Fix SQL injection concerns: use prepared statements in orderItemsRoute and tests

2026-07-06 23:14:34 +00:00
parent 53d0636193
commit 1d25cbe21c
2 changed files with 22 additions and 10 deletions
@@ -188,10 +188,16 @@ class orderItemsRoute
                    $response->error('Order Item ID is required', 400);
                }
                // Look up the order item to check department access
-                $orderItemContext = $db->query(
-                    'SELECT oi.order_id FROM order_items oi WHERE oi.id = ' . (int)$data['id'] . ' LIMIT 1'
-                );
-                $orderItemRow = $orderItemContext ? $orderItemContext->fetch_assoc() : null;
+                $itemId = (int)$data['id'];
+                $stmt = $db->prepare('SELECT oi.order_id FROM order_items oi WHERE oi.id = ? LIMIT 1');
+                if ($stmt !== false) {
+                    $stmt->bind_param('i', $itemId);
+                    $stmt->execute();
+                    $orderItemRow = $stmt->get_result()->fetch_assoc();
+                    $stmt->close();
+                } else {
+                    $orderItemRow = null;
+                }
                if ($orderItemRow !== null) {
                    $orderForAccess = (new orders_o())->getOrderById((int)$orderItemRow['order_id']);
                    if ($orderForAccess->exists()) {