Skip to content

P2: Refactor raw SQL endpoints to prepared statements #75

Open
Open
P2: Refactor raw SQL endpoints to prepared statements#75
Labels
area: backendRelated to the PHP backendarea: securitySecurity vulnerabilitiespriority: P2Security and Authentication taskstype: bugA bug or functional error

Description

@Kinin-Code-Offical
Kinin-Code-Offical
opened on Dec 22, 2025

Several endpoints use raw string concatenation to build SQL queries, creating a critical SQL injection risk.

Acceptance Criteria:

  • Identify all endpoints that use INSERT or UPDATE with string concatenation.
  • Refactor them to use mysqli_prepare, �ind_param, and execute.
  • At least �ddclient.php and �ddpolicy.php must be fixed.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    area: backendRelated to the PHP backendarea: securitySecurity vulnerabilitiespriority: P2Security and Authentication taskstype: bugA bug or functional error

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions