMIT $record_from, $record_to"

admin/modals/ai/ai_model_add.php

@@ -26,7 +26,7 @@ ob_start();
                 <select class="form-control select2" name="provider" required>
                     <option value="">- Select an AI Provider -</option>
                     <?php
-                        $sql_ai_providers = mysqli_query($mysqli, "SELECT * FROM ai_providers");
+                        $sql_ai_providers = mysqli_query($mysqli, "SELECT ai_provider_id, ai_provider_name FROM ai_providers");
                         while ($row = mysqli_fetch_assoc($sql_ai_providers)) {
                             $ai_provider_id = intval($row['ai_provider_id']);
                             $ai_provider_name = escapeHtml($row['ai_provider_name']);
@@ -62,6 +62,17 @@ ob_start();
             </div>
         </div>
 
+        <div class="form-group">
+            <label>Temperature</label>
+            <div class="input-group">
+                <div class="input-group-prepend">
+                    <span class="input-group-text"><i class="fa fa-fw fa-thermometer-half"></i></span>
+                </div>
+                <input type="number" class="form-control" name="temperature" step="0.1" min="0" max="2" value="" placeholder="Provider default">
+            </div>
+            <small class="form-text text-muted">Optional. Leave blank to let the provider use its default - some newer models reject every other value.</small>
+        </div>
+
         <div class="form-group">
             <textarea class="form-control" rows="8" name="prompt" placeholder="Enter a model prompt:"></textarea>
         </div>

admin/modals/ai/ai_model_edit.php

@@ -4,13 +4,14 @@ require_once '../../includes/modal_header.php';
 
 $model_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM ai_models WHERE ai_model_id = $model_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT ai_model_ai_provider_id, ai_model_id, ai_model_name, ai_model_prompt, ai_model_use_case, ai_model_temperature FROM ai_models WHERE ai_model_id = $model_id LIMIT 1");
 
 $row = mysqli_fetch_assoc($sql);
 $ai_model_ai_provider_id = intval($row['ai_model_ai_provider_id']);
 $model_id = intval($row['ai_model_id']);
 $model_name = escapeHtml($row['ai_model_name']);
 $use_case = escapeHtml($row['ai_model_use_case']);
+$temperature = escapeHtml($row['ai_model_temperature']);
 $prompt = escapeHtml($row['ai_model_prompt']);
 
 // Generate the HTML form content using output buffering.
@@ -38,7 +39,7 @@ ob_start();
                 <select class="form-control select2" name="provider" required>
                     <option value="">- Select an AI Provider -</option>
                     <?php
-                        $sql_ai_providers = mysqli_query($mysqli, "SELECT * FROM ai_providers");
+                        $sql_ai_providers = mysqli_query($mysqli, "SELECT ai_provider_id, ai_provider_name FROM ai_providers");
                         while ($row = mysqli_fetch_assoc($sql_ai_providers)) {
                             $ai_provider_id = intval($row['ai_provider_id']);
                             $ai_provider_name = escapeHtml($row['ai_provider_name']);
@@ -74,6 +75,16 @@ ob_start();
             </div>
         </div>
 
+        <div class="form-group">
+            <label>Temperature</label>
+            <div class="input-group">
+                <div class="input-group-prepend">
+                    <span class="input-group-text"><i class="fa fa-fw fa-thermometer-half"></i></span>
+                </div>
+                <input type="number" class="form-control" name="temperature" step="0.1" min="0" max="2" value="<?= $temperature ?>" placeholder="Provider default">
+            </div>
+            <small class="form-text text-muted">Optional. Leave blank to let the provider use its default - some newer models reject every other value.</small>
+        </div>
         <div class="form-group">
             <textarea class="form-control" rows="8" name="prompt" placeholder="Enter a model prompt:"><?= $prompt ?></textarea>
         </div>

admin/modals/ai/ai_provider_edit.php

@@ -4,7 +4,7 @@ require_once '../../includes/modal_header.php';
 
 $provider_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM ai_providers WHERE ai_provider_id = $provider_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT ai_provider_api_key, ai_provider_api_url, ai_provider_name FROM ai_providers WHERE ai_provider_id = $provider_id LIMIT 1");
 
 $row = mysqli_fetch_assoc($sql);
 $provider_name = escapeHtml($row['ai_provider_name']);

admin/modals/api/api_key_edit.php

@@ -4,7 +4,7 @@ require_once '../../includes/modal_header.php';
 
 $api_key_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM api_keys WHERE api_key_id = $api_key_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT api_key_expire, api_key_name, api_key_user_id FROM api_keys WHERE api_key_id = $api_key_id LIMIT 1");
 $row = mysqli_fetch_assoc($sql);
 $api_key_name = escapeHtml($row['api_key_name']);
 $api_key_expire = escapeHtml($row['api_key_expire']);

admin/modals/category/category_edit.php

@@ -4,7 +4,7 @@ require_once '../../includes/modal_header.php';
 
 $category_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM categories WHERE category_id = $category_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT category_color, category_description, category_name, category_type FROM categories WHERE category_id = $category_id LIMIT 1");
 
 $row = mysqli_fetch_assoc($sql);
 $category_name = escapeHtml($row['category_name']);

admin/modals/contract_template/contract_template_edit.php

@@ -7,7 +7,13 @@ $contract_types_array = ['Fully Managed', 'Partialy Managed', 'Break/Fix'];
 $update_frequency_array = ['Manual', 'Annually', '2 Year', '3 Year', '5 Year', '7 Year'];
 
 // Fetch existing template
-$sql = mysqli_query($mysqli, "SELECT * FROM contract_templates WHERE contract_template_id = $contract_template_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT contract_template_description, contract_template_details, contract_template_name,
+    contract_template_net_terms, contract_template_rate_after_hours,
+    contract_template_rate_standard, contract_template_renewal_frequency,
+    contract_template_sla_high_resolution_time, contract_template_sla_high_response_time,
+    contract_template_sla_low_resolution_time, contract_template_sla_low_response_time,
+    contract_template_sla_medium_resolution_time, contract_template_sla_medium_response_time,
+    contract_template_support_hours, contract_template_type FROM contract_templates WHERE contract_template_id = $contract_template_id LIMIT 1");
 $row = mysqli_fetch_assoc($sql);
 
 // Assign locals

admin/modals/cron/cron_edit.php

@@ -5,7 +5,8 @@ require_once '../../../includes/cron_jobs.php';
 
 $cron_job_id = intval($_GET['id']);
 
-$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT * FROM cron_jobs WHERE cron_job_id = $cron_job_id LIMIT 1"));
+$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT cron_job_daily_at, cron_job_enabled, cron_job_interval_minutes, cron_job_name,
+    cron_job_schedule FROM cron_jobs WHERE cron_job_id = $cron_job_id LIMIT 1"));
 
 $registry = cronJobRegistryByName();
 $job = $registry[$row['cron_job_name']] ?? null;

admin/modals/custom_link/custom_link_edit.php

@@ -4,7 +4,8 @@ require_once '../../includes/modal_header.php';
 
 $custom_link_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM custom_links WHERE custom_link_id = $custom_link_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT custom_link_icon, custom_link_location, custom_link_name, custom_link_new_tab,
+    custom_link_order, custom_link_uri FROM custom_links WHERE custom_link_id = $custom_link_id LIMIT 1");
 $row = mysqli_fetch_assoc($sql);
 $custom_link_name = escapeHtml($row['custom_link_name']);
 $custom_link_uri = escapeHtml($row['custom_link_uri']);

admin/modals/document_template/document_template_edit.php

@@ -4,7 +4,7 @@ require_once '../../includes/modal_header.php';
 
 $document_template_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM document_templates WHERE document_template_id = $document_template_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT document_template_content, document_template_description, document_template_name FROM document_templates WHERE document_template_id = $document_template_id LIMIT 1");
 $row = mysqli_fetch_assoc($sql);
 $document_template_name = escapeHtml($row['document_template_name']);
 $document_template_description = escapeHtml($row['document_template_description']);

admin/modals/mail_queue/mail_queue_message_view.php

@@ -12,7 +12,9 @@ $purifier_config->set('Cache.DefinitionImpl', null); // Disable cache by setting
 $purifier_config->set('URI.AllowedSchemes', ['data' => true, 'src' => true, 'http' => true, 'https' => true]);
 $purifier = new HTMLPurifier($purifier_config);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM email_queue WHERE email_id = $email_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT email_attempts, email_content, email_failed_at, email_from, email_from_name,
+    email_queued_at, email_recipient, email_recipient_name, email_sent_at, email_status,
+    email_subject FROM email_queue WHERE email_id = $email_id LIMIT 1");
 $row = mysqli_fetch_assoc($sql);
 
 $email_from = escapeHtml($row['email_from']);

admin/modals/payment_method/payment_method_edit.php

@@ -4,7 +4,7 @@ require_once '../../includes/modal_header.php';
 
 $payment_method_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM payment_methods WHERE payment_method_id = $payment_method_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT payment_method_description, payment_method_id, payment_method_name FROM payment_methods WHERE payment_method_id = $payment_method_id LIMIT 1");
 
 $row = mysqli_fetch_assoc($sql);
 $payment_method_id = intval($row['payment_method_id']);

admin/modals/payment_provider/payment_provider_edit.php

@@ -4,7 +4,9 @@ require_once '../../includes/modal_header.php';
 
 $provider_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM payment_providers WHERE payment_provider_id = $provider_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT payment_provider_account, payment_provider_expense_category,
+    payment_provider_expense_vendor, payment_provider_name, payment_provider_private_key,
+    payment_provider_public_key, payment_provider_threshold FROM payment_providers WHERE payment_provider_id = $provider_id LIMIT 1");
 
 $row = mysqli_fetch_assoc($sql);
 $provider_name = escapeHtml($row['payment_provider_name']);

admin/modals/project_template/project_template_edit.php

@@ -4,7 +4,7 @@ require_once '../../includes/modal_header.php';
 
 $project_template_id = intval($_GET['project_template_id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM project_templates WHERE project_template_id = $project_template_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT project_template_description, project_template_name FROM project_templates WHERE project_template_id = $project_template_id LIMIT 1");
 $row = mysqli_fetch_assoc($sql);
 $project_template_name = escapeHtml($row['project_template_name']);
 $project_template_description = escapeHtml($row['project_template_description']);

admin/modals/role/role_add.php

@@ -79,7 +79,7 @@ ob_start();
 
                 <?php
                 // Enumerate modules
-                $sql_modules = mysqli_query($mysqli, "SELECT * FROM modules");
+                $sql_modules = mysqli_query($mysqli, "SELECT module_description, module_id, module_name FROM modules");
                 while ($row_modules = mysqli_fetch_assoc($sql_modules)) {
 
                     $module_id = intval($row_modules['module_id']);

admin/modals/role/role_edit.php

@@ -15,7 +15,7 @@ $role_admin = intval($row['role_is_admin']);
 $sql_role_user_count = mysqli_query($mysqli, "SELECT COUNT(user_id) FROM users WHERE user_role_id = $role_id AND user_archived_at IS NULL");
 $role_user_count = mysqli_fetch_row($sql_role_user_count)[0];
 
-$sql_users = mysqli_query($mysqli, "SELECT * FROM users WHERE user_role_id = $role_id AND user_archived_at IS NULL");
+$sql_users = mysqli_query($mysqli, "SELECT user_name FROM users WHERE user_role_id = $role_id AND user_archived_at IS NULL");
 // Initialize an empty array to hold user names
 $user_names = [];
 
@@ -113,7 +113,7 @@ ob_start();
                 <?php
 
                 // Enumerate modules
-                $sql_modules = mysqli_query($mysqli, "SELECT * FROM modules");
+                $sql_modules = mysqli_query($mysqli, "SELECT module_description, module_id, module_name FROM modules");
                 while ($row_modules = mysqli_fetch_assoc($sql_modules)) {
                     $module_id = intval($row_modules['module_id']);
                     $module_name = escapeHtml($row_modules['module_name']);

admin/modals/sla/sla_edit.php

@@ -3,7 +3,7 @@ require_once '../../includes/modal_header.php';
 
 $sla_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM slas WHERE sla_id = $sla_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT sla_description, sla_name, sla_resolution_minutes, sla_response_minutes FROM slas WHERE sla_id = $sla_id LIMIT 1");
 $row = mysqli_fetch_assoc($sql);
 $sla_name = escapeHtml($row['sla_name']);
 $sla_description = escapeHtml($row['sla_description']);

admin/modals/software_template/software_template_edit.php

@@ -4,7 +4,8 @@ require_once '../../includes/modal_header.php';
 
 $software_template_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM software_templates WHERE software_template_id = $software_template_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT software_template_description, software_template_license_type, software_template_name,
+    software_template_notes, software_template_type, software_template_version FROM software_templates WHERE software_template_id = $software_template_id LIMIT 1");
 $row = mysqli_fetch_assoc($sql);
 $software_name = escapeHtml($row['software_template_name']);
 $software_version = escapeHtml($row['software_template_version']);

admin/modals/tag/tag_edit.php

@@ -4,7 +4,7 @@ require_once '../../includes/modal_header.php';
 
 $tag_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM tags WHERE tag_id = $tag_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT tag_color, tag_icon, tag_name, tag_type FROM tags WHERE tag_id = $tag_id LIMIT 1");
 
 $row = mysqli_fetch_assoc($sql);
 $tag_name = escapeHtml($row['tag_name']);

admin/modals/tax/tax_edit.php

@@ -4,7 +4,7 @@ require_once '../../includes/modal_header.php';
 
 $tax_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM taxes WHERE tax_id = $tax_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT tax_name, tax_percent FROM taxes WHERE tax_id = $tax_id LIMIT 1");
 $row = mysqli_fetch_assoc($sql);
 $tax_name = escapeHtml($row['tax_name']);
 $tax_percent = floatval($row['tax_percent']);

admin/modals/ticket_status/ticket_status_edit.php

@@ -4,7 +4,8 @@ require_once '../../includes/modal_header.php';
 
 $ticket_status_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM ticket_statuses WHERE ticket_status_id = $ticket_status_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT ticket_status_active, ticket_status_color, ticket_status_name, ticket_status_order,
+    ticket_status_pauses_sla FROM ticket_statuses WHERE ticket_status_id = $ticket_status_id LIMIT 1");
 $row = mysqli_fetch_assoc($sql);
 $ticket_status_name = escapeHtml($row['ticket_status_name']);
 $ticket_status_color = escapeHtml($row['ticket_status_color']);

admin/modals/ticket_template/ticket_template_add.php

@@ -60,7 +60,7 @@ ob_start();
                     <option value="0">- No -</option>
                     <?php
 
-                    $sql_project_templates = mysqli_query($mysqli, "SELECT * FROM project_templates WHERE project_template_archived_at IS NULL ORDER BY project_template_name ASC");
+                    $sql_project_templates = mysqli_query($mysqli, "SELECT project_template_id, project_template_name FROM project_templates WHERE project_template_archived_at IS NULL ORDER BY project_template_name ASC");
                     while ($row = mysqli_fetch_assoc($sql_project_templates)) {
                         $project_template_id_select = intval($row['project_template_id']);
                         $project_template_name_select = escapeHtml($row['project_template_name']); ?>

admin/modals/ticket_template/ticket_template_task_edit.php

@@ -4,7 +4,7 @@ require_once '../../includes/modal_header.php';
 
 $task_template_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM task_templates WHERE task_template_id = $task_template_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT task_template_completion_estimate, task_template_name, task_template_order FROM task_templates WHERE task_template_id = $task_template_id LIMIT 1");
 
 $row = mysqli_fetch_assoc($sql);
 $task_template_name = escapeHtml($row['task_template_name']);

admin/modals/user/user_add.php

@@ -75,7 +75,7 @@ ob_start();
                         <select class="form-control select2" name="role" required>
                             <option value="">- Role -</option>
                             <?php
-                                $sql_user_roles = mysqli_query($mysqli, "SELECT * FROM user_roles WHERE role_archived_at IS NULL");
+                                $sql_user_roles = mysqli_query($mysqli, "SELECT role_id, role_name FROM user_roles WHERE role_archived_at IS NULL");
                                 while ($row = mysqli_fetch_assoc($sql_user_roles)) {
                                     $role_id = intval($row['role_id']);
                                     $role_name = escapeHtml($row['role_name']);
@@ -138,7 +138,7 @@ ob_start();
                         <tbody>
 
                         <?php
-                        $sql_client_select = mysqli_query($mysqli, "SELECT * FROM clients WHERE client_archived_at IS NULL ORDER BY client_name ASC");
+                        $sql_client_select = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients WHERE client_archived_at IS NULL ORDER BY client_name ASC");
                         while ($row = mysqli_fetch_assoc($sql_client_select)) {
                             $client_id = intval($row['client_id']);
                             $client_name = escapeHtml($row['client_name']);

admin/modals/user/user_archive.php

@@ -4,7 +4,7 @@ require_once '../../includes/modal_header.php';
 
 $user_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM users WHERE users.user_id = $user_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT user_avatar, user_email, user_name FROM users WHERE users.user_id = $user_id LIMIT 1");
 
 $row = mysqli_fetch_assoc($sql);
 $user_name = escapeHtml($row['user_name']);
@@ -12,13 +12,13 @@ $user_email = escapeHtml($row['user_email']);
 $user_avatar = escapeHtml($row['user_avatar']);
 $user_initials = escapeHtml(initials($user_name));
 
-$sql_related_tickets = mysqli_query($mysqli, "SELECT * FROM tickets
+$sql_related_tickets = mysqli_query($mysqli, "SELECT 1 FROM tickets
     WHERE ticket_assigned_to = $user_id AND ticket_resolved_at IS NULL AND ticket_closed_at IS NULL");
 
 $ticket_count = mysqli_num_rows($sql_related_tickets);
 
 // Related Recurring Tickets Query
-$sql_related_recurring_tickets = mysqli_query($mysqli, "SELECT * FROM recurring_tickets WHERE recurring_ticket_assigned_to = $user_id");
+$sql_related_recurring_tickets = mysqli_query($mysqli, "SELECT 1 FROM recurring_tickets WHERE recurring_ticket_assigned_to = $user_id");
 
 $recurring_ticket_count = mysqli_num_rows($sql_related_recurring_tickets);
 
@@ -59,7 +59,7 @@ ob_start();
                 <select class="form-control select2" name="ticket_assign" required>
                     <option value="0">No one</option>
                     <?php
-                    $sql_users = mysqli_query($mysqli, "SELECT * FROM users WHERE user_type = 1 AND user_archived_at IS NULL");
+                    $sql_users = mysqli_query($mysqli, "SELECT user_id, user_name FROM users WHERE user_type = 1 AND user_archived_at IS NULL");
                     while ($row = mysqli_fetch_assoc($sql_users)) {
                         $user_id_select = intval($row['user_id']);
                         $user_name_select = escapeHtml($row['user_name']);

admin/modals/user/user_edit.php

@@ -4,7 +4,7 @@ require_once '../../includes/modal_header.php';
 
 $user_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM users
+$sql = mysqli_query($mysqli, "SELECT user_avatar, user_config_force_mfa, user_email, user_name, user_role_id, user_token FROM users
     LEFT JOIN user_settings ON users.user_id = user_settings.user_id
     WHERE users.user_id = $user_id LIMIT 1"
 );
@@ -119,7 +119,7 @@ ob_start();
                         </div>
                         <select class="form-control select2" name="role" required>
                             <?php
-                            $sql_user_roles = mysqli_query($mysqli, "SELECT * FROM user_roles WHERE role_archived_at IS NULL");
+                            $sql_user_roles = mysqli_query($mysqli, "SELECT role_id, role_name FROM user_roles WHERE role_archived_at IS NULL");
                             while ($row = mysqli_fetch_assoc($sql_user_roles)) {
                                 $role_id = intval($row['role_id']);
                                 $role_name = escapeHtml($row['role_name']);
@@ -190,7 +190,7 @@ ob_start();
                         <tbody>
 
                         <?php
-                        $sql_client_select = mysqli_query($mysqli, "SELECT * FROM clients WHERE client_archived_at IS NULL ORDER BY client_name ASC");
+                        $sql_client_select = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients WHERE client_archived_at IS NULL ORDER BY client_name ASC");
                         while ($row = mysqli_fetch_assoc($sql_client_select)) {
                             $client_id_select = intval($row['client_id']);
                             $client_name_select = escapeHtml($row['client_name']);

admin/modals/user/user_restore.php

@@ -4,7 +4,7 @@ require_once '../../includes/modal_header.php';
 
 $user_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM users WHERE user_id = $user_id AND user_archived_at IS NOT NULL LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT user_avatar, user_email, user_name, user_role_id FROM users WHERE user_id = $user_id AND user_archived_at IS NOT NULL LIMIT 1");
 
