myron/tomsjavajive
1
0
Fork 0
mirror of https://github.com/myronblair/tomsjavajive synced 2026-07-27 16:52:36 -05:00
Code Issues Packages Projects Releases Wiki Activity

Fix duplicate PDO named parameter in api/search-customers.php

Browse Source 
Same bug class as the awardPoints() fix - :q was reused three times in one
WHERE clause, which fails under real (non-emulated) prepared statements.
Split into distinct :q1/:q2/:q3 placeholders each bound to the same value.

(The other flagged file, admin/import-export.php, turned out to be a false
positive from the earlier scan - the duplicate ":checked"/"::before" matches
were CSS pseudo-selectors inside a <style> block, not SQL placeholders.)
This commit is contained in:
Myron Blair
2026-07-05 15:01:01 +00:00
parent 30daef5f74
commit cfbae6e945
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
api/search-customers.php
+2 -2
View File
@@ -16,10 +16,10 @@ if (strlen($query) < 2) {
$customers = db()->fetchAll( $customers = db()->fetchAll(
"SELECT customer_id, email, name, phone, wallet_balance, reward_points "SELECT customer_id, email, name, phone, wallet_balance, reward_points
FROM customers FROM customers
WHERE (email LIKE :q OR name LIKE :q OR phone LIKE :q) AND is_active = 1 WHERE (email LIKE :q1 OR name LIKE :q2 OR phone LIKE :q3) AND is_active = 1
ORDER BY name ASC ORDER BY name ASC
LIMIT 20", LIMIT 20",
['q' => '%' . $query . '%'] ['q1' => '%' . $query . '%', 'q2' => '%' . $query . '%', 'q3' => '%' . $query . '%']
); );
jsonResponse($customers); jsonResponse($customers);