From cfbae6e945ad80169dc8ff6ee19844a137566c2e Mon Sep 17 00:00:00 2001
From: Myron Blair <myron@orbishosting.com>
Date: Sun, 5 Jul 2026 15:01:01 +0000
Subject: [PATCH] Fix duplicate PDO named parameter in api/search-customers.php

Same bug class as the awardPoints() fix - :q was reused three times in one
WHERE clause, which fails under real (non-emulated) prepared statements.
Split into distinct :q1/:q2/:q3 placeholders each bound to the same value.

(The other flagged file, admin/import-export.php, turned out to be a false
positive from the earlier scan - the duplicate ":checked"/"::before" matches
were CSS pseudo-selectors inside a <style> block, not SQL placeholders.)
---
 api/search-customers.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/api/search-customers.php b/api/search-customers.php
index e52bbd3..5b60376 100644
--- a/api/search-customers.php
+++ b/api/search-customers.php
@@ -16,10 +16,10 @@ if (strlen($query) < 2) {
 $customers = db()->fetchAll(
     "SELECT customer_id, email, name, phone, wallet_balance, reward_points 
      FROM customers 
-     WHERE (email LIKE :q OR name LIKE :q OR phone LIKE :q) AND is_active = 1
+     WHERE (email LIKE :q1 OR name LIKE :q2 OR phone LIKE :q3) AND is_active = 1
      ORDER BY name ASC
      LIMIT 20",
-    ['q' => '%' . $query . '%']
+    ['q1' => '%' . $query . '%', 'q2' => '%' . $query . '%', 'q3' => '%' . $query . '%']
 );
 
 jsonResponse($customers);