 $row = mysqli_fetch_assoc($sql);
 $user_name = str_replace(" (archived)", "", $row['user_name']); //Removed (archived) from user_name
@@ -63,7 +63,7 @@ ob_start();
                 </div>
                 <select class="form-control select2" name="role" required>
                     <?php
-                    $sql_user_roles = mysqli_query($mysqli, "SELECT * FROM user_roles WHERE role_archived_at IS NULL");
+                    $sql_user_roles = mysqli_query($mysqli, "SELECT role_id, role_name FROM user_roles WHERE role_archived_at IS NULL");
                     while ($row = mysqli_fetch_assoc($sql_user_roles)) {
                         $role_id = intval($row['role_id']);
                         $role_name = escapeHtml($row['role_name']);

admin/modals/vendor_template/vendor_template_edit.php

@@ -4,7 +4,10 @@ require_once '../../includes/modal_header.php';
 
 $vendor_template_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM vendor_templates WHERE vendor_template_id = $vendor_template_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT vendor_template_account_number, vendor_template_code, vendor_template_contact_name,
+    vendor_template_description, vendor_template_email, vendor_template_extension,
+    vendor_template_hours, vendor_template_name, vendor_template_notes, vendor_template_phone,
+    vendor_template_phone_country_code, vendor_template_sla, vendor_template_website FROM vendor_templates WHERE vendor_template_id = $vendor_template_id LIMIT 1");
 $row = mysqli_fetch_assoc($sql);
 $vendor_name = escapeHtml($row['vendor_template_name']);
 $vendor_description = escapeHtml($row['vendor_template_description']);

admin/modules.php

@@ -8,7 +8,7 @@ require_once "includes/inc_all_admin.php";
 
 $sql = mysqli_query(
     $mysqli,
-    "SELECT SQL_CALC_FOUND_ROWS * FROM modules
+    "SELECT SQL_CALC_FOUND_ROWS module_description, module_id, module_name FROM modules
     WHERE (module_name LIKE '%$q%' OR module_description LIKE '%$q%')
     ORDER BY $sort $order LIMIT $record_from, $record_to"
 );

admin/payment_methods.php

@@ -6,7 +6,8 @@ $order = "ASC";
 
 require_once "includes/inc_all_admin.php";
 
-$sql = mysqli_query($mysqli, "SELECT * FROM payment_methods ORDER BY $sort $order");
+$sql = mysqli_query($mysqli, "SELECT payment_method_created_at, payment_method_description, payment_method_id,
+    payment_method_name FROM payment_methods ORDER BY $sort $order");
 
 $num_rows = mysqli_num_rows($sql);
 

admin/payment_providers.php

@@ -6,7 +6,8 @@ $order = "ASC";
 
 require_once "includes/inc_all_admin.php";
 
-$sql = mysqli_query($mysqli, "SELECT * FROM payment_providers
+$sql = mysqli_query($mysqli, "SELECT account_name, category_name, payment_provider_description, payment_provider_id,
+    payment_provider_name, payment_provider_threshold, vendor_name FROM payment_providers
     LEFT JOIN accounts ON payment_provider_account = account_id
     LEFT JOIN vendors ON payment_provider_expense_vendor = vendor_id
     LEFT JOIN categories ON payment_provider_expense_category = category_id

admin/post.php

@@ -10,7 +10,11 @@ require_once __DIR__ . "/../includes/check_login.php";
 // Only allow running post files via inclusion (prevents people/bots poking them directly)
 define('FROM_POST_HANDLER', true);
 
-// Load all admin module POST logic
+// Load all admin module POST logic.
+// *_model.php is a RESERVED suffix: those files are not handlers, they are inline
+// field-parsing fragments that read $_POST at include time, so the glob must not
+// pull them in. A handler named *_model.php is silently never loaded - name entity
+// handlers around it (admin/post/ai_models.php, not ai_model.php).
 if (!empty($session_is_admin)) {
     foreach (glob(__DIR__ . "/post/*.php") as $admin_module) {
         if (!str_ends_with($admin_module, '_model.php')) {
@@ -22,3 +26,11 @@ if (!empty($session_is_admin)) {
 // Logout is shared between portals
 require_once __DIR__ . "/../post/logout.php";
 require_once __DIR__ . "/../post/misc.php";
+
+// Every handler above exits or redirects, so getting here means no handler claimed
+// the request - a blank page and no trace of why. Log it; the usual cause is a
+// handler file that never loaded.
+if ($_SERVER['REQUEST_METHOD'] === 'POST') {
+    $unhandled = implode(', ', array_slice(array_keys($_POST), 0, 10));
+    logApp('Request', 'warning', "Unhandled POST to admin/post.php - no handler matched. Fields: $unhandled");
+}

admin/post/ai_models.php

@@ -1,7 +1,7 @@
 <?php
 
 /*
- * ITFlow - GET/POST request handler for AI Models ('ai_model')
+ * ITFlow - GET/POST request handler for AI Models ('ai_models')
  */
 
 defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
@@ -15,9 +15,17 @@ if (isset($_POST['add_ai_model'])) {
     $prompt = escapeSql($_POST['prompt']);
     $use_case = escapeSql($_POST['use_case']);
 
-    mysqli_query($mysqli,"INSERT INTO ai_models SET ai_model_name = '$model', ai_model_prompt = '$prompt', ai_model_use_case = '$use_case', ai_model_ai_provider_id = $provider_id");
+    // Blank means "send no temperature at all" - the only setting that works on every
+    // provider. Anything else rides as a numeric literal, so no quoting.
+    $temperature = ($_POST['temperature'] ?? '') === '' ? 'NULL' : floatval($_POST['temperature']);
 
-    $ai_model_id = mysqli_insert_id($mysqli);
+    mysqli_query($mysqli,"INSERT INTO ai_models SET ai_model_name = '$model', ai_model_prompt = '$prompt', ai_model_use_case = '$use_case', ai_model_temperature = $temperature, ai_model_ai_provider_id = $provider_id");
+
+    if (!mysqli_affected_rows($mysqli)) {
+        logApp('AI', 'error', 'Failed to create AI Model ' . $model . ': ' . mysqli_error($mysqli));
+        flashAlert("AI Model <strong>$model</strong> could not be created - see Admin > App Logs", 'error');
+        redirect();
+    }
 
     logAudit("AI Model", "Create", "$session_name created AI Model $model");
 
@@ -36,7 +44,11 @@ if (isset($_POST['edit_ai_model'])) {
     $prompt = escapeSql($_POST['prompt']);
     $use_case = escapeSql($_POST['use_case']);
 
-    mysqli_query($mysqli,"UPDATE ai_models SET ai_model_name = '$model', ai_model_prompt = '$prompt', ai_model_use_case = '$use_case' WHERE ai_model_id = $model_id");
+    // Blank means "send no temperature at all" - the only setting that works on every
+    // provider. Anything else rides as a numeric literal, so no quoting.
+    $temperature = ($_POST['temperature'] ?? '') === '' ? 'NULL' : floatval($_POST['temperature']);
+
+    mysqli_query($mysqli,"UPDATE ai_models SET ai_model_name = '$model', ai_model_prompt = '$prompt', ai_model_use_case = '$use_case', ai_model_temperature = $temperature WHERE ai_model_id = $model_id");
 
     logAudit("AI Model", "Edit", "$session_name edited AI Model $model");
 

admin/post/settings_mail.php

@@ -91,6 +91,18 @@ if (isset($_POST['edit_mail_smtp_settings'])) {
     $config_smtp_username   = escapeSql($_POST['config_smtp_username'] ?? $config_smtp_username);
     $config_smtp_password   = escapeSql($_POST['config_smtp_password'] ?? $config_smtp_password);
 
+    // The host/port/encryption/password inputs are hidden and disabled for OAuth
+    // providers, so they never post and the ?? fallbacks above keep whatever the
+    // install used before. Clear them instead: the endpoint is fixed by provider,
+    // and the stored values would otherwise be both wrong and unreachable from
+    // the settings page. The mailbox password is no longer used either.
+    if ($config_smtp_provider === 'google_oauth' || $config_smtp_provider === 'microsoft_oauth') {
+        $config_smtp_host       = '';
+        $config_smtp_port       = 0;
+        $config_smtp_encryption = '';
+        $config_smtp_password   = '';
+    }
+
     mysqli_query($mysqli, "
         UPDATE settings SET
             config_smtp_provider              = '$config_smtp_provider',
@@ -121,6 +133,15 @@ if (isset($_POST['edit_mail_imap_settings'])) {
     $config_imap_username   = escapeSql($_POST['config_imap_username'] ?? $config_imap_username);
     $config_imap_password   = escapeSql($_POST['config_imap_password'] ?? $config_imap_password);
 
+    // Same as the SMTP handler above - the connection fields are hidden for OAuth
+    // providers and never post, so drop the leftovers rather than carrying them.
+    if ($config_imap_provider === 'google_oauth' || $config_imap_provider === 'microsoft_oauth') {
+        $config_imap_host       = '';
+        $config_imap_port       = 0;
+        $config_imap_encryption = '';
+        $config_imap_password   = '';
+    }
+
     mysqli_query($mysqli, "
         UPDATE settings SET
             config_imap_provider              = '$config_imap_provider',
@@ -259,26 +280,17 @@ if (isset($_POST['test_email_imap'])) {
 
     $is_oauth = ($provider === 'google_oauth' || $provider === 'microsoft_oauth');
 
+    // Override, don't default - a leftover standard-IMAP host from before the
+    // switch to OAuth would otherwise make this test fail against the old server
+    // while the cron parser (which overrides unconditionally) connects fine.
     if ($provider === 'google_oauth') {
-        if (empty($host)) {
-            $host = 'imap.gmail.com';
-        }
-        if (empty($port)) {
-            $port = 993;
-        }
-        if (empty($encryption)) {
-            $encryption = 'ssl';
-        }
+        $host       = 'imap.gmail.com';
+        $port       = 993;
+        $encryption = 'ssl';
     } elseif ($provider === 'microsoft_oauth') {
-        if (empty($host)) {
-            $host = 'outlook.office365.com';
-        }
-        if (empty($port)) {
-            $port = 993;
-        }
-        if (empty($encryption)) {
-            $encryption = 'ssl';
-        }
+        $host       = 'outlook.office365.com';
+        $port       = 993;
+        $encryption = 'ssl';
     }
 
     if (empty($host) || empty($port) || empty($username)) {

admin/post/users.php

@@ -54,7 +54,7 @@ if (isset($_POST['add_user'])) {
     // Create Settings
     mysqli_query($mysqli, "INSERT INTO user_settings SET user_id = $user_id, user_config_force_mfa = $force_mfa");
 
-    $sql = mysqli_query($mysqli,"SELECT * FROM companies WHERE company_id = 1");
+    $sql = mysqli_query($mysqli,"SELECT company_name FROM companies WHERE company_id = 1");
     $row = mysqli_fetch_assoc($sql);
     $company_name = escapeSql($row['company_name']);
 
@@ -328,7 +328,7 @@ if (isset($_POST['restore_user'])) {
 
 }
 
-if (isset($_POST['export_users'])) {
+if (isExportRequest('export_users')) {
 
     validateCSRFToken();
 
@@ -355,7 +355,7 @@ if (isset($_POST['export_users'])) {
 
     $sql = mysqli_query(
         $mysqli,
-        "SELECT * FROM users
+        "SELECT role_name, user_created_at, user_email, user_name, user_status FROM users
         LEFT JOIN user_roles ON user_role_id = role_id
         WHERE (user_name LIKE '%$q%' OR user_email LIKE '%$q%')
         AND user_type = 1
@@ -402,7 +402,7 @@ if (isset($_POST['ir_reset_user_password'])) {
 
     // Confirm logged-in user password, for security
     $admin_password = $_POST['admin_password'];
-    $sql = mysqli_query($mysqli, "SELECT * FROM users WHERE user_id = $session_user_id");
+    $sql = mysqli_query($mysqli, "SELECT user_password FROM users WHERE user_id = $session_user_id");
     $userRow = mysqli_fetch_assoc($sql);
 
     if (!password_verify($admin_password, $userRow['user_password'])) {
@@ -411,7 +411,7 @@ if (isset($_POST['ir_reset_user_password'])) {
     }
 
     // Get agents/users, other than the current user
-    $sql_users = mysqli_query($mysqli, "SELECT * FROM users WHERE (user_archived_at IS NULL AND user_id != $session_user_id)");
+    $sql_users = mysqli_query($mysqli, "SELECT user_email, user_id FROM users WHERE (user_archived_at IS NULL AND user_id != $session_user_id)");
 
     // Reset passwords
     while ($row = mysqli_fetch_assoc($sql_users)) {

admin/project_template.php

@@ -8,7 +8,8 @@ if (isset($_GET['project_template_id'])) {
 
     $sql_project_templates = mysqli_query(
         $mysqli,
-        "SELECT * FROM project_templates
+        "SELECT project_template_created_at, project_template_description, project_template_name,
+            project_template_updated_at FROM project_templates
         WHERE project_template_id = $project_template_id LIMIT 1"
     );
 
@@ -27,7 +28,9 @@ if (isset($_GET['project_template_id'])) {
     $project_template_updated_at = escapeHtml($row['project_template_updated_at']);
 
     // Get Associated Ticket Templates
-    $sql_ticket_templates = mysqli_query($mysqli, "SELECT * FROM ticket_templates, project_template_ticket_templates
+    $sql_ticket_templates = mysqli_query($mysqli, "SELECT ticket_template_created_at, ticket_template_description,
+        project_template_ticket_templates.ticket_template_id, ticket_template_name,
+        ticket_template_order, ticket_template_subject, ticket_template_updated_at FROM ticket_templates, project_template_ticket_templates
         WHERE ticket_templates.ticket_template_id = project_template_ticket_templates.ticket_template_id
         AND project_template_ticket_templates.project_template_id = $project_template_id
         ORDER BY ticket_template_order ASC, ticket_template_name ASC");
@@ -35,7 +38,7 @@ if (isset($_GET['project_template_id'])) {
 
     // Get All Task Templates
     $sql_task_templates = mysqli_query($mysqli,
-        "SELECT * FROM ticket_templates, task_templates, project_template_ticket_templates
+        "SELECT task_template_id, task_template_name FROM ticket_templates, task_templates, project_template_ticket_templates
         WHERE ticket_templates.ticket_template_id = project_template_ticket_templates.ticket_template_id
         AND project_template_ticket_templates.project_template_id = $project_template_id
         AND ticket_templates.ticket_template_id = task_template_ticket_template_id

admin/project_templates.php

@@ -8,7 +8,8 @@ require_once "includes/inc_all_admin.php";
 
 $sql = mysqli_query(
     $mysqli,
-    "SELECT SQL_CALC_FOUND_ROWS * FROM project_templates
+    "SELECT SQL_CALC_FOUND_ROWS project_template_created_at, project_template_description, project_template_id,
+        project_template_name FROM project_templates
     WHERE (project_template_name LIKE '%$q%' OR project_template_description LIKE '%$q%')
     AND project_template_archived_at IS NULL
     ORDER BY $sort $order LIMIT $record_from, $record_to"
@@ -68,7 +69,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                     $project_template_created_at = escapeHtml($row['project_template_created_at']);
 
                     // Get Ticket Template Count
-                    $sql_ticket_templates = mysqli_query($mysqli, "SELECT * FROM ticket_templates, project_template_ticket_templates
+                    $sql_ticket_templates = mysqli_query($mysqli, "SELECT 1 FROM ticket_templates, project_template_ticket_templates
                         WHERE ticket_templates.ticket_template_id = project_template_ticket_templates.ticket_template_id
                         AND project_template_ticket_templates.project_template_id = $project_template_id
                         ORDER BY ticket_template_order ASC, ticket_template_name ASC");
@@ -76,7 +77,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
 
                     // Get Tasks Template Count
                     $sql_task_templates = mysqli_query($mysqli,
-                        "SELECT * FROM ticket_templates, task_templates, project_template_ticket_templates
+                        "SELECT 1 FROM ticket_templates, task_templates, project_template_ticket_templates
                         WHERE ticket_templates.ticket_template_id = project_template_ticket_templates.ticket_template_id
                         AND project_template_ticket_templates.project_template_id = $project_template_id
                         AND ticket_templates.ticket_template_id = task_template_ticket_template_id

admin/roles.php

@@ -75,7 +75,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                         $sql_role_user_count = mysqli_query($mysqli, "SELECT COUNT(user_id) FROM users WHERE user_role_id = $role_id AND user_archived_at IS NULL");
                         $role_user_count = mysqli_fetch_row($sql_role_user_count)[0];
 
-                        $sql_users = mysqli_query($mysqli, "SELECT * FROM users WHERE user_role_id = $role_id AND user_archived_at IS NULL");
+                        $sql_users = mysqli_query($mysqli, "SELECT user_name FROM users WHERE user_role_id = $role_id AND user_archived_at IS NULL");
                         // Initialize an empty array to hold user names
                         $user_names = [];
 

admin/settings_company.php

@@ -2,7 +2,9 @@
 require_once "includes/inc_all_admin.php";
 
 
-$sql = mysqli_query($mysqli,"SELECT * FROM companies, settings WHERE companies.company_id = settings.company_id AND companies.company_id = 1");
+$sql = mysqli_query($mysqli,"SELECT company_address, company_city, company_country, company_currency, company_email,
+    settings.company_id, company_locale, company_logo, company_name, company_phone,
+    company_phone_country_code, company_state, company_tax_id, company_website, company_zip FROM companies, settings WHERE companies.company_id = settings.company_id AND companies.company_id = 1");
 
 $row = mysqli_fetch_assoc($sql);
 $company_id = intval($row['company_id']);

admin/settings_default.php

@@ -59,7 +59,7 @@ $net_terms_array = array (
                         <option value="0">- None -</option>
                         <?php
 
-                        $sql = mysqli_query($mysqli, "SELECT * FROM calendars ORDER BY calendar_name ASC");
+                        $sql = mysqli_query($mysqli, "SELECT calendar_id, calendar_name FROM calendars ORDER BY calendar_name ASC");
                         while ($row = mysqli_fetch_assoc($sql)) {
                             $calendar_id = intval($row['calendar_id']);
                             $calendar_name = escapeHtml($row['calendar_name']); ?>
@@ -82,7 +82,7 @@ $net_terms_array = array (
                         <option value="0">- None -</option>
                         <?php
 
-                        $sql = mysqli_query($mysqli, "SELECT * FROM accounts WHERE account_archived_at IS NULL ORDER BY account_name ASC");
+                        $sql = mysqli_query($mysqli, "SELECT account_id, account_name FROM accounts WHERE account_archived_at IS NULL ORDER BY account_name ASC");
                         while ($row = mysqli_fetch_assoc($sql)) {
                             $account_id = intval($row['account_id']);
                             $account_name = escapeHtml($row['account_name']); ?>
@@ -105,7 +105,7 @@ $net_terms_array = array (
                         <option value="0">- None -</option>
                         <?php
 
-                        $sql = mysqli_query($mysqli, "SELECT * FROM accounts WHERE account_archived_at IS NULL ORDER BY account_name ASC");
+                        $sql = mysqli_query($mysqli, "SELECT account_id, account_name FROM accounts WHERE account_archived_at IS NULL ORDER BY account_name ASC");
                         while ($row = mysqli_fetch_assoc($sql)) {
                             $account_id = intval($row['account_id']);
                             $account_name = escapeHtml($row['account_name']); ?>
@@ -128,7 +128,7 @@ $net_terms_array = array (
                         <option value="0">- None -</option>
                         <?php
 
-                        $sql = mysqli_query($mysqli, "SELECT * FROM accounts WHERE account_archived_at IS NULL ORDER BY account_name ASC");
+                        $sql = mysqli_query($mysqli, "SELECT account_id, account_name FROM accounts WHERE account_archived_at IS NULL ORDER BY account_name ASC");
                         while ($row = mysqli_fetch_assoc($sql)) {
                             $account_id = intval($row['account_id']);
                             $account_name = escapeHtml($row['account_name']); ?>
@@ -153,7 +153,7 @@ $net_terms_array = array (
                         <option value="0">- None -</option>
                         <?php
 
-                        $sql = mysqli_query($mysqli, "SELECT * FROM accounts WHERE account_archived_at IS NULL ORDER BY account_name ASC");
+                        $sql = mysqli_query($mysqli, "SELECT account_id, account_name FROM accounts WHERE account_archived_at IS NULL ORDER BY account_name ASC");
                         while ($row = mysqli_fetch_assoc($sql)) {
                             $account_id = intval($row['account_id']);
                             $account_name = escapeHtml($row['account_name']); ?>
@@ -176,7 +176,7 @@ $net_terms_array = array (
                         <option value="">- None -</option>
                         <?php
 
