mirror of
https://github.com/myronblair/tomsjavajive
synced 2026-07-28 01:02:35 -05:00
Myron Blair
cfbae6e945
Same bug class as the awardPoints() fix - :q was reused three times in one WHERE clause, which fails under real (non-emulated) prepared statements. Split into distinct :q1/:q2/:q3 placeholders each bound to the same value. (The other flagged file, admin/import-export.php, turned out to be a false positive from the earlier scan - the duplicate ":checked"/"::before" matches were CSS pseudo-selectors inside a <style> block, not SQL placeholders.)
26 lines
597 B
PHP
26 lines
597 B
PHP
<?php
|
|
/**
|
|
* Tom's Java Jive - Customer Search API
|
|
*/
|
|
|
|
header('Content-Type: application/json');
|
|
|
|
require_once __DIR__ . '/../includes/functions.php';
|
|
|
|
$query = $_GET['q'] ?? '';
|
|
|
|
if (strlen($query) < 2) {
|
|
jsonResponse([]);
|
|
}
|
|
|
|
$customers = db()->fetchAll(
|
|
"SELECT customer_id, email, name, phone, wallet_balance, reward_points
|
|
FROM customers
|
|
WHERE (email LIKE :q1 OR name LIKE :q2 OR phone LIKE :q3) AND is_active = 1
|
|
ORDER BY name ASC
|
|
LIMIT 20",
|
|
['q1' => '%' . $query . '%', 'q2' => '%' . $query . '%', 'q3' => '%' . $query . '%']
|
|
);
|
|
|
|
jsonResponse($customers);
|