Feat: Avoiding SQL injections using prepared statements of MySQLi (Open for contribution)

[aswinikalyan30]

Describe the feature

In the current implementation , we are directly passing the POST data with session variables into the query string which can expose the application to SQL injection. Re-factor the SQL statements in admin_class.php file to mitigate this.

Add ScreenShots

Refactor items like these into:

Prepared statements like these:

Record

• I agree to follow this project's Code of Conduct
• I'm a GSSOC'24 contributor
• I want to work on this issue

[aswinikalyan30]

More than 1 can work on this issue and collaborate across files to implement this

[anushkasaxena07]

@aswinikalyan30 please assign this issue to me....i would love to work on this .

[aswinikalyan30]

Hey @anushkasaxena07 , there are a lot of queries to be modified and need to ensure everything is working after the changes
I'll assign this to you, but will keep it open so that other contributors can work with you

[anushkasaxena07]

i have to make changes just in admin_class.php file or in others too ? @aswinikalyan30

[aswinikalyan30]

There are direct SQL queries injection in many files, let this issue be only for the admin_class file. Will open another one for the others

[SheetalDawar]

i would like to work on this project, please assign this to me