-                        $sql = mysqli_query($mysqli, "SELECT * FROM categories WHERE category_type = 'Payment Method' ORDER BY category_name ASC");
+                        $sql = mysqli_query($mysqli, "SELECT category_name FROM categories WHERE category_type = 'Payment Method' ORDER BY category_name ASC");
                         while ($row = mysqli_fetch_assoc($sql)) {
                             $payment_method = escapeHtml($row['category_name']); ?>
                             <option <?php if ($config_default_payment_method == $payment_method) {
@@ -198,7 +198,7 @@ $net_terms_array = array (
                         <option value="">- None -</option>
                         <?php
 
-                        $sql = mysqli_query($mysqli, "SELECT * FROM categories WHERE category_type = 'Payment Method' ORDER BY category_name ASC");
+                        $sql = mysqli_query($mysqli, "SELECT category_name FROM categories WHERE category_type = 'Payment Method' ORDER BY category_name ASC");
                         while ($row = mysqli_fetch_assoc($sql)) {
                             $payment_method = escapeHtml($row['category_name']); ?>
                             <option <?php if ($config_default_expense_payment_method == $payment_method) {

admin/settings_localization.php

@@ -2,7 +2,7 @@
 require_once "includes/inc_all_admin.php";
 
 
-$sql = mysqli_query($mysqli,"SELECT * FROM companies, settings WHERE companies.company_id = settings.company_id AND companies.company_id = 1");
+$sql = mysqli_query($mysqli,"SELECT company_currency, company_locale FROM companies, settings WHERE companies.company_id = settings.company_id AND companies.company_id = 1");
 
 $row = mysqli_fetch_assoc($sql);
 $company_locale = escapeHtml($row['company_locale']);

admin/sla.php

@@ -12,7 +12,8 @@ $config_sla_warning_percent = intval($row['config_sla_warning_percent']);
 $config_sla_notification_email = escapeHtml($row['config_sla_notification_email']);
 
 // SLA plans (active first)
-$sql_slas = mysqli_query($mysqli, "SELECT * FROM slas ORDER BY sla_archived_at IS NOT NULL, sla_name ASC");
+$sql_slas = mysqli_query($mysqli, "SELECT sla_archived_at, sla_description, sla_id, sla_name, sla_resolution_minutes,
+    sla_response_minutes FROM slas ORDER BY sla_archived_at IS NOT NULL, sla_name ASC");
 
 // Active plans for the assignment dropdowns
 $active_slas = [];

admin/software_templates.php

@@ -8,7 +8,9 @@ require_once "includes/inc_all_admin.php";
 
 $sql = mysqli_query(
     $mysqli,
-    "SELECT SQL_CALC_FOUND_ROWS * FROM software_templates
+    "SELECT SQL_CALC_FOUND_ROWS software_template_description, software_template_id, software_template_license_type,
+        software_template_name, software_template_notes, software_template_type,
+        software_template_version FROM software_templates
     WHERE software_template_name LIKE '%$q%' OR software_template_type LIKE '%$q%'
     ORDER BY $sort $order LIMIT $record_from, $record_to"
 );

admin/tags.php

@@ -26,7 +26,7 @@ $tag_type_display = $tag_types[$type_filter]['label'] ?? 'Unknown';
 
 $sql = mysqli_query(
     $mysqli,
-    "SELECT SQL_CALC_FOUND_ROWS * FROM tags
+    "SELECT SQL_CALC_FOUND_ROWS tag_color, tag_icon, tag_id, tag_name FROM tags
     WHERE tag_name LIKE '%$q%'
     AND tag_type = $type_filter
     ORDER BY $sort $order LIMIT $record_from, $record_to"

admin/tax_rates.php

@@ -8,7 +8,7 @@ require_once "includes/inc_all_admin.php";
 
 $sql = mysqli_query(
     $mysqli,
-    "SELECT * FROM taxes
+    "SELECT tax_id, tax_name, tax_percent FROM taxes
     WHERE tax_archived_at IS NULL
     ORDER BY $sort $order"
 );

admin/ticket_statuses.php

@@ -8,7 +8,8 @@ require_once "includes/inc_all_admin.php";
 
 $sql = mysqli_query(
     $mysqli,
-    "SELECT SQL_CALC_FOUND_ROWS * FROM ticket_statuses
+    "SELECT SQL_CALC_FOUND_ROWS ticket_status_active, ticket_status_color, ticket_status_id, ticket_status_name,
+        ticket_status_pauses_sla FROM ticket_statuses
     WHERE ticket_status_name LIKE '%$q%'
     ORDER BY $sort $order LIMIT $record_from, $record_to"
 );

admin/ticket_template.php

@@ -15,7 +15,8 @@ if (isset($_GET['ticket_template_id'])) {
     $ticket_template_id = intval($_GET['ticket_template_id']);
 }
 
-$sql_ticket_template = mysqli_query($mysqli, "SELECT * FROM ticket_templates WHERE ticket_template_id = $ticket_template_id LIMIT 1");
+$sql_ticket_template = mysqli_query($mysqli, "SELECT ticket_template_created_at, ticket_template_description, ticket_template_details,
+    ticket_template_name, ticket_template_subject, ticket_template_updated_at FROM ticket_templates WHERE ticket_template_id = $ticket_template_id LIMIT 1");
 
 if (mysqli_num_rows($sql_ticket_template) == 0) {
     echo "<center><h1 class='text-secondary mt-5'>Nothing to see here</h1><a class='btn btn-lg btn-secondary mt-3' href='javascript:history.back()'><i class='fa fa-fw fa-arrow-left'></i> Go Back</a></center>";
@@ -33,7 +34,7 @@ $ticket_template_created_at = escapeHtml($row['ticket_template_created_at']);
 $ticket_template_updated_at = escapeHtml($row['ticket_template_updated_at']);
 
 // Get Task Templates
-$sql_task_templates = mysqli_query($mysqli, "SELECT * FROM task_templates WHERE task_template_ticket_template_id = $ticket_template_id ORDER BY task_template_order ASC, task_template_id ASC");
+$sql_task_templates = mysqli_query($mysqli, "SELECT task_template_completion_estimate, task_template_id, task_template_name FROM task_templates WHERE task_template_ticket_template_id = $ticket_template_id ORDER BY task_template_order ASC, task_template_id ASC");
 
 ?>
 

admin/users.php

@@ -8,7 +8,8 @@ require_once "includes/inc_all_admin.php";
 
 $sql = mysqli_query(
     $mysqli,
-    "SELECT SQL_CALC_FOUND_ROWS * FROM users
+    "SELECT SQL_CALC_FOUND_ROWS role_name, user_archived_at, user_avatar, user_config_force_mfa, user_email,
+        user_settings.user_id, user_name, user_role_id, user_status, user_token FROM users
     LEFT JOIN user_roles ON user_role_id = role_id
     LEFT JOIN user_settings ON users.user_id = user_settings.user_id
     WHERE (user_name LIKE '%$q%' OR user_email LIKE '%$q%')
@@ -132,7 +133,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
 
                     $sql_last_login = mysqli_query(
                         $mysqli,
-                        "SELECT * FROM logs
+                        "SELECT log_created_at, log_ip, log_user_agent FROM logs
                         WHERE log_user_id = $user_id AND log_type = 'Login'
                         ORDER BY log_id DESC LIMIT 1"
                     );
@@ -155,7 +156,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                         $client_access_array[] = intval($row['client_id']);
                     }
 
-                    $sql_remember_tokens = mysqli_query($mysqli, "SELECT * FROM remember_tokens WHERE remember_token_user_id = $user_id");
+                    $sql_remember_tokens = mysqli_query($mysqli, "SELECT 1 FROM remember_tokens WHERE remember_token_user_id = $user_id");
                     $remember_token_count = mysqli_num_rows($sql_remember_tokens);
 
 

admin/vendor_templates.php

@@ -8,7 +8,10 @@ require_once "includes/inc_all_admin.php";
 
 $sql = mysqli_query(
     $mysqli,
-    "SELECT SQL_CALC_FOUND_ROWS * FROM vendor_templates
+    "SELECT SQL_CALC_FOUND_ROWS vendor_template_account_number, vendor_template_code, vendor_template_contact_name,
+        vendor_template_description, vendor_template_email, vendor_template_extension,
+        vendor_template_hours, vendor_template_id, vendor_template_name, vendor_template_notes,
+        vendor_template_phone, vendor_template_sla, vendor_template_website FROM vendor_templates
     WHERE vendor_template_name LIKE '%$q%' OR vendor_template_description LIKE '%$q%' OR vendor_template_account_number LIKE '%$q%' OR vendor_template_website LIKE '%$q%' OR vendor_template_contact_name LIKE '%$q%' OR vendor_template_email LIKE '%$q%' OR vendor_template_phone LIKE '%$phone_query%' ORDER BY $sort $order LIMIT $record_from, $record_to"
 );
 

agent/accounts.php

@@ -11,7 +11,7 @@ enforceUserPermission('module_financial');
 
 $sql = mysqli_query(
     $mysqli,
-    "SELECT SQL_CALC_FOUND_ROWS * FROM accounts
+    "SELECT SQL_CALC_FOUND_ROWS account_currency_code, account_id, account_name, account_notes, opening_balance FROM accounts
     WHERE (account_name LIKE '%$q%')
     AND account_archived_at IS NULL
     ORDER BY $sort $order LIMIT $record_from, $record_to"

agent/ajax.php

@@ -239,7 +239,7 @@ if (isset($_GET['share_generate_link'])) {
         $url = "https://$config_base_url/guest/guest_view_item.php?id=$share_id&key=$item_key";
     }
 
-    $sql = mysqli_query($mysqli,"SELECT * FROM companies WHERE company_id = 1");
+    $sql = mysqli_query($mysqli,"SELECT company_name, company_phone, company_phone_country_code FROM companies WHERE company_id = 1");
     $row = mysqli_fetch_assoc($sql);
     $company_name = escapeSql($row['company_name']);
     $company_phone = escapeSql(formatPhoneNumber($row['company_phone'], $row['company_phone_country_code']));
@@ -294,7 +294,7 @@ if (isset($_GET['get_active_clients'])) {
         $mysqli,
         "SELECT client_id, client_name FROM clients
         WHERE client_archived_at IS NULL
-        $access_permission_query
+        " . clientScopeSql('clients.client_id') . "
         ORDER BY client_accessed_at DESC"
     );
 
@@ -320,7 +320,7 @@ if (isset($_GET['get_client_contacts'])) {
         "SELECT contact_id, contact_name, contact_title, contact_email, contact_primary, contact_important, contact_technical FROM contacts
         LEFT JOIN clients on contact_client_id = client_id
         WHERE contacts.contact_archived_at IS NULL AND contact_client_id = $client_id
-        $access_permission_query
+        " . clientScopeSql('contact_client_id') . "
         ORDER BY contact_primary DESC, contact_technical DESC, contact_important DESC, contact_name"
     );
 
@@ -350,7 +350,7 @@ if (isset($_GET['get_client_assets'])) {
         LEFT JOIN clients on asset_client_id = client_id
         LEFT JOIN contacts ON contact_id = asset_contact_id
         WHERE assets.asset_archived_at IS NULL AND asset_client_id = $client_id
-        $access_permission_query
+        " . clientScopeSql('asset_client_id') . "
         ORDER BY asset_type ASC, asset_favorite DESC, asset_name"
     );
 
@@ -379,7 +379,7 @@ if (isset($_GET['get_client_locations'])) {
         "SELECT location_id, location_name FROM locations
         LEFT JOIN clients on location_client_id = client_id
         WHERE locations.location_archived_at IS NULL AND location_client_id = $client_id
-        $access_permission_query
+        " . clientScopeSql('location_client_id') . "
         ORDER BY location_primary DESC, location_name ASC"
     );
 
@@ -408,7 +408,7 @@ if (isset($_GET['get_client_vendors'])) {
         "SELECT vendor_id, vendor_name FROM vendors
         LEFT JOIN clients on vendor_client_id = client_id
         WHERE vendors.vendor_archived_at IS NULL AND vendor_client_id = $client_id
-        $access_permission_query
+        " . clientScopeSql('vendor_client_id') . "
         ORDER BY vendor_name ASC"
     );
 
@@ -437,7 +437,7 @@ if (isset($_GET['get_client_projects'])) {
         "SELECT project_id, project_name FROM projects
         LEFT JOIN clients on project_client_id = client_id
         WHERE projects.project_archived_at IS NULL AND projects.project_completed_at IS NULL AND project_client_id = $client_id
-        $access_permission_query
+        " . clientScopeSql('project_client_id') . "
         ORDER BY project_name ASC"
     );
 
@@ -564,7 +564,6 @@ if (isset($_POST['update_kanban_ticket'])) {
 
                     // Get details
                     $ticket_sql = mysqli_query($mysqli, "SELECT contact_name, contact_email, ticket_prefix, ticket_number, ticket_subject, ticket_status_name, ticket_assigned_to, ticket_url_key, ticket_client_id FROM tickets
-                        LEFT JOIN clients ON ticket_client_id = client_id
                         LEFT JOIN contacts ON ticket_contact_id = contact_id
                         LEFT JOIN ticket_statuses ON ticket_status = ticket_status_id
                         WHERE ticket_id = $ticket_id
@@ -838,127 +837,88 @@ if (isset($_GET['ai_reword'])) {
 
     header('Content-Type: application/json');
 
-    $sql = mysqli_query($mysqli, "SELECT * FROM ai_models LEFT JOIN ai_providers ON ai_model_ai_provider_id = ai_provider_id WHERE ai_model_use_case = 'General' LIMIT 1");
+    // The reword button sits on every TinyMCE instance, so the ticket editor asks for
+    // the Tickets model and everything else gets General. Anything unrecognised is
+    // treated as General rather than trusted into the query.
+    $use_case = ($_GET['use_case'] ?? '') === 'Tickets' ? 'Tickets' : 'General';
 
-    $row = mysqli_fetch_assoc($sql);
-    $model_name = $row['ai_model_name'];
-    $promptText = $row['ai_model_prompt'];
-    $url = $row['ai_provider_api_url'];
-    $key = $row['ai_provider_api_key'];
+    $model = getAiModel($use_case);
+
+    if (!$model) {
+        echo json_encode(['error' => aiModelMissingError($use_case)]);
+        exit;
+    }
 
     // Collecting the input data from the AJAX request.
     $inputJSON = file_get_contents('php://input');
     $input = json_decode($inputJSON, TRUE); // Convert JSON into array.
 
-    $userText = $input['text'];
+    $userText = $input['text'] ?? '';
 
-    // Preparing the data for the OpenAI Chat API request.
-    $data = [
-        "model" => "$model_name", // Specify the model
-        "messages" => [
-            ["role" => "system", "content" => $promptText],
-            ["role" => "user", "content" => $userText],
-        ],
-        "temperature" => 0.5
-    ];
-
-    // Initialize cURL session to the OpenAI Chat API.
-    $ch = curl_init("$url");
-
-    // Set cURL options for the request.
-    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
-    curl_setopt($ch, CURLOPT_POST, true);
-    curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($data));
-    curl_setopt($ch, CURLOPT_HTTPHEADER, [
-        'Content-Type: application/json',
-        'Authorization: Bearer ' . $key,
+    $result = callAiApi($model, [
+        ["role" => "system", "content" => $model['ai_model_prompt']],
+        ["role" => "user", "content" => $userText],
     ]);
 
-    // Execute the cURL session and capture the response.
-    $response = curl_exec($ch);
-    curl_close($ch);
-
-    // Decode the JSON response.
-    $responseData = json_decode($response, true);
-
-    // Check if the response contains the expected data and return it.
-    if (isset($responseData['choices'][0]['message']['content'])) {
-        // Get the response content.
-        $content = $responseData['choices'][0]['message']['content'];
-
-        // Clean any leading "html" word or other unwanted text at the beginning.
-        $content = preg_replace('/^html/i', '', $content);  // Remove any occurrence of 'html' at the start
-
-        // Clean the response content to remove backticks or code block markers.
-        $cleanedContent = str_replace('```', '', $content); // Remove backticks if they exist.
-
-        // Trim any leading/trailing whitespace.
-        $cleanedContent = trim($cleanedContent);
-
-        // Return the cleaned response.
-        echo json_encode(['rewordedText' => $cleanedContent]);
-    } else {
-        // Handle errors or unexpected response structure.
-        echo json_encode(['rewordedText' => 'Failed to get a response from the AI API.']);
+    // Report failures as an error, never as reworded text - the editor writes
+    // rewordedText straight back over the user's content
+    if (!$result['ok']) {
+        echo json_encode(['error' => $result['error']]);
+        exit;
     }
 
+    $content = $result['content'];
+
+    // Clean any leading "html" word or other unwanted text at the beginning.
+    $content = preg_replace('/^html/i', '', $content);  // Remove any occurrence of 'html' at the start
+
+    // Clean the response content to remove backticks or code block markers.
+    $cleanedContent = str_replace('```', '', $content); // Remove backticks if they exist.
+
+    // Trim any leading/trailing whitespace.
+    $cleanedContent = trim($cleanedContent);
+
+    echo json_encode(['rewordedText' => $cleanedContent]);
+
 }
 
 if (isset($_GET['ai_create_document_template'])) {
-    // get_ai_document_template.php
+
+    enforceUserPermission('module_support');
 
     header('Content-Type: text/html; charset=UTF-8');
 
-    $sql = mysqli_query($mysqli, "SELECT * FROM ai_models LEFT JOIN ai_providers ON ai_model_ai_provider_id = ai_provider_id WHERE ai_model_use_case = 'General' LIMIT 1");
-
-    $row = mysqli_fetch_assoc($sql);
-    $model_name = $row['ai_model_name'];
-    $url = $row['ai_provider_api_url'];
-    $key = $row['ai_provider_api_key'];
-
     $prompt = $_POST['prompt'] ?? '';
 
     // Basic validation
-    if(empty($prompt)){
+    if (empty($prompt)) {
         echo "No prompt provided.";
         exit;
     }
 
+    $model = getAiModel('Documentation');
+
+    if (!$model) {
+        echo escapeHtml(aiModelMissingError('Documentation'));
+        exit;
+    }
+
     // Prepare prompt
     $system_message = "You are a helpful IT documentation assistant. You will create a well-structured HTML template for IT documentation based on a given prompt. Include headings, subheadings, bullet points, and possibly tables for clarity. No Lorem Ipsum, use realistic placeholders and professional language.";
     $user_message = "Create an HTML formatted IT documentation template based on the following request:\n\n\"$prompt\"\n\nThe template should be structured, professional, and useful for IT staff. Include relevant sections, instructions, prerequisites, and best practices.";
 
-    $post_data = [
-        "model" => "$model_name",
-        "messages" => [
-            ["role" => "system", "content" => $system_message],
-            ["role" => "user", "content" => $user_message]
-        ],
-        "temperature" => 0.5
-    ];
-
-    $ch = curl_init();
-    curl_setopt($ch, CURLOPT_URL, $url);
-    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
-    curl_setopt($ch, CURLOPT_POST, true);
-    curl_setopt($ch, CURLOPT_HTTPHEADER, [
-        'Content-Type: application/json',
-        'Authorization: Bearer ' . $key
+    $result = callAiApi($model, [
+        ["role" => "system", "content" => $system_message],
+        ["role" => "user", "content" => $user_message]
     ]);
-    curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($post_data));
 
-    $response = curl_exec($ch);
-    if (curl_errno($ch)) {
-        echo "Error: " . curl_error($ch);
+    if (!$result['ok']) {
+        echo "<p>" . escapeHtml($result['error']) . "</p>";
         exit;
     }
-    curl_close($ch);
-
-    $response_data = json_decode($response, true);
-    $template = $response_data['choices'][0]['message']['content'] ?? "<p>No content returned from AI.</p>";
 
     // Print the generated HTML template directly
-    echo $template;
+    echo $result['content'];
 }
 
 if (isset($_GET['ai_ticket_summary'])) {
@@ -967,12 +927,12 @@ if (isset($_GET['ai_ticket_summary'])) {
 
     header('Content-Type: text/html; charset=UTF-8');
 
-    $sql = mysqli_query($mysqli, "SELECT * FROM ai_models LEFT JOIN ai_providers ON ai_model_ai_provider_id = ai_provider_id WHERE ai_model_use_case = 'General' LIMIT 1");
+    $model = getAiModel('Tickets');
 
-    $row = mysqli_fetch_assoc($sql);
-    $model_name = $row['ai_model_name'];
-    $url = $row['ai_provider_api_url'];
-    $key = $row['ai_provider_api_key'];
+    if (!$model) {
+        echo escapeHtml(aiModelMissingError('Tickets'));
+        exit;
+    }
 
     // Retrieve the ticket_id from POST
     $ticket_id = intval($_POST['ticket_id']);
@@ -1049,38 +1009,17 @@ if (isset($_GET['ai_ticket_summary'])) {
     If any part of the ticket or replies is unclear or ambiguous, mention it in the summary and suggest if further clarification is needed.
     ";
 
