refactor(sql): remove QuotedOrNull and convert to prepared statements #10573
Conversation
These definitions were never called within their respective files. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Replace SQL string concatenation with prepared statements, eliminating the QuotedOrNull function and its SQL injection vulnerability (the function did not escape input). Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Inline the empty-to-null conversion since the code already uses prepared statements correctly. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Replace SQL string concatenation with prepared statements, eliminating the QuotedOrNull function. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Replace direct sqlStatement/sqlInsert calls with QueryUtils methods which provide better error handling via exceptions. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## master #10573 +/- ##
==========================================
Coverage 16.21% 16.21%
Complexity 80296 80296
==========================================
Files 3653 3653
Lines 384216 384036 -180
==========================================
- Hits 62299 62287 -12
+ Misses 321917 321749 -168
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
kojiromike
added
Security
Database Layer
| $_REQUEST['form_comments'], | ||
| $form_begin ?: null, | ||
| $form_end ?: null, | ||
| empty($form_return) ? null : $form_return, |
There was a problem hiding this comment.
This $form_return variable appears to never be set anywhere in this file. The $form_begin and $form_end are set from $_REQUEST via DateToYYYYMMDD() on lines 648-649, but there's no corresponding assignment for $form_return.
This means returndate has effectively always been NULL in the database. If that's intentional, this refactor correctly preserves that behavior. If not, it might be worth adding:
$form_return = DateToYYYYMMDD($_REQUEST['form_return'] ?? '');Call it outside scope if you want, but if you don't address it here, please create a ticket.
2 participants
Towards #10241 and #10149 (ish)
Short description of what this resolves:
Removes the duplicate
QuotedOrNullfunction definitions (5 total) and converts the affected SQL queries to use proper prepared statements, fixing a possible SQL injection vulnerability in the process.Changes proposed in this pull request:
QuotedOrNullinadd_edit_issue.phpandtypes_edit.php(defined but never called)orders_results.phpfrom SQL string concatenation to prepared statements (fixes SQL injection - the QuotedOrNull there did not escape input)QuotedOrNullfromprocedure_order/common.phpby inlining the empty-to-null conversioneye_mag/save.phplists queries to prepared statementsQueryUtilsmethods for better error handling via exceptionsDoes your code include anything generated by an AI Engine? Yes / No
Yes
If you answered yes: Verify that each file that has AI generated code has a description that describes what AI engine was used and that the file includes AI generated code. Sections of code that are entirely or mostly generated by AI should be marked with a comment header and footer that includes the AI engine used and stating the code was AI.
All commits include
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>trailer. The refactored SQL queries using HEREDOC syntax and QueryUtils were generated with Claude Code assistance.