-    // Prepare the POST data
-    $post_data = [
-        "model" => "$model_name",
-        "messages" => [
-            ["role" => "system", "content" => "Your task is to summarize IT support tickets with clear, concise details."],
-            ["role" => "user", "content" => $prompt]
-        ],
-        "temperature" => 0.3
-    ];
-
-    $ch = curl_init();
-    curl_setopt($ch, CURLOPT_URL, $url);
-    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
-    curl_setopt($ch, CURLOPT_POST, true);
-    curl_setopt($ch, CURLOPT_HTTPHEADER, [
-        'Content-Type: application/json',
-        'Authorization: Bearer ' . $key
+    $result = callAiApi($model, [
+        ["role" => "system", "content" => "Your task is to summarize IT support tickets with clear, concise details."],
+        ["role" => "user", "content" => $prompt]
     ]);
-    curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($post_data));
 
-    $response = curl_exec($ch);
-    if (curl_errno($ch)) {
-        echo "Error: " . curl_error($ch);
+    if (!$result['ok']) {
+        echo "<p>" . escapeHtml($result['error']) . "</p>";
         exit;
     }
-    curl_close($ch);
 
-    $response_data = json_decode($response, true);
-    $summary = $response_data['choices'][0]['message']['content'] ?? "No summary available.";
-
-
-    echo $summary; // nl2br to convert newlines to <br>, htmlspecialchars to prevent XSS
+    echo $result['content'];
 }
 
 // Stops people trying to use sub-domains in the domains tracker

agent/asset.php

@@ -14,7 +14,15 @@ if (isset($_GET['client_id'])) {
 if (isset($_GET['asset_id'])) {
     $asset_id = intval($_GET['asset_id']);
 
-    $sql = mysqli_query($mysqli, "SELECT * FROM assets
+    $sql = mysqli_query($mysqli, "SELECT asset_contact_id, asset_created_at, asset_description, asset_favorite, asset_id,
+        asset_install_date, asset_location_id, asset_make, asset_model, asset_name, asset_notes,
+        asset_os, asset_photo, asset_physical_location, asset_purchase_date,
+        asset_purchase_reference, asset_serial, asset_status, asset_type, asset_uri, asset_uri_2,
+        asset_uri_client, asset_vendor_id, asset_warranty_expire, client_id, client_name,
+        contact_archived_at, contact_email, contact_extension, contact_mobile,
+        contact_mobile_country_code, contact_name, contact_phone, contact_phone_country_code,
+        interface_ip, interface_ipv6, interface_mac, interface_nat_ip, interface_network_id,
+        location_archived_at, location_name FROM assets
         LEFT JOIN clients ON client_id = asset_client_id
         LEFT JOIN contacts ON asset_contact_id = contact_id
         LEFT JOIN locations ON asset_location_id = location_id
@@ -114,7 +122,7 @@ if (isset($_GET['asset_id'])) {
         $recurring_ticket_count = mysqli_num_rows($sql_related_recurring_tickets);
 
         // Related Documents
-        $sql_related_documents = mysqli_query($mysqli, "SELECT * FROM asset_documents
+        $sql_related_documents = mysqli_query($mysqli, "SELECT 1 FROM asset_documents
             LEFT JOIN documents ON asset_documents.document_id = documents.document_id
             WHERE asset_documents.asset_id = $asset_id
             AND document_archived_at IS NULL
@@ -125,7 +133,7 @@ if (isset($_GET['asset_id'])) {
         // Tags - many to many relationship
         $asset_tag_name_display_array = array();
         $asset_tag_id_array = array();
-        $sql_asset_tags = mysqli_query($mysqli, "SELECT * FROM asset_tags LEFT JOIN tags ON asset_tag_tag_id = tag_id WHERE asset_tag_asset_id = $asset_id ORDER BY tag_name ASC");
+        $sql_asset_tags = mysqli_query($mysqli, "SELECT tag_color, tag_icon, tag_id, tag_name FROM asset_tags LEFT JOIN tags ON asset_tag_tag_id = tag_id WHERE asset_tag_asset_id = $asset_id ORDER BY tag_name ASC");
         while ($row = mysqli_fetch_assoc($sql_asset_tags)) {
 
             $asset_tag_id = intval($row['tag_id']);
@@ -186,7 +194,7 @@ if (isset($_GET['asset_id'])) {
         $interface_count = mysqli_num_rows($sql_related_interfaces);
 
         // Related Files
-        $sql_related_files = mysqli_query($mysqli, "SELECT * FROM asset_files
+        $sql_related_files = mysqli_query($mysqli, "SELECT file_created_at, file_description, file_ext, files.file_id, file_name FROM asset_files
             LEFT JOIN files ON asset_files.file_id = files.file_id
             WHERE asset_files.asset_id = $asset_id
             AND file_archived_at IS NULL
@@ -206,7 +214,8 @@ if (isset($_GET['asset_id'])) {
         }
 
         // Related Documents
-        $sql_related_documents = mysqli_query($mysqli, "SELECT * FROM asset_documents, documents
+        $sql_related_documents = mysqli_query($mysqli, "SELECT document_created_at, document_description, documents.document_id, document_name,
+            document_updated_at, user_name FROM asset_documents, documents
             LEFT JOIN users ON document_created_by = user_id
             WHERE asset_documents.asset_id = $asset_id
             AND asset_documents.document_id = documents.document_id
@@ -243,7 +252,9 @@ if (isset($_GET['asset_id'])) {
         // Related Software Query
         $sql_related_software = mysqli_query(
             $mysqli,
-            "SELECT * FROM software_assets
+            "SELECT software_expire, software_assets.software_id, software_key, software_license_type,
+                software_name, software_notes, software_purchase, software_seats, software_type,
+                software_version FROM software_assets
             LEFT JOIN software ON software_assets.software_id = software.software_id
             WHERE software_assets.asset_id = $asset_id
             AND software_archived_at IS NULL
@@ -253,7 +264,8 @@ if (isset($_GET['asset_id'])) {
         $software_count = mysqli_num_rows($sql_related_software);
 
         // Linked Services
-        $sql_linked_services = mysqli_query($mysqli, "SELECT * FROM service_assets, services
+        $sql_linked_services = mysqli_query($mysqli, "SELECT service_category, service_description, service_assets.service_id, service_importance,
+            service_name FROM service_assets, services
             WHERE service_assets.asset_id = $asset_id
             AND service_assets.service_id = services.service_id
             ORDER BY service_name ASC"
@@ -263,7 +275,7 @@ if (isset($_GET['asset_id'])) {
         $linked_services = array();
 
         // Notes - 1 to many relationship
-        $sql_related_notes = mysqli_query($mysqli, "SELECT * FROM asset_notes
+        $sql_related_notes = mysqli_query($mysqli, "SELECT asset_note, asset_note_created_at, asset_note_id, asset_note_type, user_name FROM asset_notes
             LEFT JOIN users ON asset_note_created_by = user_id
             WHERE asset_note_asset_id = $asset_id
             AND asset_note_archived_at IS NULL
@@ -690,7 +702,7 @@ if (isset($_GET['asset_id'])) {
                                     // Tags
                                     $credential_tag_name_display_array = array();
                                     $credential_tag_id_array = array();
-                                    $sql_credential_tags = mysqli_query($mysqli, "SELECT * FROM credential_tags LEFT JOIN tags ON credential_tags.tag_id = tags.tag_id WHERE credential_id = $credential_id ORDER BY tag_name ASC");
+                                    $sql_credential_tags = mysqli_query($mysqli, "SELECT tag_color, tag_icon, credential_tags.tag_id, tag_name FROM credential_tags LEFT JOIN tags ON credential_tags.tag_id = tags.tag_id WHERE credential_id = $credential_id ORDER BY tag_name ASC");
                                     while ($row = mysqli_fetch_assoc($sql_credential_tags)) {
 
                                         $credential_tag_id = intval($row['tag_id']);

agent/assets.php

@@ -124,7 +124,7 @@ $row = mysqli_fetch_assoc(mysqli_query($mysqli, "
         LEFT JOIN tags ON tag_id = asset_tag_tag_id
         WHERE $archive_query
         $tag_query
-        $access_permission_query
+        " . clientScopeSql('asset_client_id') . "
         $client_query
         GROUP BY asset_id
     ) AS filtered_assets;
@@ -150,7 +150,14 @@ $other_count = intval($row['other_count']);
 
 $sql = mysqli_query(
     $mysqli,
-    "SELECT SQL_CALC_FOUND_ROWS * FROM assets
+    "SELECT SQL_CALC_FOUND_ROWS asset_archived_at, asset_contact_id, asset_created_at, asset_description, asset_favorite,
+        asset_id, asset_install_date, asset_location_id, asset_make, asset_model, asset_name,
+        asset_notes, asset_os, asset_photo, asset_physical_location, asset_purchase_date,
+        asset_purchase_reference, asset_serial, asset_status, asset_type, asset_uri, asset_uri_2,
+        asset_uri_client, asset_vendor_id, asset_warranty_expire, client_id, client_name,
+        contact_archived_at, contact_name, interface_ip, interface_ipv6, interface_mac,
+        interface_nat_ip, interface_network_id, location_archived_at, location_name, tag_color,
+        tag_icon, tag_id, tag_name FROM assets
     LEFT JOIN clients ON asset_client_id = client_id
     LEFT JOIN contacts ON asset_contact_id = contact_id
     LEFT JOIN locations ON asset_location_id = location_id
@@ -161,7 +168,7 @@ $sql = mysqli_query(
     $tag_query
     AND (asset_name LIKE '%$q%' OR asset_description LIKE '%$q%' OR asset_type LIKE '%$q%' OR interface_ip LIKE '%$q%' OR interface_ipv6 LIKE '%$q%' OR interface_mac LIKE '%$q%' OR asset_make LIKE '%$q%' OR asset_model LIKE '%$q%' OR asset_serial LIKE '%$q%' OR asset_os LIKE '%$q%' OR contact_name LIKE '%$q%' OR location_name LIKE '%$q%' OR client_name LIKE '%$q%' OR tag_name LIKE '%$q%')
     AND ($type_query)
-    $access_permission_query
+    " . clientScopeSql('asset_client_id') . "
     $location_query
     $expire_query
     $client_query
@@ -288,7 +295,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                                 FROM clients
                                 JOIN assets ON asset_client_id = client_id
                                 WHERE $archive_query
-                                $access_permission_query
+                                " . clientScopeSql('clients.client_id') . "
                                 ORDER BY client_name ASC
                             ");
                             while ($row = mysqli_fetch_assoc($sql_clients_filter)) {
@@ -634,13 +641,13 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                             $location_name_display = $location_name;
                         }
 
-                        $sql_credentials = mysqli_query($mysqli, "SELECT * FROM credentials WHERE credential_asset_id = $asset_id");
+                        $sql_credentials = mysqli_query($mysqli, "SELECT 1 FROM credentials WHERE credential_asset_id = $asset_id");
                         $credential_count = mysqli_num_rows($sql_credentials);
 
                         // Tags
                         $asset_tag_name_display_array = array();
                         $asset_tag_id_array = array();
-                        $sql_asset_tags = mysqli_query($mysqli, "SELECT * FROM asset_tags LEFT JOIN tags ON asset_tag_tag_id = tag_id WHERE asset_tag_asset_id = $asset_id ORDER BY tag_name ASC");
+                        $sql_asset_tags = mysqli_query($mysqli, "SELECT tag_color, tag_icon, tag_id, tag_name FROM asset_tags LEFT JOIN tags ON asset_tag_tag_id = tag_id WHERE asset_tag_asset_id = $asset_id ORDER BY tag_name ASC");
                         while ($row = mysqli_fetch_assoc($sql_asset_tags)) {
 
                             $asset_tag_id = intval($row['tag_id']);

agent/calendar.php

@@ -38,7 +38,7 @@ if (isset($_GET['calendar_id'])) {
             </div>
             <div class="card-body">
                 <?php
-                $sql = mysqli_query($mysqli, "SELECT * FROM calendars");
+                $sql = mysqli_query($mysqli, "SELECT calendar_color, calendar_feed_key, calendar_id, calendar_name FROM calendars");
                 while ($row = mysqli_fetch_assoc($sql)) {
                     $calendar_id = intval($row['calendar_id']);
                     $calendar_name = escapeHtml($row['calendar_name']);
@@ -135,7 +135,8 @@ if (isset($_GET['calendar_id'])) {
 require_once "modals/calendar/calendar_event_add.php";
 
 //loop through IDs and create a modal for each
-$sql = mysqli_query($mysqli, "SELECT * FROM calendar_events LEFT JOIN calendars ON event_calendar_id = calendar_id $client_event_query");
+$sql = mysqli_query($mysqli, "SELECT calendar_color, calendar_id, calendar_name, event_client_id, event_description, event_end,
+    event_id, event_location, event_repeat, event_start, event_title FROM calendar_events LEFT JOIN calendars ON event_calendar_id = calendar_id $client_event_query");
 while ($row = mysqli_fetch_assoc($sql)) {
     $event_id = intval($row['event_id']);
     $event_title = escapeHtml($row['event_title']);
@@ -303,7 +304,8 @@ while ($row = mysqli_fetch_assoc($sql)) {
         },
         events: [
             <?php
-            $sql = mysqli_query($mysqli, "SELECT * FROM calendar_events LEFT JOIN calendars ON event_calendar_id = calendar_id $client_event_query");
+            $sql = mysqli_query($mysqli, "SELECT calendar_color, calendar_id, calendar_name, event_all_day, event_end, event_id,
+                event_repeat, event_start, event_title FROM calendar_events LEFT JOIN calendars ON event_calendar_id = calendar_id $client_event_query");
 
             // Repeating events are stored as a single row, so the occurrences have to
             // be materialised here - the bundled FullCalendar build has no rrule
@@ -341,7 +343,7 @@ while ($row = mysqli_fetch_assoc($sql)) {
             }
 
             // Invoices Created
-            $sql = mysqli_query($mysqli, "SELECT * FROM clients LEFT JOIN invoices ON client_id = invoice_client_id $client_query $access_permission_query");
+            $sql = mysqli_query($mysqli, "SELECT invoice_date, invoice_id, invoice_number, invoice_prefix, invoice_scope FROM clients LEFT JOIN invoices ON client_id = invoice_client_id $client_query " . clientScopeSql('clients.client_id') . "");
             while ($row = mysqli_fetch_assoc($sql)) {
                 $event_id = intval($row['invoice_id']);
                 $scope = strval($row['invoice_scope']);
@@ -356,7 +358,7 @@ while ($row = mysqli_fetch_assoc($sql)) {
             }
 
             // Quotes Created
-            $sql = mysqli_query($mysqli, "SELECT * FROM clients LEFT JOIN quotes ON client_id = quote_client_id $client_query $access_permission_query");
+            $sql = mysqli_query($mysqli, "SELECT quote_date, quote_id, quote_number, quote_prefix, quote_scope FROM clients LEFT JOIN quotes ON client_id = quote_client_id $client_query " . clientScopeSql('clients.client_id') . "");
             while ($row = mysqli_fetch_assoc($sql)) {
                 $event_id = intval($row['quote_id']);
                 $event_title = json_encode($row['quote_prefix'] . $row['quote_number'] . " " . $row['quote_scope']);
@@ -366,11 +368,12 @@ while ($row = mysqli_fetch_assoc($sql)) {
             }
 
             // Tickets Created
-            $sql = mysqli_query($mysqli, "SELECT * FROM clients
+            $sql = mysqli_query($mysqli, "SELECT ticket_created_at, ticket_id, ticket_number, ticket_prefix, ticket_status,
+                ticket_status_name, ticket_subject, user_name FROM clients
                 LEFT JOIN tickets ON client_id = ticket_client_id
                 LEFT JOIN ticket_statuses ON ticket_status = ticket_status_id
                 LEFT JOIN users ON ticket_assigned_to = user_id
-                $client_query $access_permission_query"
+                $client_query " . clientScopeSql('clients.client_id') . ""
             );
             while ($row = mysqli_fetch_assoc($sql)) {
                 $event_id = intval($row['ticket_id']);
@@ -401,10 +404,11 @@ while ($row = mysqli_fetch_assoc($sql)) {
             }
 
             // Recurring Tickets
-            $sql = mysqli_query($mysqli, "SELECT * FROM clients
+            $sql = mysqli_query($mysqli, "SELECT client_id, recurring_ticket_frequency, recurring_ticket_id, recurring_ticket_next_run,
+                recurring_ticket_subject, user_name FROM clients
                 LEFT JOIN recurring_tickets ON client_id = recurring_ticket_client_id
                 LEFT JOIN users ON recurring_ticket_assigned_to = user_id
-                $client_query $access_permission_query"
+                $client_query " . clientScopeSql('clients.client_id') . ""
             );
             while ($row = mysqli_fetch_assoc($sql)) {
                 $event_id = intval($row['recurring_ticket_id']);
@@ -425,11 +429,12 @@ while ($row = mysqli_fetch_assoc($sql)) {
             }
 
             // Tickets Scheduled
-            $sql = mysqli_query($mysqli, "SELECT * FROM clients
+            $sql = mysqli_query($mysqli, "SELECT ticket_id, ticket_number, ticket_prefix, ticket_schedule, ticket_status_name,
+                ticket_subject, user_name FROM clients
                 LEFT JOIN tickets ON client_id = ticket_client_id
                 LEFT JOIN ticket_statuses ON ticket_status = ticket_status_id
                 LEFT JOIN users ON ticket_assigned_to = user_id
-                $client_query $access_permission_query AND ticket_schedule IS NOT NULL"
+                $client_query " . clientScopeSql('clients.client_id') . " AND ticket_schedule IS NOT NULL"
             );
             while ($row = mysqli_fetch_assoc($sql)) {
                 $event_id = intval($row['ticket_id']);
@@ -460,7 +465,7 @@ while ($row = mysqli_fetch_assoc($sql)) {
             }
 
             // Vendors Added Created
-            $sql = mysqli_query($mysqli, "SELECT * FROM clients LEFT JOIN vendors ON client_id = vendor_client_id $client_query $access_permission_query");
+            $sql = mysqli_query($mysqli, "SELECT client_id, vendor_created_at, vendor_id, vendor_name FROM clients LEFT JOIN vendors ON client_id = vendor_client_id $client_query " . clientScopeSql('clients.client_id') . "");
             while ($row = mysqli_fetch_assoc($sql)) {
                 $event_id = intval($row['vendor_id']);
                 $client_id = intval($row['client_id']);
@@ -472,7 +477,7 @@ while ($row = mysqli_fetch_assoc($sql)) {
 
             if (!isset($_GET['client_id'])) {
                 //Clients Added
-                $sql = mysqli_query($mysqli, "SELECT * FROM clients");
+                $sql = mysqli_query($mysqli, "SELECT client_created_at, client_id, client_name FROM clients");
                 while ($row = mysqli_fetch_assoc($sql)) {
                     $event_id = intval($row['client_id']);
                     $event_title = json_encode("Client: '" . $row['client_name'] . "' created");

agent/certificates.php

@@ -61,11 +61,13 @@ if (!$client_url) {
     }
 }
 
-$sql = mysqli_query($mysqli, "SELECT SQL_CALC_FOUND_ROWS * FROM certificates
+$sql = mysqli_query($mysqli, "SELECT SQL_CALC_FOUND_ROWS certificate_archived_at, certificate_created_at, certificate_description,
+    certificate_domain, certificate_expire, certificate_id, certificate_issued_by,
+    certificate_name, client_id, client_name FROM certificates
     LEFT JOIN clients ON client_id = certificate_client_id
     WHERE $archive_query
     AND (certificate_name LIKE '%$q%' OR certificate_domain LIKE '%$q%' OR certificate_description LIKE '%$q%' OR certificate_issued_by LIKE '%$q%' OR client_name LIKE '%$q%')
-    $access_permission_query
+    " . clientScopeSql('certificate_client_id') . "
     $client_query
     $expire_query
     ORDER BY $sort $order LIMIT $record_from, $record_to"
@@ -122,7 +124,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                                 FROM clients
                                 JOIN certificates ON certificate_client_id = client_id
                                 WHERE $archive_query
-                                $access_permission_query
+                                " . clientScopeSql('clients.client_id') . "
                                 ORDER BY client_name ASC
                             ");
                             while ($row = mysqli_fetch_assoc($sql_clients_filter)) {

agent/client_overview.php

@@ -4,7 +4,7 @@ require_once "includes/inc_all_client.php";
 
 $sql_recent_activities = mysqli_query(
     $mysqli,
-    "SELECT * FROM logs
+    "SELECT log_created_at, log_description FROM logs
     WHERE log_client_id = $client_id
     ORDER BY log_created_at DESC
     LIMIT 5"
@@ -12,7 +12,9 @@ $sql_recent_activities = mysqli_query(
 
 $sql_important_contacts = mysqli_query(
     $mysqli,
-    "SELECT * FROM contacts
+    "SELECT contact_email, contact_extension, contact_id, contact_mobile, contact_mobile_country_code,
+        contact_name, contact_phone, contact_phone_country_code, contact_photo, contact_primary,
+        contact_title FROM contacts
     WHERE contact_client_id = $client_id
         AND (contact_important = 1
             OR contact_billing = 1
@@ -25,7 +27,7 @@ $sql_important_contacts = mysqli_query(
 
 $sql_favorite_assets = mysqli_query(
     $mysqli,
-    "SELECT * FROM assets
+    "SELECT asset_id, asset_make, asset_model, asset_name, asset_type FROM assets
     WHERE asset_client_id = $client_id
         AND asset_favorite = 1
         AND asset_archived_at IS NULL
@@ -34,7 +36,8 @@ $sql_favorite_assets = mysqli_query(
 
 $sql_favorite_credentials = mysqli_query(
     $mysqli,
-    "SELECT * FROM credentials
+    "SELECT credential_description, credential_id, credential_name, credential_otp_secret,
+        credential_uri, credential_uri_2, credential_username FROM credentials
     WHERE credential_client_id = $client_id
         AND credential_favorite = 1
         AND credential_archived_at IS NULL
@@ -60,7 +63,8 @@ $sql_recent_credentials = mysqli_query(
 
 $sql_shared_items = mysqli_query(
     $mysqli,
-    "SELECT * FROM shared_items
+    "SELECT item_active, item_created_at, item_expire_at, item_id, item_key, item_note, item_recipient,
+        item_related_id, item_type, item_view_limit, item_views FROM shared_items
     WHERE item_client_id = $client_id
         AND item_active = 1
     ORDER BY item_created_at ASC
@@ -74,7 +78,7 @@ $sql_shared_items = mysqli_query(
 // Stale Tickets
 $sql_stale_tickets = mysqli_query(
     $mysqli,
-    "SELECT * FROM tickets
+    "SELECT ticket_created_at, ticket_id, ticket_number, ticket_prefix, ticket_subject FROM tickets
     WHERE ticket_client_id = $client_id
         AND ticket_updated_at < CURRENT_DATE - INTERVAL 7 DAY
         AND ticket_resolved_At IS NULL
@@ -87,7 +91,7 @@ $sql_stale_tickets = mysqli_query(
 // Get Domains Expiring
 $sql_domains_expiring = mysqli_query(
     $mysqli,
-    "SELECT * FROM domains
+    "SELECT domain_expire, domain_id, domain_name FROM domains
     WHERE domain_client_id = $client_id
         AND domain_expire IS NOT NULL
         AND domain_archived_at IS NULL
@@ -99,7 +103,7 @@ $sql_domains_expiring = mysqli_query(
 // Get Certificates Expiring
 $sql_certificates_expiring = mysqli_query(
     $mysqli,
-    "SELECT * FROM certificates
+    "SELECT certificate_expire, certificate_id, certificate_name FROM certificates
     WHERE certificate_client_id = $client_id
         AND certificate_expire IS NOT NULL
         AND certificate_archived_at IS NULL
@@ -111,7 +115,7 @@ $sql_certificates_expiring = mysqli_query(
 // Get Licenses Expiring
 $sql_licenses_expiring = mysqli_query(
     $mysqli,
-    "SELECT * FROM software
+    "SELECT software_expire, software_id, software_name FROM software
     WHERE software_client_id = $client_id
         AND software_expire IS NOT NULL
         AND software_archived_at IS NULL
@@ -123,7 +127,7 @@ $sql_licenses_expiring = mysqli_query(
 // Get Asset Warranties Expiring
 $sql_asset_warranties_expiring = mysqli_query(
     $mysqli,
-    "SELECT * FROM assets
+    "SELECT asset_id, asset_name, asset_warranty_expire FROM assets
     WHERE asset_client_id = $client_id
         AND asset_warranty_expire IS NOT NULL
         AND asset_archived_at IS NULL
@@ -135,7 +139,7 @@ $sql_asset_warranties_expiring = mysqli_query(
 // Get Assets Retiring 7 Year
 $sql_asset_retire = mysqli_query(
     $mysqli,
-    "SELECT * FROM assets
+    "SELECT asset_id, asset_install_date, asset_name FROM assets
     WHERE asset_client_id = $client_id
         AND asset_install_date IS NOT NULL
         AND asset_archived_at IS NULL
@@ -151,7 +155,7 @@ $sql_asset_retire = mysqli_query(
 // Get Domains Expired
 $sql_domains_expired = mysqli_query(
     $mysqli,
-    "SELECT * FROM domains
+    "SELECT domain_expire, domain_id, domain_name FROM domains
     WHERE domain_client_id = $client_id
         AND domain_expire IS NOT NULL
         AND domain_archived_at IS NULL
@@ -162,7 +166,7 @@ $sql_domains_expired = mysqli_query(
 // Get Certificates Expired
 $sql_certificates_expired = mysqli_query(
     $mysqli,
-    "SELECT * FROM certificates
+    "SELECT certificate_expire, certificate_id, certificate_name FROM certificates
     WHERE certificate_client_id = $client_id
         AND certificate_expire IS NOT NULL
         AND certificate_archived_at IS NULL
@@ -173,7 +177,7 @@ $sql_certificates_expired = mysqli_query(
 // Get Licenses Expired
 $sql_licenses_expired = mysqli_query(
     $mysqli,
-    "SELECT * FROM software
+    "SELECT software_expire, software_id, software_name FROM software
     WHERE software_client_id = $client_id
         AND software_expire IS NOT NULL
         AND software_archived_at IS NULL
@@ -184,7 +188,7 @@ $sql_licenses_expired = mysqli_query(
 // Get Asset Warranties Expired
 $sql_asset_warranties_expired = mysqli_query(
     $mysqli,
-    "SELECT * FROM assets
+    "SELECT asset_id, asset_name, asset_warranty_expire FROM assets
     WHERE asset_client_id = $client_id
         AND asset_warranty_expire IS NOT NULL
         AND asset_archived_at IS NULL
@@ -195,7 +199,7 @@ $sql_asset_warranties_expired = mysqli_query(
 // Get Retired Assets
 $sql_asset_retired = mysqli_query(
     $mysqli,
-    "SELECT * FROM assets
+    "SELECT asset_id, asset_install_date, asset_name FROM assets
     WHERE asset_client_id = $client_id
         AND asset_install_date IS NOT NULL
         AND asset_archived_at IS NULL

agent/clients.php

@@ -67,7 +67,7 @@ $sql = mysqli_query(
       AND client_$archive_query
       AND DATE(client_created_at) BETWEEN '$dtf' AND '$dtt'
       $leads_query
-      $access_permission_query
+      " . clientScopeSql('clients.client_id') . "
       $tag_query
       $industry_query
       $referral_query
@@ -369,7 +369,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                     // Client Tags
                     $client_tag_name_display_array = array();
                     $client_tag_id_array = array();
-                    $sql_client_tags = mysqli_query($mysqli, "SELECT * FROM client_tags LEFT JOIN tags ON client_tags.tag_id = tags.tag_id WHERE client_id = $client_id ORDER BY tag_name ASC");
+                    $sql_client_tags = mysqli_query($mysqli, "SELECT tag_color, tag_icon, client_tags.tag_id, tag_name FROM client_tags LEFT JOIN tags ON client_tags.tag_id = tags.tag_id WHERE client_id = $client_id ORDER BY tag_name ASC");
                     while ($row = mysqli_fetch_assoc($sql_client_tags)) {
                         $client_tag_id = intval($row['tag_id']);
                         $client_tag_name = escapeHtml($row['tag_name']);

agent/contact.php

@@ -14,7 +14,11 @@ if (isset($_GET['client_id'])) {
 if (isset($_GET['contact_id'])) {
     $contact_id = intval($_GET['contact_id']);
 
-    $sql = mysqli_query($mysqli, "SELECT * FROM contacts
+    $sql = mysqli_query($mysqli, "SELECT client_id, client_name, contact_billing, contact_client_id, contact_created_at,
+        contact_department, contact_email, contact_extension, contact_important,
+        contact_location_id, contact_mobile, contact_mobile_country_code, contact_name,
+        contact_notes, contact_phone, contact_phone_country_code, contact_photo, contact_pin,
+        contact_primary, contact_technical, contact_title, location_name, user_auth_method FROM contacts
         LEFT JOIN clients ON client_id = contact_client_id
         LEFT JOIN locations ON location_id = contact_location_id
         LEFT JOIN users ON user_id = contact_user_id
@@ -64,7 +68,11 @@ if (isset($_GET['contact_id'])) {
     }
 
     // Related Assets Query - 1 to 1 relationship
-    $sql_related_assets = mysqli_query($mysqli, "SELECT * FROM assets
+    $sql_related_assets = mysqli_query($mysqli, "SELECT asset_created_at, asset_description, asset_favorite, asset_id, asset_install_date,
+        asset_make, asset_model, asset_name, asset_notes, asset_os, asset_photo,
+        asset_physical_location, asset_purchase_date, asset_serial, asset_status, asset_type,
+        asset_uri, asset_uri_2, asset_warranty_expire, interface_ip, interface_ipv6, interface_mac,
+        interface_nat_ip, tag_color, tag_icon, tag_id, tag_name FROM assets
         LEFT JOIN asset_interfaces ON interface_asset_id = asset_id AND interface_primary = 1
         LEFT JOIN asset_tags ON asset_tag_asset_id = asset_id
         LEFT JOIN tags ON tag_id = asset_tag_tag_id
@@ -75,7 +83,9 @@ if (isset($_GET['contact_id'])) {
     $asset_count = mysqli_num_rows($sql_related_assets);
 
     // Linked Software Licenses
-    $sql_linked_software = mysqli_query($mysqli, "SELECT * FROM software_contacts, software
+    $sql_linked_software = mysqli_query($mysqli, "SELECT software_expire, software_contacts.software_id, software_key, software_license_type,
+        software_name, software_notes, software_purchase, software_seats, software_type,
+        software_version FROM software_contacts, software
         WHERE software_contacts.contact_id = $contact_id
         AND software_contacts.software_id = software.software_id
         AND software_archived_at IS NULL
@@ -102,14 +112,17 @@ if (isset($_GET['contact_id'])) {
     $credential_count = mysqli_num_rows($sql_related_credentials);
 
     // Related Tickets Query - 1 to 1 relationship
-    $sql_related_tickets = mysqli_query($mysqli, "SELECT * FROM tickets
+    $sql_related_tickets = mysqli_query($mysqli, "SELECT ticket_assigned_to, ticket_closed_at, ticket_created_at, ticket_id, ticket_number,
+        ticket_prefix, ticket_priority, ticket_status, ticket_status_color, ticket_status_name,
+        ticket_subject, ticket_updated_at, user_name FROM tickets
         LEFT JOIN users ON ticket_assigned_to = user_id
         LEFT JOIN ticket_statuses ON ticket_status = ticket_status_id
         WHERE ticket_contact_id = $contact_id ORDER BY ticket_id DESC");
     $ticket_count = mysqli_num_rows($sql_related_tickets);
 
     // Related Recurring Tickets Query
-    $sql_related_recurring_tickets = mysqli_query($mysqli, "SELECT * FROM recurring_tickets
+    $sql_related_recurring_tickets = mysqli_query($mysqli, "SELECT recurring_ticket_frequency, recurring_ticket_id, recurring_ticket_next_run,
+        recurring_ticket_priority, recurring_ticket_subject FROM recurring_tickets
         WHERE recurring_ticket_contact_id = $contact_id
         ORDER BY recurring_ticket_next_run DESC"
     );
@@ -119,7 +132,7 @@ if (isset($_GET['contact_id'])) {
     // Tags - many to many relationship
     $contact_tag_name_display_array = array();
     $contact_tag_id_array = array();
-    $sql_contact_tags = mysqli_query($mysqli, "SELECT * FROM contact_tags LEFT JOIN tags ON contact_tags.tag_id = tags.tag_id WHERE contact_id = $contact_id ORDER BY tag_name ASC");
+    $sql_contact_tags = mysqli_query($mysqli, "SELECT tag_color, tag_icon, contact_tags.tag_id, tag_name FROM contact_tags LEFT JOIN tags ON contact_tags.tag_id = tags.tag_id WHERE contact_id = $contact_id ORDER BY tag_name ASC");
     while ($row = mysqli_fetch_assoc($sql_contact_tags)) {
 
         $contact_tag_id = intval($row['tag_id']);
@@ -139,7 +152,7 @@ if (isset($_GET['contact_id'])) {
     $contact_tags_display = implode('', $contact_tag_name_display_array);
 
     // Notes - 1 to 1 relationship
-    $sql_related_notes = mysqli_query($mysqli, "SELECT * FROM contact_notes LEFT JOIN users ON contact_note_created_by = user_id WHERE contact_note_contact_id = $contact_id AND contact_note_archived_at IS NULL ORDER BY contact_note_created_at DESC");
+    $sql_related_notes = mysqli_query($mysqli, "SELECT contact_note, contact_note_created_at, contact_note_id, contact_note_type, user_name FROM contact_notes LEFT JOIN users ON contact_note_created_by = user_id WHERE contact_note_contact_id = $contact_id AND contact_note_archived_at IS NULL ORDER BY contact_note_created_at DESC");
     $note_count = mysqli_num_rows($sql_related_notes);
 
     // Note type icons, read from the categories list so the seeded icons
@@ -151,7 +164,8 @@ if (isset($_GET['contact_id'])) {
     }
 
      // Linked Services
-    $sql_linked_services = mysqli_query($mysqli, "SELECT * FROM service_contacts, services
+    $sql_linked_services = mysqli_query($mysqli, "SELECT service_category, service_description, service_contacts.service_id, service_importance,
+        service_name FROM service_contacts, services
         WHERE service_contacts.contact_id = $contact_id
         AND service_contacts.service_id = services.service_id
         ORDER BY service_name ASC"
@@ -161,7 +175,8 @@ if (isset($_GET['contact_id'])) {
     $linked_services = array();
 
     // Linked Documents
-    $sql_linked_documents = mysqli_query($mysqli, "SELECT * FROM contact_documents, documents
+    $sql_linked_documents = mysqli_query($mysqli, "SELECT document_created_at, document_description, documents.document_id, document_name,
+        document_updated_at, user_name FROM contact_documents, documents
         LEFT JOIN users ON document_created_by = user_id
         WHERE contact_documents.contact_id = $contact_id
         AND contact_documents.document_id = documents.document_id
@@ -173,7 +188,7 @@ if (isset($_GET['contact_id'])) {
     $linked_documents = array();
 
     // Linked Files
-    $sql_linked_files = mysqli_query($mysqli, "SELECT * FROM contact_files, files
+    $sql_linked_files = mysqli_query($mysqli, "SELECT file_created_at, file_description, files.file_id, file_mime_type, file_name, file_size FROM contact_files, files
         WHERE contact_files.contact_id = $contact_id
         AND contact_files.file_id = files.file_id
         AND file_archived_at IS NULL
@@ -420,7 +435,7 @@ if (isset($_GET['contact_id'])) {
                                 // Tags
                                 $asset_tag_name_display_array = array();
                                 $asset_tag_id_array = array();
-                                $sql_asset_tags = mysqli_query($mysqli, "SELECT * FROM asset_tags LEFT JOIN tags ON asset_tag_tag_id = tag_id WHERE asset_tag_asset_id = $asset_id ORDER BY tag_name ASC");
+                                $sql_asset_tags = mysqli_query($mysqli, "SELECT tag_color, tag_icon, tag_id, tag_name FROM asset_tags LEFT JOIN tags ON asset_tag_tag_id = tag_id WHERE asset_tag_asset_id = $asset_id ORDER BY tag_name ASC");
                                 while ($row = mysqli_fetch_assoc($sql_asset_tags)) {
 
                                     $asset_tag_id = intval($row['tag_id']);
@@ -574,7 +589,7 @@ if (isset($_GET['contact_id'])) {
                                 // Tags
                                 $credential_tag_name_display_array = array();
                                 $credential_tag_id_array = array();
-                                $sql_credential_tags = mysqli_query($mysqli, "SELECT * FROM credential_tags LEFT JOIN tags ON credential_tags.tag_id = tags.tag_id WHERE credential_id = $credential_id ORDER BY tag_name ASC");
+                                $sql_credential_tags = mysqli_query($mysqli, "SELECT tag_color, tag_icon, credential_tags.tag_id, tag_name FROM credential_tags LEFT JOIN tags ON credential_tags.tag_id = tags.tag_id WHERE credential_id = $credential_id ORDER BY tag_name ASC");
                                 while ($row = mysqli_fetch_assoc($sql_credential_tags)) {
 
                                     $credential_tag_id = intval($row['tag_id']);

agent/contacts.php

@@ -74,7 +74,7 @@ $sql = mysqli_query($mysqli, "SELECT SQL_CALC_FOUND_ROWS contacts.*, clients.*,
     WHERE $archive_query
     $tag_query
     AND (contact_name LIKE '%$q%' OR contact_title LIKE '%$q%' OR location_name LIKE '%$q%'  OR contact_email LIKE '%$q%' OR contact_department LIKE '%$q%' OR contact_phone LIKE '%$phone_query%' OR contact_extension LIKE '%$q%' OR contact_mobile LIKE '%$phone_query%' OR tag_name LIKE '%$q%' OR client_name LIKE '%$q%')
-    $access_permission_query
+    " . clientScopeSql('contact_client_id') . "
     $client_query
     $location_query
     GROUP BY contact_id
@@ -193,7 +193,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                                 FROM clients
                                 JOIN contacts ON contact_client_id = client_id
                                 WHERE $archive_query
-                                $access_permission_query
+                                " . clientScopeSql('clients.client_id') . "
                                 ORDER BY client_name ASC
                             ");
                             while ($row = mysqli_fetch_assoc($sql_clients_filter)) {
@@ -444,7 +444,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                         // Tags
                         $contact_tag_name_display_array = array();
                         $contact_tag_id_array = array();
-                        $sql_contact_tags = mysqli_query($mysqli, "SELECT * FROM contact_tags LEFT JOIN tags ON contact_tags.tag_id = tags.tag_id WHERE contact_id = $contact_id ORDER BY tag_name ASC");
+                        $sql_contact_tags = mysqli_query($mysqli, "SELECT tag_color, tag_icon, contact_tags.tag_id, tag_name FROM contact_tags LEFT JOIN tags ON contact_tags.tag_id = tags.tag_id WHERE contact_id = $contact_id ORDER BY tag_name ASC");
                         while ($row = mysqli_fetch_assoc($sql_contact_tags)) {
 
                             $contact_tag_id = intval($row['tag_id']);

agent/credentials.php

@@ -90,7 +90,7 @@ $sql = mysqli_query(
     $tag_query
     AND (c.credential_name LIKE '%$q%' OR c.credential_description LIKE '%$q%' OR c.credential_uri LIKE '%$q%' OR tag_name LIKE '%$q%' OR client_name LIKE '%$q%')
     $location_query
-    $access_permission_query
+    " . clientScopeSql('credential_client_id') . "
     $client_query
     GROUP BY c.credential_id
     ORDER BY c.credential_favorite DESC, $sort $order LIMIT $record_from, $record_to"
@@ -179,7 +179,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                             <option value="">- All Asset Locations -</option>
 
                             <?php
-                            $sql_locations_filter = mysqli_query($mysqli, "SELECT * FROM locations WHERE location_client_id = $client_id AND location_archived_at IS NULL ORDER BY location_name ASC");
+                            $sql_locations_filter = mysqli_query($mysqli, "SELECT location_id, location_name FROM locations WHERE location_client_id = $client_id AND location_archived_at IS NULL ORDER BY location_name ASC");
                             while ($row = mysqli_fetch_assoc($sql_locations_filter)) {
                                 $location_id = intval($row['location_id']);
                                 $location_name = escapeHtml($row['location_name']);
@@ -204,7 +204,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                                 FROM clients
                                 JOIN credentials ON credential_client_id = client_id
                                 WHERE $archive_query
-                                $access_permission_query
+                                " . clientScopeSql('clients.client_id') . "
                                 ORDER BY client_name ASC
                             ");
                             while ($row = mysqli_fetch_assoc($sql_clients_filter)) {
@@ -349,7 +349,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                             // Tags
                             $credential_tag_name_display_array = array();
                             $credential_tag_id_array = array();
-                            $sql_credential_tags = mysqli_query($mysqli, "SELECT * FROM credential_tags LEFT JOIN tags ON credential_tags.tag_id = tags.tag_id WHERE credential_id = $credential_id ORDER BY tag_name ASC");
+                            $sql_credential_tags = mysqli_query($mysqli, "SELECT tag_color, tag_icon, credential_tags.tag_id, tag_name FROM credential_tags LEFT JOIN tags ON credential_tags.tag_id = tags.tag_id WHERE credential_id = $credential_id ORDER BY tag_name ASC");
                             while ($row = mysqli_fetch_assoc($sql_credential_tags)) {
 
                                 $credential_tag_id = intval($row['tag_id']);
@@ -389,7 +389,8 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                             // Check if shared
                             $sql_shared = mysqli_query(
                                 $mysqli,
-                                "SELECT * FROM shared_items
+                                "SELECT item_active, item_created_at, item_expire_at, item_id, item_key, item_note, item_recipient,
+                                    item_related_id, item_type, item_view_limit, item_views FROM shared_items
                                 WHERE item_client_id = $client_id
                                 AND item_active = 1
                                 AND (COALESCE(item_view_limit, 0) = 0 OR item_views < item_view_limit)

agent/dashboard.php

@@ -16,7 +16,7 @@ if (isset($_GET['enable_technical'])) {
 }
 
 // Fetch User Dashboard Settings
-$sql_user_dashboard_settings = mysqli_query($mysqli, "SELECT * FROM user_settings WHERE user_id = $session_user_id");
+$sql_user_dashboard_settings = mysqli_query($mysqli, "SELECT user_config_dashboard_financial_enable, user_config_dashboard_technical_enable FROM user_settings WHERE user_id = $session_user_id");
 $row = mysqli_fetch_assoc($sql_user_dashboard_settings);
 $user_config_dashboard_financial_enable = intval($row['user_config_dashboard_financial_enable']);
 $user_config_dashboard_technical_enable = intval($row['user_config_dashboard_technical_enable']);
@@ -117,17 +117,17 @@ if ($user_config_dashboard_financial_enable == 1) {
 
     $profit = $total_income - $total_expenses;
 
-    $sql_accounts = mysqli_query($mysqli, "SELECT * FROM accounts WHERE account_archived_at IS NULL ORDER BY account_name ASC");
+    $sql_accounts = mysqli_query($mysqli, "SELECT account_id, account_name, opening_balance FROM accounts WHERE account_archived_at IS NULL ORDER BY account_name ASC");
 
     $sql_latest_invoice_payments = mysqli_query($mysqli, "
-        SELECT * FROM payments
+        SELECT client_name, invoice_number, invoice_prefix, payment_amount, payment_date FROM payments
         JOIN invoices ON payment_invoice_id = invoice_id
         JOIN clients ON invoice_client_id = client_id
         ORDER BY payment_id DESC LIMIT 5
     ");
 
     $sql_latest_expenses = mysqli_query($mysqli, "
-        SELECT * FROM expenses
+        SELECT category_name, expense_amount, expense_date, vendor_name FROM expenses
         JOIN vendors ON expense_vendor_id = vendor_id
         JOIN categories ON expense_category_id = category_id
         ORDER BY expense_id DESC LIMIT 5
@@ -599,7 +599,9 @@ if ($user_config_dashboard_technical_enable == 1) {
     $expiring_asset_warranties = $sql_asset_warranty_expiring['expiring_asset_warranties'];
 
     $sql_your_tickets = mysqli_query($mysqli, "
-        SELECT * FROM tickets
+        SELECT client_name, contact_name, ticket_client_id, ticket_contact_id, ticket_created_at,
+            ticket_id, ticket_number, ticket_prefix, ticket_priority, ticket_status,
+            ticket_status_color, ticket_status_name, ticket_subject, ticket_updated_at FROM tickets
         LEFT JOIN ticket_statuses ON ticket_status = ticket_status_id
         LEFT JOIN clients ON ticket_client_id = client_id
         LEFT JOIN contacts ON ticket_contact_id = contact_id

agent/document.php

@@ -17,7 +17,9 @@ if (isset($_GET['document_id'])) {
 
 $folder_location = 0;
 
-$sql_document = mysqli_query($mysqli, "SELECT * FROM documents
+$sql_document = mysqli_query($mysqli, "SELECT document_archived_at, document_client_visible, document_content, document_created_at,
+    document_created_by, document_description, document_folder_id, document_name,
+    document_updated_at, folder_name, user_name FROM documents
     LEFT JOIN folders ON document_folder_id = folder_id
     LEFT JOIN users ON document_created_by = user_id
     WHERE document_client_id = $client_id AND document_id = $document_id
@@ -142,7 +144,8 @@ $page_title = $row['document_name'];
                     </thead>
                     <tbody>
                         <?php
-                        $sql_document_versions = mysqli_query($mysqli, "SELECT * FROM document_versions
+                        $sql_document_versions = mysqli_query($mysqli, "SELECT document_version_created_at, document_version_description, document_version_id,
+                            document_version_name, user_name FROM document_versions
                             LEFT JOIN users ON document_version_created_by = user_id
                             WHERE document_version_document_id = $document_id
                             ORDER BY document_version_created_at ASC"
@@ -208,7 +211,7 @@ $page_title = $row['document_name'];
                 </button>
             </h6>
             <?php
-            $sql_files = mysqli_query($mysqli, "SELECT * FROM files, document_files
+            $sql_files = mysqli_query($mysqli, "SELECT file_folder_id, files.file_id, file_name FROM files, document_files
                 WHERE document_files.file_id = files.file_id
                 AND document_files.document_id = $document_id
                 ORDER BY file_name ASC"
@@ -394,7 +397,8 @@ $page_title = $row['document_name'];
             <h6><i class="fas fa-history mr-2"></i>Revisions</h6>
             <?php
 
-            $sql_document_versions = mysqli_query($mysqli, "SELECT * FROM document_versions
+            $sql_document_versions = mysqli_query($mysqli, "SELECT document_version_created_at, document_version_description, document_version_id,
+                document_version_name, user_name FROM document_versions
                 LEFT JOIN users ON document_version_created_by = user_id
                 WHERE document_version_document_id = $document_id
                 ORDER BY document_version_created_at DESC"

agent/domains.php

@@ -78,7 +78,7 @@ $sql = mysqli_query($mysqli, "SELECT SQL_CALC_FOUND_ROWS domains.*, clients.*,
     LEFT JOIN vendors AS webhost ON domains.domain_webhost = webhost.vendor_id
     WHERE (domains.domain_name LIKE '%$q%' OR domains.domain_description LIKE '%$q%' OR registrar.vendor_name LIKE '%$q%' OR dnshost.vendor_name LIKE '%$q%' OR mailhost.vendor_name LIKE '%$q%' OR webhost.vendor_name LIKE '%$q%' OR client_name LIKE '%$q%')
     AND $archive_query
-    $access_permission_query
+    " . clientScopeSql('domain_client_id') . "
     $client_query
     $expire_query
     ORDER BY $sort $order LIMIT $record_from, $record_to");
@@ -134,7 +134,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                                 FROM clients
                                 JOIN domains ON domain_client_id = client_id
                                 WHERE $archive_query
-                                $access_permission_query
+                                " . clientScopeSql('clients.client_id') . "
                                 ORDER BY client_name ASC
                             ");
                             while ($row = mysqli_fetch_assoc($sql_clients_filter)) {

agent/expenses.php

@@ -41,7 +41,10 @@ if (isset($_GET['category']) & !empty($_GET['category'])) {
 
 $sql = mysqli_query(
     $mysqli,
-    "SELECT SQL_CALC_FOUND_ROWS * FROM expenses
+    "SELECT SQL_CALC_FOUND_ROWS account_name, category_name, client_name, expense_account_id, expense_amount,
+        expense_category_id, expense_client_id, expense_created_at, expense_currency_code,
+        expense_date, expense_description, expense_id, expense_receipt, expense_reference,
+        expense_vendor_id, vendor_name FROM expenses
     LEFT JOIN categories ON expense_category_id = category_id
     LEFT JOIN vendors ON expense_vendor_id = vendor_id
     LEFT JOIN accounts ON expense_account_id = account_id
@@ -52,7 +55,7 @@ $sql = mysqli_query(
     $category_query
     AND (vendor_name LIKE '%$q%' OR client_name LIKE '%$q%' OR category_name LIKE '%$q%' OR account_name LIKE '%$q%' OR expense_description LIKE '%$q%' OR expense_amount LIKE '%$q%')
     $account_query
-    $access_permission_query
+    " . clientScopeSql('expense_client_id') . "
     ORDER BY $sort $order LIMIT $record_from, $record_to"
 );
 

agent/files.php

@@ -99,7 +99,7 @@ function displayFolders($parent_folder_id, $client_id, $indent = 0, $render_root
 
     $sql_folders = mysqli_query(
         $mysqli,
-        "SELECT * FROM folders
+        "SELECT folder_id, folder_name FROM folders
          WHERE parent_folder = $parent_folder_id
          AND folder_client_id = $client_id
          ORDER BY folder_name ASC"
@@ -731,7 +731,7 @@ $num_root_items = intval($row_root_files['num']) + intval($row_root_docs['num'])
                                         // Shared?
                                         $sql_shared = mysqli_query(
                                             $mysqli,
-                                            "SELECT * FROM shared_items
+                                            "SELECT item_expire_at, item_recipient FROM shared_items
                                              WHERE item_client_id = $client_id
                                              AND item_active = 1
                                              AND (COALESCE(item_view_limit, 0) = 0 OR item_views < item_view_limit)
@@ -843,7 +843,7 @@ $num_root_items = intval($row_root_files['num']) + intval($row_root_docs['num'])
 
                                         $sql_shared = mysqli_query(
                                             $mysqli,
-                                            "SELECT * FROM shared_items
+                                            "SELECT item_expire_at, item_recipient FROM shared_items
                                              WHERE item_client_id = $client_id
                                              AND item_active = 1
                                              AND (COALESCE(item_view_limit, 0) = 0 OR item_views < item_view_limit)

agent/global_search.php

@@ -28,15 +28,19 @@ if (isset($_GET['query'])) {
     $can_sales      = lookupUserPermission('module_sales')      >= 1;
     $can_credential = lookupUserPermission('module_credential') >= 1;
 
-    $sql_clients = !$can_client ? false : mysqli_query($mysqli, "SELECT * FROM clients
+    $sql_clients = !$can_client ? false : mysqli_query($mysqli, "SELECT client_id, client_name, client_website, location_phone, location_phone_country_code
+        FROM clients
         LEFT JOIN locations ON clients.client_id = locations.location_client_id AND location_primary = 1
         WHERE client_archived_at IS NULL
             AND (client_name LIKE '%$query%' OR client_abbreviation LIKE '%$query%')
-            $access_permission_query
+            " . clientScopeSql('clients.client_id') . "
         ORDER BY client_id DESC LIMIT 5"
     );
 
-    $sql_contacts = !$can_client ? false : mysqli_query($mysqli, "SELECT * FROM contacts
+    $sql_contacts = !$can_client ? false : mysqli_query($mysqli, "SELECT client_id, client_name, contact_department, contact_email, contact_extension, contact_id,
+        contact_mobile, contact_mobile_country_code, contact_name, contact_phone,
+        contact_phone_country_code, contact_title
+        FROM contacts
         LEFT JOIN clients ON client_id = contact_client_id
         WHERE contact_archived_at IS NULL
             AND (contact_name LIKE '%$query%'
@@ -44,51 +48,59 @@ if (isset($_GET['query'])) {
             OR contact_email LIKE '%$query%'
             OR contact_phone LIKE '%$phone_query%'
             OR contact_mobile LIKE '%$phone_query%')
-            $access_permission_query
+            " . clientScopeSql('contact_client_id') . "
         ORDER BY contact_id DESC LIMIT 5"
     );
 
-    $sql_vendors = !$can_client ? false : mysqli_query($mysqli, "SELECT * FROM vendors
+    $sql_vendors = !$can_client ? false : mysqli_query($mysqli, "SELECT client_id, client_name, vendor_description, vendor_name, vendor_phone,
+        vendor_phone_country_code
+        FROM vendors
         LEFT JOIN clients ON vendor_client_id = client_id
         WHERE vendor_archived_at IS NULL
             AND (vendor_name LIKE '%$query%' OR vendor_phone LIKE '%$phone_query%')
-            $access_permission_query
+            " . clientScopeSql('vendor_client_id') . "
         ORDER BY vendor_id DESC LIMIT 5"
     );
 
-    $sql_domains = !$can_support ? false : mysqli_query($mysqli, "SELECT * FROM domains
+    $sql_domains = !$can_support ? false : mysqli_query($mysqli, "SELECT client_id, client_name, domain_expire, domain_id, domain_name
+        FROM domains
         LEFT JOIN clients ON domain_client_id = client_id
         WHERE domain_archived_at IS NULL
             AND domain_name LIKE '%$query%'
-            $access_permission_query
+            " . clientScopeSql('domain_client_id') . "
         ORDER BY domain_id DESC LIMIT 5"
     );
 
-    $sql_products = !$can_sales ? false : mysqli_query($mysqli, "SELECT * FROM products
+    $sql_products = !$can_sales ? false : mysqli_query($mysqli, "SELECT product_description, product_name
+        FROM products
         WHERE product_archived_at IS NULL
             AND product_name LIKE '%$query%'
         ORDER BY product_id DESC LIMIT 5"
     );
 
-    $sql_documents = !$can_support ? false : mysqli_query($mysqli, "SELECT * FROM documents
+    $sql_documents = !$can_support ? false : mysqli_query($mysqli, "SELECT client_name, document_client_id, document_id, document_name
+        FROM documents
         LEFT JOIN clients on document_client_id = clients.client_id
         WHERE document_archived_at IS NULL
             AND MATCH(document_content_raw) AGAINST ('$query')
-            $access_permission_query
+            " . clientScopeSql('document_client_id') . "
         ORDER BY document_id DESC LIMIT 5"
     );
 
-    $sql_files = !$can_support ? false : mysqli_query($mysqli, "SELECT * FROM files
+    $sql_files = !$can_support ? false : mysqli_query($mysqli, "SELECT client_name, file_client_id, file_description, file_id, file_name, folder_id, folder_name
+        FROM files
         LEFT JOIN clients ON file_client_id = client_id
         LEFT JOIN folders ON folder_id = file_folder_id
         WHERE file_archived_at IS NULL
             AND (file_name LIKE '%$query%'
             OR file_description LIKE '%$query%')
-            $access_permission_query
+            " . clientScopeSql('file_client_id') . "
         ORDER BY file_id DESC LIMIT 5"
     );
 
-    $sql_tickets = !$can_support ? false : mysqli_query($mysqli, "SELECT * FROM tickets
+    $sql_tickets = !$can_support ? false : mysqli_query($mysqli, "SELECT client_name, ticket_client_id, ticket_id, ticket_number, ticket_prefix, ticket_status_name,
+        ticket_subject
+        FROM tickets
         LEFT JOIN clients on tickets.ticket_client_id = clients.client_id
         LEFT JOIN ticket_statuses ON ticket_status = ticket_status_id
         WHERE ticket_archived_at IS NULL
@@ -96,62 +108,75 @@ if (isset($_GET['query'])) {
             OR ticket_details LIKE '%$query%'
             OR CONCAT(ticket_prefix,ticket_number) LIKE '%$query%'
             OR ticket_number = '$ticket_num_query')
-            $access_permission_query
+            " . clientScopeSql('tickets.ticket_client_id') . "
         ORDER BY ticket_id DESC LIMIT 5"
     );
 
-    $sql_recurring_tickets = !$can_support ? false : mysqli_query($mysqli, "SELECT * FROM recurring_tickets
+    $sql_recurring_tickets = !$can_support ? false : mysqli_query($mysqli, "SELECT client_id, client_name, recurring_ticket_frequency, recurring_ticket_id,
+        recurring_ticket_next_run, recurring_ticket_subject
+        FROM recurring_tickets
         LEFT JOIN clients ON recurring_ticket_client_id = client_id
         WHERE (recurring_ticket_subject LIKE '%$query%'
             OR recurring_ticket_details LIKE '%$query%')
-            $access_permission_query
+            " . clientScopeSql('recurring_ticket_client_id') . "
         ORDER BY recurring_ticket_id DESC LIMIT 5"
     );
 
-    $sql_credentials = !$can_credential ? false : mysqli_query($mysqli, "SELECT * FROM credentials
+    $sql_credentials = !$can_credential ? false : mysqli_query($mysqli, "SELECT client_id, client_name, credential_client_id, credential_description, credential_name,
+        credential_password, credential_username
+        FROM credentials
         LEFT JOIN contacts ON credential_contact_id = contact_id
         LEFT JOIN clients ON credential_client_id = client_id
         WHERE credential_archived_at IS NULL
             AND (credential_name LIKE '%$query%' OR credential_description LIKE '%$query%')
-            $access_permission_query
+            " . clientScopeSql('credential_client_id') . "
         ORDER BY credential_id DESC LIMIT 5"
     );
 
-    $sql_quotes = !$can_sales ? false : mysqli_query($mysqli, "SELECT * FROM quotes
+    $sql_quotes = !$can_sales ? false : mysqli_query($mysqli, "SELECT client_id, client_name, quote_amount, quote_currency_code, quote_id, quote_number,
+        quote_prefix, quote_status
+        FROM quotes
         LEFT JOIN clients ON quote_client_id = client_id
         LEFT JOIN categories ON quote_category_id = category_id
         WHERE quote_archived_at IS NULL
             AND (CONCAT(quote_prefix,quote_number) LIKE '%$query%' OR quote_number LIKE '%$query%' OR quote_scope LIKE '%$query%')
-            $access_permission_query
+            " . clientScopeSql('quote_client_id') . "
         ORDER BY quote_number DESC LIMIT 5"
     );
 
-    $sql_invoices = !$can_sales ? false : mysqli_query($mysqli, "SELECT * FROM invoices
+    $sql_invoices = !$can_sales ? false : mysqli_query($mysqli, "SELECT client_id, client_name, invoice_amount, invoice_currency_code, invoice_id, invoice_number,
+        invoice_prefix, invoice_status
+        FROM invoices
         LEFT JOIN clients ON invoice_client_id = client_id
         LEFT JOIN categories ON invoice_category_id = category_id
         WHERE invoice_archived_at IS NULL
             AND (CONCAT(invoice_prefix,invoice_number) LIKE '%$query%' OR invoice_number LIKE '%$query%' OR invoice_scope LIKE '%$query%')
-            $access_permission_query
+            " . clientScopeSql('invoice_client_id') . "
         ORDER BY invoice_number DESC LIMIT 5"
     );
 
-    $sql_assets = !$can_support ? false : mysqli_query($mysqli,"SELECT * FROM assets
+    $sql_assets = !$can_support ? false : mysqli_query($mysqli,"SELECT asset_client_id, asset_contact_id, asset_created_at, asset_description, asset_id,
+        asset_location_id, asset_make, asset_model, asset_name, asset_serial, asset_status, asset_type,
+        asset_uri, client_name, contact_archived_at, contact_id, contact_name
+        FROM assets
         LEFT JOIN contacts ON asset_contact_id = contact_id
         LEFT JOIN locations ON asset_location_id = location_id
         LEFT JOIN clients ON asset_client_id = client_id
         LEFT JOIN asset_interfaces ON interface_asset_id = asset_id AND interface_primary = 1
         WHERE asset_archived_at IS NULL
             AND (asset_name LIKE '%$query%' OR asset_description LIKE '%$query%' OR asset_type LIKE '%$query%' OR asset_make LIKE '%$query%' OR asset_model LIKE '%$query%' OR asset_serial LIKE '%$query%' OR asset_os LIKE '%$query%' OR interface_ip LIKE '%$query%' OR interface_nat_ip LIKE '%$query%' OR interface_mac LIKE '%$query%' OR asset_status LIKE '%$query%')
-            $access_permission_query
+            " . clientScopeSql('asset_client_id') . "
         ORDER BY asset_name DESC LIMIT 5"
     );
 
-    $sql_ticket_replies = !$can_support ? false : mysqli_query($mysqli,"SELECT * FROM ticket_replies
+    $sql_ticket_replies = !$can_support ? false : mysqli_query($mysqli,"SELECT client_name, ticket_client_id, ticket_id, ticket_number, ticket_prefix, ticket_reply,
+        ticket_subject
+        FROM ticket_replies
         LEFT JOIN tickets ON ticket_reply_ticket_id = ticket_id
         LEFT JOIN clients ON ticket_client_id = client_id
         WHERE ticket_reply_archived_at IS NULL
             AND (ticket_reply LIKE '%$query%')
-            $access_permission_query
+            " . clientScopeSql('ticket_client_id') . "
         ORDER BY ticket_id DESC, ticket_reply_id ASC LIMIT 20"
     );
 

agent/includes/client_overview_side_nav.php

@@ -1,31 +1,31 @@
 <?php
 // Badge Counts
 
-$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('contact_id') AS num FROM contacts LEFT JOIN clients ON contact_client_id = client_id WHERE contact_archived_at IS NULL AND client_archived_at IS NULL $access_permission_query"));
+$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('contact_id') AS num FROM contacts LEFT JOIN clients ON contact_client_id = client_id WHERE contact_archived_at IS NULL AND client_archived_at IS NULL " . clientScopeSql('contact_client_id') . ""));
 $num_contacts = $row['num'];
 
-$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('location_id') AS num FROM locations LEFT JOIN clients ON location_client_id = client_id WHERE location_archived_at IS NULL AND client_archived_at IS NULL $access_permission_query"));
+$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('location_id') AS num FROM locations LEFT JOIN clients ON location_client_id = client_id WHERE location_archived_at IS NULL AND client_archived_at IS NULL " . clientScopeSql('location_client_id') . ""));
 $num_locations = $row['num'];
 
-$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('asset_id') AS num FROM assets LEFT JOIN clients ON asset_client_id = client_id WHERE asset_archived_at IS NULL AND client_archived_at IS NULL $access_permission_query"));
+$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('asset_id') AS num FROM assets LEFT JOIN clients ON asset_client_id = client_id WHERE asset_archived_at IS NULL AND client_archived_at IS NULL " . clientScopeSql('asset_client_id') . ""));
 $num_assets = $row['num'];
 
-$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('service_id') AS num FROM services LEFT JOIN clients ON service_client_id = client_id WHERE client_archived_at IS NULL $access_permission_query"));
+$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('service_id') AS num FROM services LEFT JOIN clients ON service_client_id = client_id WHERE client_archived_at IS NULL " . clientScopeSql('service_client_id') . ""));
 $num_services = $row['num'];
 
-$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('credential_id') AS num FROM credentials LEFT JOIN clients ON credential_client_id = client_id WHERE credential_archived_at IS NULL AND client_archived_at IS NULL $access_permission_query"));
+$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('credential_id') AS num FROM credentials LEFT JOIN clients ON credential_client_id = client_id WHERE credential_archived_at IS NULL AND client_archived_at IS NULL " . clientScopeSql('credential_client_id') . ""));
 $num_credentials = $row['num'];
 
-$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('network_id') AS num FROM networks LEFT JOIN clients ON network_client_id = client_id WHERE network_archived_at IS NULL AND client_archived_at IS NULL $access_permission_query"));
+$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('network_id') AS num FROM networks LEFT JOIN clients ON network_client_id = client_id WHERE network_archived_at IS NULL AND client_archived_at IS NULL " . clientScopeSql('network_client_id') . ""));
 $num_networks = $row['num'];
 
-$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('domain_id') AS num FROM domains LEFT JOIN clients ON domain_client_id = client_id WHERE domain_archived_at IS NULL AND client_archived_at IS NULL $access_permission_query"));
+$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('domain_id') AS num FROM domains LEFT JOIN clients ON domain_client_id = client_id WHERE domain_archived_at IS NULL AND client_archived_at IS NULL " . clientScopeSql('domain_client_id') . ""));
 $num_domains = $row['num'];
 
-$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('certificate_id') AS num FROM certificates LEFT JOIN clients ON certificate_client_id = client_id WHERE certificate_archived_at IS NULL AND client_archived_at IS NULL $access_permission_query"));
+$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('certificate_id') AS num FROM certificates LEFT JOIN clients ON certificate_client_id = client_id WHERE certificate_archived_at IS NULL AND client_archived_at IS NULL " . clientScopeSql('certificate_client_id') . ""));
 $num_certificates = $row['num'];
 
-$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('software_id') AS num FROM software LEFT JOIN clients ON software_client_id = client_id WHERE software_archived_at IS NULL AND client_archived_at IS NULL $access_permission_query"));
+$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('software_id') AS num FROM software LEFT JOIN clients ON software_client_id = client_id WHERE software_archived_at IS NULL AND client_archived_at IS NULL " . clientScopeSql('software_client_id') . ""));
 $num_software = $row['num'];
 
 ?>

agent/includes/get_side_nav_counts.php

@@ -2,31 +2,31 @@
 // Get Main Side Bar Badge Counts
 
 // Active Clients Count
-$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('client_id') AS num FROM clients WHERE client_archived_at IS NULL $access_permission_query"));
+$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('client_id') AS num FROM clients WHERE client_archived_at IS NULL " . clientScopeSql('clients.client_id') . ""));
 $num_active_clients = $row['num'];
 
 // Active Ticket Count
-$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('ticket_id') AS num FROM tickets LEFT JOIN clients ON client_id = ticket_client_id WHERE ticket_archived_at IS NULL AND ticket_closed_at IS NULL AND ticket_status != 4 $access_permission_query"));
+$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('ticket_id') AS num FROM tickets WHERE ticket_archived_at IS NULL AND ticket_closed_at IS NULL AND ticket_status != 4 " . clientScopeSql('ticket_client_id') . ""));
 $num_active_tickets = $row['num'];
 
 // Recurring Ticket Count
-$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('recurring_ticket_id') AS num FROM recurring_tickets LEFT JOIN clients ON client_id = recurring_ticket_client_id WHERE 1 = 1 $access_permission_query"));
+$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('recurring_ticket_id') AS num FROM recurring_tickets WHERE 1 = 1 " . clientScopeSql('recurring_ticket_client_id') . ""));
 $num_recurring_tickets = $row['num'];
 
 // Active Project Count
-$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('project_id') AS num FROM projects LEFT JOIN clients ON project_client_id = client_id WHERE project_archived_at IS NULL AND project_completed_at IS NULL $access_permission_query"));
+$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('project_id') AS num FROM projects WHERE project_archived_at IS NULL AND project_completed_at IS NULL " . clientScopeSql('project_client_id') . ""));
 $num_active_projects = $row['num'];
 
 // Open Invoices Count
-$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('invoice_id') AS num FROM invoices LEFT JOIN clients ON invoice_client_id = client_id WHERE (invoice_status = 'Sent' OR invoice_status = 'Viewed' OR invoice_status = 'Partial' OR invoice_status = 'Draft') AND invoice_archived_at IS NULL $access_permission_query"));
+$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('invoice_id') AS num FROM invoices WHERE (invoice_status = 'Sent' OR invoice_status = 'Viewed' OR invoice_status = 'Partial' OR invoice_status = 'Draft') AND invoice_archived_at IS NULL " . clientScopeSql('invoice_client_id') . ""));
 $num_open_invoices = $row['num'];
 
 // Recurring Invoice Count
-$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('recurring_invoice_id') AS num FROM recurring_invoices LEFT JOIN clients ON recurring_invoice_client_id = client_id WHERE recurring_invoice_archived_at IS NULL $access_permission_query"));
+$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('recurring_invoice_id') AS num FROM recurring_invoices WHERE recurring_invoice_archived_at IS NULL " . clientScopeSql('recurring_invoice_client_id') . ""));
 $num_recurring_invoices = $row['num'];
 
 // Open Quotes Count
-$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('quote_id') AS num FROM quotes LEFT JOIN clients ON quote_client_id = client_id WHERE (quote_status = 'Sent' OR quote_status = 'Viewed') AND quote_archived_at IS NULL $access_permission_query"));
+$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('quote_id') AS num FROM quotes WHERE (quote_status = 'Sent' OR quote_status = 'Viewed') AND quote_archived_at IS NULL " . clientScopeSql('quote_client_id') . ""));
 $num_open_quotes = $row['num'];
 
 // Recurring Expenses Count

agent/includes/inc_all_client.php

@@ -18,7 +18,13 @@ if (isset($_GET['client_id'])) {
 
     $sql = mysqli_query(
         $mysqli,
-        "SELECT * FROM clients
+        "SELECT client_abbreviation, client_archived_at, client_created_at, client_currency_code,
+            client_lead, client_name, client_net_terms, client_notes, client_rate, client_referral,
+            client_tax_id_number, client_type, client_website, contact_email, contact_extension,
+            contact_id, contact_mobile, contact_mobile_country_code, contact_name, contact_phone,
+            contact_phone_country_code, contact_primary, contact_title, location_address,
+            location_city, location_country, location_id, location_name, location_phone,
+            location_phone_country_code, location_primary, location_state, location_zip FROM clients
         LEFT JOIN locations ON client_id = location_client_id AND location_primary = 1
         LEFT JOIN contacts ON client_id = contact_client_id AND contact_primary = 1
         WHERE client_id = $client_id"
@@ -75,7 +81,7 @@ if (isset($_GET['client_id'])) {
 
         $client_tag_name_display_array = array();
         $client_tag_id_array = array();
-        $sql_client_tags = mysqli_query($mysqli, "SELECT * FROM client_tags LEFT JOIN tags ON client_tags.tag_id = tags.tag_id WHERE client_id = $client_id ORDER BY tag_name ASC");
+        $sql_client_tags = mysqli_query($mysqli, "SELECT tag_color, tag_icon, client_tags.tag_id, tag_name FROM client_tags LEFT JOIN tags ON client_tags.tag_id = tags.tag_id WHERE client_id = $client_id ORDER BY tag_name ASC");
         while ($row = mysqli_fetch_assoc($sql_client_tags)) {
 
             $client_tag_id = intval($row['tag_id']);

agent/includes/inc_client_top_head.php

@@ -31,7 +31,7 @@
                         </a>
                         <?php } ?>
                     <?php } ?>
-                    <?php if (lookupUserPermission("module_client") >= 3) { ?>
+                    <?php if (lookupUserPermission("module_client") >= 1) { ?>
                         <div class="dropdown-divider"></div>
                         <a class="dropdown-item" href="#" data-toggle="modal" data-target="#exportClientPDFModal">
                             <i class="fas fa-fw fa-file-pdf mr-2"></i>Export Data

agent/includes/side_nav.php

@@ -200,7 +200,7 @@
                 <?php } ?>
 
                 <?php
-                $sql_custom_links = mysqli_query($mysqli, "SELECT * FROM custom_links WHERE custom_link_location = 1 AND custom_link_archived_at IS NULL
+                $sql_custom_links = mysqli_query($mysqli, "SELECT custom_link_icon, custom_link_name, custom_link_new_tab, custom_link_uri FROM custom_links WHERE custom_link_location = 1 AND custom_link_archived_at IS NULL
                     ORDER BY custom_link_order ASC, custom_link_name ASC"
                 );
 

agent/income.php

@@ -91,7 +91,7 @@ $income_query =
     LEFT JOIN categories ON invoice_category_id = category_id
     WHERE payment_archived_at IS NULL
     $payment_client_query
-    $access_permission_query
+    " . clientScopeSql('invoice_client_id') . "
 
     UNION ALL
 
@@ -120,7 +120,8 @@ $income_query =
     LEFT JOIN transfers ON transfer_revenue_id = revenue_id
     WHERE revenue_archived_at IS NULL
     AND transfer_id IS NULL
-    $revenue_client_query";
+    $revenue_client_query
+    " . clientScopeSql('revenue_client_id') . "";
 
 $income_filter_query =
     "WHERE DATE(income_date) BETWEEN '$dtf' AND '$dtt'

agent/invoice.php

@@ -16,12 +16,18 @@ if (isset($_GET['invoice_id'])) {
 
     $sql = mysqli_query(
         $mysqli,
-        "SELECT * FROM invoices
+        "SELECT client_currency_code, client_id, client_name, client_net_terms, client_website,
+            contact_email, contact_extension, contact_mobile, contact_mobile_country_code,
+            contact_phone, contact_phone_country_code, invoice_amount, invoice_category_id,
+            invoice_created_at, invoice_credit_amount, invoice_currency_code, invoice_date,
+            invoice_discount_amount, invoice_due, invoice_id, invoice_note, invoice_number,
+            invoice_prefix, invoice_scope, invoice_status, invoice_url_key, location_address,
+            location_city, location_country, location_state, location_zip FROM invoices
         LEFT JOIN clients ON invoice_client_id = client_id
         LEFT JOIN contacts ON client_id = contact_client_id AND contact_primary = 1
         LEFT JOIN locations ON client_id = location_client_id AND location_primary = 1
         WHERE invoice_id = $invoice_id
-        $access_permission_query
+        " . clientScopeSql('invoice_client_id') . "
         LIMIT 1"
     );
 
@@ -77,7 +83,9 @@ if (isset($_GET['invoice_id'])) {
     $tab_title = $row['client_name'];
     $page_title = "{$row['invoice_prefix']}{$row['invoice_number']}";
 
-    $sql = mysqli_query($mysqli, "SELECT * FROM companies WHERE company_id = 1");
+    $sql = mysqli_query($mysqli, "SELECT company_address, company_city, company_country, company_email, company_id, company_logo,
+        company_name, company_phone, company_phone_country_code, company_state, company_tax_id,
+        company_website, company_zip FROM companies WHERE company_id = 1");
     $row = mysqli_fetch_assoc($sql);
     $company_id = intval($row['company_id']);
     $company_name = escapeHtml($row['company_name']);
@@ -98,9 +106,10 @@ if (isset($_GET['invoice_id'])) {
     }
     $company_logo = escapeHtml($row['company_logo']);
 
-    $sql_history = mysqli_query($mysqli, "SELECT * FROM history WHERE history_invoice_id = $invoice_id ORDER BY history_id DESC");
+    $sql_history = mysqli_query($mysqli, "SELECT history_created_at, history_description, history_status FROM history WHERE history_invoice_id = $invoice_id ORDER BY history_id DESC");
 
-    $sql_payments = mysqli_query($mysqli, "SELECT * FROM payments, accounts WHERE payment_account_id = account_id AND payment_invoice_id = $invoice_id ORDER BY payments.payment_id DESC");
+    $sql_payments = mysqli_query($mysqli, "SELECT account_name, payment_amount, payment_currency_code, payment_date, payment_id,
+        payment_reference FROM payments, accounts WHERE payment_account_id = account_id AND payment_invoice_id = $invoice_id ORDER BY payments.payment_id DESC");
 
     $sql_tickets = mysqli_query($mysqli, "
         SELECT
@@ -121,8 +130,7 @@ if (isset($_GET['invoice_id'])) {
     //Get billable, and unbilled tickets to add to invoice
     $sql_tickets_billable = mysqli_query(
         $mysqli, "
-        SELECT
-            *
+        SELECT 1
         FROM
             tickets
         WHERE
@@ -190,7 +198,7 @@ if (isset($_GET['invoice_id'])) {
 
     // Saved Payment Methods
     $sql_saved_payment_methods = mysqli_query($mysqli, "
-        SELECT * FROM client_saved_payment_methods
+        SELECT 1 FROM client_saved_payment_methods
         LEFT JOIN payment_providers
             ON client_saved_payment_methods.saved_payment_provider_id = payment_providers.payment_provider_id
         WHERE saved_payment_client_id = $client_id
@@ -372,7 +380,8 @@ if (isset($_GET['invoice_id'])) {
                 </div>
             </div>
 
-            <?php $sql_invoice_items = mysqli_query($mysqli, "SELECT * FROM invoice_items WHERE item_invoice_id = $invoice_id ORDER BY item_order ASC"); ?>
+            <?php $sql_invoice_items = mysqli_query($mysqli, "SELECT item_created_at, item_description, item_id, item_name, item_price, item_product_id,
+                item_quantity, item_tax, item_tax_id, item_total FROM invoice_items WHERE item_invoice_id = $invoice_id ORDER BY item_order ASC"); ?>
 
             <div class="row mb-3">
                 <div class="col-md-12">
@@ -469,7 +478,7 @@ if (isset($_GET['invoice_id'])) {
                                             <select class="form-control select2" name="tax_id" id="tax" required>
                                                 <option value="0">No Tax</option>
                                                 <?php
-                                                $taxes_sql = mysqli_query($mysqli, "SELECT * FROM taxes WHERE tax_archived_at IS NULL ORDER BY tax_name ASC");
+                                                $taxes_sql = mysqli_query($mysqli, "SELECT tax_id, tax_name, tax_percent FROM taxes WHERE tax_archived_at IS NULL ORDER BY tax_name ASC");
                                                 while ($row = mysqli_fetch_assoc($taxes_sql)) {
                                                     $tax_id = intval($row['tax_id']);
                                                     $tax_name = escapeHtml($row['tax_name']);

agent/invoices.php

@@ -11,57 +11,57 @@ if (isset($_GET['client_id'])) {
     $client_url = "client_id=$client_id&";
 } else {
     require_once "includes/inc_all.php";
-    $client_query = "$access_permission_query";
+    $client_query = clientScopeSql('invoice_client_id');
     $client_url = '';
 }
 
 // Perms
 enforceUserPermission('module_sales');
 
-$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('invoice_id') AS num FROM invoices LEFT JOIN clients ON invoice_client_id = client_id WHERE invoice_status = 'Sent' $client_query"));
+$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('invoice_id') AS num FROM invoices WHERE invoice_status = 'Sent' $client_query"));
 $sent_count = $row['num'];
 
-$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('invoice_id') AS num FROM invoices LEFT JOIN clients ON invoice_client_id = client_id WHERE invoice_status = 'Viewed' $client_query"));
+$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('invoice_id') AS num FROM invoices WHERE invoice_status = 'Viewed' $client_query"));
 $viewed_count = $row['num'];
 
-$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('invoice_id') AS num FROM invoices LEFT JOIN clients ON invoice_client_id = client_id WHERE invoice_status = 'Partial' $client_query"));
+$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('invoice_id') AS num FROM invoices WHERE invoice_status = 'Partial' $client_query"));
 $partial_count = $row['num'];
 
-$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('invoice_id') AS num FROM invoices LEFT JOIN clients ON invoice_client_id = client_id WHERE invoice_status = 'Draft' $client_query"));
+$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('invoice_id') AS num FROM invoices WHERE invoice_status = 'Draft' $client_query"));
 $draft_count = $row['num'];
 
-$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('invoice_id') AS num FROM invoices LEFT JOIN clients ON invoice_client_id = client_id WHERE invoice_status = 'Cancelled' $client_query"));
+$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('invoice_id') AS num FROM invoices WHERE invoice_status = 'Cancelled' $client_query"));
 $cancelled_count = $row['num'];
 
-$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('invoice_id') AS num FROM invoices LEFT JOIN clients ON invoice_client_id = client_id WHERE invoice_status NOT LIKE 'Draft' AND invoice_status NOT LIKE 'Paid' AND invoice_status NOT LIKE 'Cancelled' AND invoice_status NOT LIKE 'Non-Billable' AND invoice_due < CURDATE() $client_query"));
+$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT COUNT('invoice_id') AS num FROM invoices WHERE invoice_status NOT LIKE 'Draft' AND invoice_status NOT LIKE 'Paid' AND invoice_status NOT LIKE 'Cancelled' AND invoice_status NOT LIKE 'Non-Billable' AND invoice_due < CURDATE() $client_query"));
 $overdue_count = $row['num'];
 
-$sql_total_draft_amount = mysqli_query($mysqli, "SELECT SUM(invoice_amount) AS total_draft_amount FROM invoices LEFT JOIN clients ON invoice_client_id = client_id WHERE invoice_status = 'Draft' $client_query");
+$sql_total_draft_amount = mysqli_query($mysqli, "SELECT SUM(invoice_amount) AS total_draft_amount FROM invoices WHERE invoice_status = 'Draft' $client_query");
 $row = mysqli_fetch_assoc($sql_total_draft_amount);
 $total_draft_amount = floatval($row['total_draft_amount']);
 
-$sql_total_sent_amount = mysqli_query($mysqli, "SELECT SUM(invoice_amount) AS total_sent_amount FROM invoices LEFT JOIN clients ON invoice_client_id = client_id WHERE invoice_status = 'Sent' $client_query");
+$sql_total_sent_amount = mysqli_query($mysqli, "SELECT SUM(invoice_amount) AS total_sent_amount FROM invoices WHERE invoice_status = 'Sent' $client_query");
 $row = mysqli_fetch_assoc($sql_total_sent_amount);
 $total_sent_amount = floatval($row['total_sent_amount']);
 
-$sql_total_viewed_amount = mysqli_query($mysqli, "SELECT SUM(invoice_amount) AS total_viewed_amount FROM invoices LEFT JOIN clients ON invoice_client_id = client_id WHERE invoice_status = 'Viewed' $client_query");
+$sql_total_viewed_amount = mysqli_query($mysqli, "SELECT SUM(invoice_amount) AS total_viewed_amount FROM invoices WHERE invoice_status = 'Viewed' $client_query");
 $row = mysqli_fetch_assoc($sql_total_viewed_amount);
 $total_viewed_amount = floatval($row['total_viewed_amount']);
 
-$sql_total_cancelled_amount = mysqli_query($mysqli, "SELECT SUM(invoice_amount) AS total_cancelled_amount FROM invoices LEFT JOIN clients ON invoice_client_id = client_id WHERE invoice_status = 'Cancelled' $client_query");
+$sql_total_cancelled_amount = mysqli_query($mysqli, "SELECT SUM(invoice_amount) AS total_cancelled_amount FROM invoices WHERE invoice_status = 'Cancelled' $client_query");
 $row = mysqli_fetch_assoc($sql_total_cancelled_amount);
 $total_cancelled_amount = floatval($row['total_cancelled_amount']);
 
-$sql_total_partial_amount = mysqli_query($mysqli, "SELECT SUM(invoice_amount) AS total_partial_amount FROM payments, invoices LEFT JOIN clients ON invoice_client_id = client_id WHERE payment_invoice_id = invoice_id AND invoice_status = 'Partial' $client_query");
+$sql_total_partial_amount = mysqli_query($mysqli, "SELECT SUM(invoice_amount) AS total_partial_amount FROM payments, invoices WHERE payment_invoice_id = invoice_id AND invoice_status = 'Partial' $client_query");
 $row = mysqli_fetch_assoc($sql_total_partial_amount);
 $total_partial_amount = floatval($row['total_partial_amount']);
 $total_partial_count = mysqli_num_rows($sql_total_partial_amount);
 
-$sql_total_overdue_partial_amount = mysqli_query($mysqli, "SELECT SUM(payment_amount) AS total_overdue_partial_amount FROM payments, invoices LEFT JOIN clients ON invoice_client_id = client_id WHERE payment_invoice_id = invoice_id AND invoice_status = 'Partial' AND invoice_due < CURDATE() $client_query");
+$sql_total_overdue_partial_amount = mysqli_query($mysqli, "SELECT SUM(payment_amount) AS total_overdue_partial_amount FROM payments, invoices WHERE payment_invoice_id = invoice_id AND invoice_status = 'Partial' AND invoice_due < CURDATE() $client_query");
 $row = mysqli_fetch_assoc($sql_total_overdue_partial_amount);
 $total_overdue_partial_amount = floatval($row['total_overdue_partial_amount']);
 
-$sql_total_overdue_amount = mysqli_query($mysqli, "SELECT SUM(invoice_amount) AS total_overdue_amount FROM invoices LEFT JOIN clients ON invoice_client_id = client_id WHERE invoice_status != 'Draft' AND invoice_status != 'Paid' AND invoice_status != 'Cancelled' AND invoice_status != 'Non-Billable' AND invoice_due < CURDATE() $client_query");
+$sql_total_overdue_amount = mysqli_query($mysqli, "SELECT SUM(invoice_amount) AS total_overdue_amount FROM invoices WHERE invoice_status != 'Draft' AND invoice_status != 'Paid' AND invoice_status != 'Cancelled' AND invoice_status != 'Non-Billable' AND invoice_due < CURDATE() $client_query");
 $row = mysqli_fetch_assoc($sql_total_overdue_amount);
 $total_overdue_amount = floatval($row['total_overdue_amount']);
 
@@ -94,7 +94,11 @@ if (isset($_GET['category']) & !empty($_GET['category'])) {
 
 $sql = mysqli_query(
     $mysqli,
-    "SELECT SQL_CALC_FOUND_ROWS * FROM invoices
+    "SELECT SQL_CALC_FOUND_ROWS category_id, category_name, client_currency_code, client_id, client_name, client_net_terms,
+        invoice_amount, invoice_created_at, invoice_currency_code, invoice_date,
+        invoice_discount_amount, invoice_due, invoice_id, invoice_number, invoice_prefix,
+        invoice_scope, invoice_status, recurring_invoice_id, recurring_invoice_number,
+        recurring_invoice_prefix FROM invoices
     LEFT JOIN clients ON invoice_client_id = client_id
     LEFT JOIN categories ON invoice_category_id = category_id
     LEFT JOIN recurring_invoices ON invoice_recurring_invoice_id = recurring_invoice_id
@@ -103,7 +107,7 @@ $sql = mysqli_query(
     $category_query
     AND DATE(invoice_date) BETWEEN '$dtf' AND '$dtt'
     AND (CONCAT(invoice_prefix,invoice_number) LIKE '%$q%' OR invoice_scope LIKE '%$q%' OR client_name LIKE '%$q%' OR invoice_status LIKE '%$q%' OR invoice_amount LIKE '%$q%' OR category_name LIKE '%$q%')
-    $access_permission_query
+    " . clientScopeSql('invoice_client_id') . "
     $client_query
     ORDER BY $sort $order LIMIT $record_from, $record_to"
 );
@@ -362,7 +366,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
 
                         // Saved Payment Methods
                         $sql_saved_payment_methods = mysqli_query($mysqli, "
-                            SELECT * FROM client_saved_payment_methods
+                            SELECT 1 FROM client_saved_payment_methods
                             LEFT JOIN payment_providers
                                 ON client_saved_payment_methods.saved_payment_provider_id = payment_providers.payment_provider_id
                             WHERE saved_payment_client_id = $client_id

agent/locations.php

@@ -64,7 +64,7 @@ $sql = mysqli_query(
     WHERE $archive_query
     $tag_query
     AND (location_name LIKE '%$q%' OR location_description LIKE '%$q%' OR location_address LIKE '%$q%' OR location_city LIKE '%$q%' OR location_state LIKE '%$q%' OR location_zip LIKE '%$q%' OR location_country LIKE '%$q%' OR location_phone LIKE '%$phone_query%' OR tag_name LIKE '%$q%' OR client_name LIKE '%$q%')
-    $access_permission_query
+    " . clientScopeSql('location_client_id') . "
     $client_query
     GROUP BY location_id
     ORDER BY location_primary DESC, $sort $order LIMIT $record_from, $record_to"
@@ -154,7 +154,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                                 FROM clients
                                 JOIN locations ON location_client_id = client_id
                                 WHERE $archive_query
-                                $access_permission_query
+                                " . clientScopeSql('clients.client_id') . "
                                 ORDER BY client_name ASC
                             ");
                             while ($row = mysqli_fetch_assoc($sql_clients_filter)) {
@@ -306,7 +306,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
 
                         $location_tag_name_display_array = array();
                         $location_tag_id_array = array();
-                        $sql_location_tags = mysqli_query($mysqli, "SELECT * FROM location_tags LEFT JOIN tags ON location_tags.tag_id = tags.tag_id WHERE location_tags.location_id = $location_id ORDER BY tag_name ASC");
+                        $sql_location_tags = mysqli_query($mysqli, "SELECT tag_color, tag_icon, location_tags.tag_id, tag_name FROM location_tags LEFT JOIN tags ON location_tags.tag_id = tags.tag_id WHERE location_tags.location_id = $location_id ORDER BY tag_name ASC");
                         while ($row = mysqli_fetch_assoc($sql_location_tags)) {
 
                             $location_tag_id = intval($row['tag_id']);

agent/modals/account/account_edit.php

@@ -6,7 +6,7 @@ enforceUserPermission('module_financial', 2);
 
 $account_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM accounts WHERE account_id = $account_id LIMIT 1");
+$sql = mysqli_query($mysqli, "SELECT account_name, account_notes FROM accounts WHERE account_id = $account_id LIMIT 1");
 
 $row = mysqli_fetch_assoc($sql);
 $account_name = escapeHtml($row['account_name']);

agent/modals/asset/asset.php

@@ -6,7 +6,15 @@ enforceUserPermission('module_support');
 
 $asset_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM assets
+$sql = mysqli_query($mysqli, "SELECT asset_contact_id, asset_created_at, asset_description, asset_favorite, asset_id,
+    asset_install_date, asset_location_id, asset_make, asset_model, asset_name, asset_notes,
+    asset_os, asset_photo, asset_physical_location, asset_purchase_date,
+    asset_purchase_reference, asset_serial, asset_status, asset_type, asset_uri, asset_uri_2,
+    asset_uri_client, asset_vendor_id, asset_warranty_expire, client_id, client_name,
+    contact_archived_at, contact_email, contact_extension, contact_mobile,
+    contact_mobile_country_code, contact_name, contact_phone, contact_phone_country_code,
+    interface_ip, interface_ipv6, interface_mac, interface_nat_ip, interface_network_id,
+    location_archived_at, location_name FROM assets
     LEFT JOIN clients ON client_id = asset_client_id
     LEFT JOIN contacts ON asset_contact_id = contact_id
     LEFT JOIN locations ON asset_location_id = location_id
@@ -82,7 +90,7 @@ if ($location_archived_at) {
 // Tags - many to many relationship
 $asset_tag_name_display_array = array();
 $asset_tag_id_array = array();
-$sql_asset_tags = mysqli_query($mysqli, "SELECT * FROM asset_tags LEFT JOIN tags ON asset_tag_tag_id = tag_id WHERE asset_tag_asset_id = $asset_id ORDER BY tag_name ASC");
+$sql_asset_tags = mysqli_query($mysqli, "SELECT tag_color, tag_icon, tag_id, tag_name FROM asset_tags LEFT JOIN tags ON asset_tag_tag_id = tag_id WHERE asset_tag_asset_id = $asset_id ORDER BY tag_name ASC");
 while ($row = mysqli_fetch_assoc($sql_asset_tags)) {
 
     $asset_tag_id = intval($row['tag_id']);
@@ -179,7 +187,8 @@ $sql_related_tickets = mysqli_query($mysqli, "
 $ticket_count = mysqli_num_rows($sql_related_tickets);
 
 // Related Recurring Tickets Query
-$sql_related_recurring_tickets = mysqli_query($mysqli, "SELECT * FROM recurring_tickets
+$sql_related_recurring_tickets = mysqli_query($mysqli, "SELECT recurring_ticket_frequency, recurring_ticket_assets.recurring_ticket_id,
+    recurring_ticket_next_run, recurring_ticket_priority, recurring_ticket_subject FROM recurring_tickets
     LEFT JOIN recurring_ticket_assets ON recurring_tickets.recurring_ticket_id = recurring_ticket_assets.recurring_ticket_id
     WHERE recurring_ticket_asset_id = $asset_id OR recurring_ticket_assets.asset_id = $asset_id
     GROUP BY recurring_tickets.recurring_ticket_id
@@ -188,7 +197,8 @@ $sql_related_recurring_tickets = mysqli_query($mysqli, "SELECT * FROM recurring_
 $recurring_ticket_count = mysqli_num_rows($sql_related_recurring_tickets);
 
 // Related Documents
-$sql_related_documents = mysqli_query($mysqli, "SELECT * FROM asset_documents
+$sql_related_documents = mysqli_query($mysqli, "SELECT document_created_at, document_description, documents.document_id, document_name,
+    document_updated_at, user_name FROM asset_documents
     LEFT JOIN documents ON asset_documents.document_id = documents.document_id
     LEFT JOIN users ON user_id = document_created_by
     WHERE asset_documents.asset_id = $asset_id
@@ -198,7 +208,7 @@ $sql_related_documents = mysqli_query($mysqli, "SELECT * FROM asset_documents
 $document_count = mysqli_num_rows($sql_related_documents);
 
 // Related Files
-$sql_related_files = mysqli_query($mysqli, "SELECT * FROM asset_files
+$sql_related_files = mysqli_query($mysqli, "SELECT file_created_at, file_description, file_ext, files.file_id, file_mime_type, file_name FROM asset_files
     LEFT JOIN files ON asset_files.file_id = files.file_id
     WHERE asset_files.asset_id = $asset_id
     AND file_archived_at IS NULL
@@ -209,7 +219,9 @@ $file_count = mysqli_num_rows($sql_related_files);
 // Related Software Query
 $sql_related_software = mysqli_query(
     $mysqli,
-    "SELECT * FROM software_assets
+    "SELECT software_expire, software_assets.software_id, software_key, software_license_type,
+        software_name, software_notes, software_purchase, software_seats, software_type,
+        software_version FROM software_assets
     LEFT JOIN software ON software_assets.software_id = software.software_id
     WHERE software_assets.asset_id = $asset_id
     AND software_archived_at IS NULL
@@ -219,7 +231,7 @@ $sql_related_software = mysqli_query(
 $software_count = mysqli_num_rows($sql_related_software);
 
 // Related Notes
-$sql_related_notes = mysqli_query($mysqli, "SELECT * FROM asset_notes
+$sql_related_notes = mysqli_query($mysqli, "SELECT asset_note, asset_note_created_at, asset_note_type, user_name FROM asset_notes
     LEFT JOIN users ON asset_note_created_by = user_id
     WHERE asset_note_asset_id = $asset_id
     AND asset_note_archived_at IS NULL
@@ -571,7 +583,7 @@ ob_start();
                         // Tags
                         $credential_tag_name_display_array = array();
                         $credential_tag_id_array = array();
-                        $sql_credential_tags = mysqli_query($mysqli, "SELECT * FROM credential_tags LEFT JOIN tags ON credential_tags.tag_id = tags.tag_id WHERE credential_id = $credential_id ORDER BY tag_name ASC");
+                        $sql_credential_tags = mysqli_query($mysqli, "SELECT tag_color, tag_icon, credential_tags.tag_id, tag_name FROM credential_tags LEFT JOIN tags ON credential_tags.tag_id = tags.tag_id WHERE credential_id = $credential_id ORDER BY tag_name ASC");
                         while ($row = mysqli_fetch_assoc($sql_credential_tags)) {
 
                             $credential_tag_id = intval($row['tag_id']);

agent/modals/asset/asset_add.php

@@ -7,12 +7,12 @@ $contact_id = intval($_GET['contact_id'] ?? 0);
 $type = escapeHtml(ucwords($_GET['type']) ?? '');
 
 if ($client_id) {
-    $sql_network_select = mysqli_query($mysqli, "SELECT * FROM networks WHERE network_archived_at IS NULL AND network_client_id = $client_id ORDER BY network_name ASC");
-    $sql_vendor_select = mysqli_query($mysqli, "SELECT * FROM vendors WHERE vendor_archived_at IS NULL AND vendor_client_id = $client_id ORDER BY vendor_name ASC");
+    $sql_network_select = mysqli_query($mysqli, "SELECT network, network_id, network_name FROM networks WHERE network_archived_at IS NULL AND network_client_id = $client_id ORDER BY network_name ASC");
+    $sql_vendor_select = mysqli_query($mysqli, "SELECT vendor_id, vendor_name FROM vendors WHERE vendor_archived_at IS NULL AND vendor_client_id = $client_id ORDER BY vendor_name ASC");
     $sql_location_select = mysqli_query($mysqli, "SELECT location_id, location_name FROM locations WHERE location_archived_at IS NULL AND location_client_id = $client_id ORDER BY location_name ASC");
-    $sql_contact_select = mysqli_query($mysqli, "SELECT * FROM contacts WHERE contact_archived_at IS NULL AND contact_client_id = $client_id ORDER BY contact_name ASC");
+    $sql_contact_select = mysqli_query($mysqli, "SELECT contact_id, contact_name FROM contacts WHERE contact_archived_at IS NULL AND contact_client_id = $client_id ORDER BY contact_name ASC");
 } else {
-    $sql_client_select = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients WHERE client_archived_at IS NULL $access_permission_query ORDER BY client_name ASC");
+    $sql_client_select = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients WHERE client_archived_at IS NULL " . clientScopeSql('clients.client_id') . " ORDER BY client_name ASC");
 }
 
 // OS typeahead suggestions

agent/modals/asset/asset_bulk_add_ticket.php

@@ -116,7 +116,7 @@ ob_start();
                     <option value="0">- None -</option>
                     <?php
 
-                    $sql_projects = mysqli_query($mysqli, "SELECT * FROM projects WHERE project_completed_at IS NULL AND project_archived_at IS NULL ORDER BY project_name ASC");
+                    $sql_projects = mysqli_query($mysqli, "SELECT project_id, project_name FROM projects WHERE project_completed_at IS NULL AND project_archived_at IS NULL ORDER BY project_name ASC");
                     while ($row = mysqli_fetch_assoc($sql_projects)) {
                         $project_id_select = intval($row['project_id']);
                         $project_name_select = escapeHtml($row['project_name']); ?>

agent/modals/asset/asset_bulk_assign_contact.php

@@ -37,7 +37,7 @@ ob_start();
                     <option value="">- Contact -</option>
                     <?php
 
-                    $sql = mysqli_query($mysqli, "SELECT * FROM contacts WHERE contact_archived_at IS NULL AND contact_client_id = $client_id ORDER BY contact_name ASC");
+                    $sql = mysqli_query($mysqli, "SELECT contact_id, contact_name FROM contacts WHERE contact_archived_at IS NULL AND contact_client_id = $client_id ORDER BY contact_name ASC");
                     while ($row = mysqli_fetch_assoc($sql)) {
                         $contact_id = intval($row['contact_id']);
                         $contact_name = escapeHtml($row['contact_name']);

agent/modals/asset/asset_bulk_assign_tags.php

@@ -37,7 +37,7 @@ ob_start();
                 <select class="form-control select2" name="tags[]" data-placeholder="Add some tags" multiple>
                     <?php
 
-                    $sql_tags_select = mysqli_query($mysqli, "SELECT * FROM tags WHERE tag_type = 5 ORDER BY tag_name ASC");
+                    $sql_tags_select = mysqli_query($mysqli, "SELECT tag_id, tag_name FROM tags WHERE tag_type = 5 ORDER BY tag_name ASC");
                     while ($row = mysqli_fetch_assoc($sql_tags_select)) {
                         $tag_id_select = intval($row['tag_id']);
                         $tag_name_select = escapeHtml($row['tag_name']);

agent/modals/asset/asset_copy.php

@@ -6,7 +6,12 @@ enforceUserPermission('module_support', 2);
 
 $asset_id = intval($_GET['id']);
 
-$sql = mysqli_query($mysqli, "SELECT * FROM assets
+$sql = mysqli_query($mysqli, "SELECT asset_archived_at, asset_client_id, asset_contact_id, asset_created_at, asset_description,
+    asset_id, asset_install_date, asset_location_id, asset_make, asset_model, asset_name,
+    asset_notes, asset_os, asset_photo, asset_physical_location, asset_purchase_date,
+    asset_purchase_reference, asset_serial, asset_status, asset_type, asset_uri, asset_uri_2,
+    asset_vendor_id, asset_warranty_expire, interface_ip, interface_ipv6, interface_mac,
+    interface_nat_ip, interface_network_id FROM assets
     LEFT JOIN asset_interfaces ON interface_asset_id = asset_id AND interface_primary = 1
     WHERE asset_id = $asset_id LIMIT 1"
 );
@@ -181,7 +186,7 @@ ob_start();
                             <option value="">- Select Location -</option>
                             <?php
 
-                            $sql_locations = mysqli_query($mysqli, "SELECT * FROM locations WHERE location_archived_at IS NULL AND location_client_id = $client_id ORDER BY location_name ASC");
+                            $sql_locations = mysqli_query($mysqli, "SELECT location_id, location_name FROM locations WHERE location_archived_at IS NULL AND location_client_id = $client_id ORDER BY location_name ASC");
                             while ($row = mysqli_fetch_assoc($sql_locations)) {
                                 $location_id_select = intval($row['location_id']);
                                 $location_name_select = escapeHtml($row['location_name']);
@@ -213,7 +218,7 @@ ob_start();
                             <option value="">- Select Contact -</option>
                             <?php
 
-                            $sql_contacts = mysqli_query($mysqli, "SELECT * FROM contacts WHERE contact_archived_at IS NULL AND contact_client_id = $client_id ORDER BY contact_name ASC");
+                            $sql_contacts = mysqli_query($mysqli, "SELECT contact_id, contact_name FROM contacts WHERE contact_archived_at IS NULL AND contact_client_id = $client_id ORDER BY contact_name ASC");
                             while ($row = mysqli_fetch_assoc($sql_contacts)) {
                                 $contact_id_select = intval($row['contact_id']);
                                 $contact_name_select = escapeHtml($row['contact_name']);
@@ -265,7 +270,7 @@ ob_start();
                             <option value="">- Select Network -</option>
                             <?php
 
-                            $sql_networks = mysqli_query($mysqli, "SELECT * FROM networks WHERE network_archived_at IS NULL AND network_client_id = $client_id ORDER BY network_name ASC");
+                            $sql_networks = mysqli_query($mysqli, "SELECT network, network_id, network_name FROM networks WHERE network_archived_at IS NULL AND network_client_id = $client_id ORDER BY network_name ASC");
                             while ($row = mysqli_fetch_assoc($sql_networks)) {
                                 $network_id_select = intval($row['network_id']);
                                 $network_name_select = escapeHtml($row['network_name']);
@@ -358,7 +363,7 @@ ob_start();
                             <option value="">- Select Vendor -</option>
                             <?php
 
-                            $sql_vendors = mysqli_query($mysqli, "SELECT * FROM vendors WHERE vendor_archived_at IS NULL AND vendor_client_id = $client_id ORDER BY vendor_name ASC");
+                            $sql_vendors = mysqli_query($mysqli, "SELECT vendor_id, vendor_name FROM vendors WHERE vendor_archived_at IS NULL AND vendor_client_id = $client_id ORDER BY vendor_name ASC");
                             while ($row = mysqli_fetch_assoc($sql_vendors)) {
                                 $vendor_id_select = intval($row['vendor_id']);
                                 $vendor_name_select = escapeHtml($row['vendor_name']);