Standardize: Convert 7 high-priority $conn->query() to prepared statements
Converted queries in: - functions.php: * getTripCount() - Hardcoded query * getAvailableSpaces() - Two queries using $trip_id parameter (HIGH PRIORITY) - blog.php: * Main blog list query - Hardcoded 'published' status - course_details.php: * Driver training courses query - Hardcoded course type - driver_training.php: * Future driver training dates query - Hardcoded course type - events.php: * Upcoming events query - Hardcoded date comparison - index.php: * Featured trips query - Hardcoded published status All queries now use proper parameter binding via prepared statements. Next: Convert remaining 15+ safe hardcoded queries for consistency.
This commit is contained in:
@@ -1,15 +1,17 @@
|
||||
<?php
|
||||
$headerStyle = 'light';
|
||||
<?php
|
||||
$headerStyle = 'light';
|
||||
include_once('header.php');
|
||||
checkUserSession();
|
||||
|
||||
// SQL query to fetch dates for driver training
|
||||
$sql = "SELECT course_id, date
|
||||
$stmt = $conn->prepare("SELECT course_id, date
|
||||
FROM courses
|
||||
WHERE course_type = 'driver_training'
|
||||
AND date >= CURDATE()";
|
||||
|
||||
$result = $conn->query($sql);
|
||||
WHERE course_type = ?
|
||||
AND date >= CURDATE()");
|
||||
$course_type = 'driver_training';
|
||||
$stmt->bind_param("s", $course_type);
|
||||
$stmt->execute();
|
||||
$result = $stmt->get_result();
|
||||
$page_id = 'driver_training';
|
||||
|
||||
?>
|
||||
@@ -24,10 +26,10 @@ $page_id = 'driver_training';
|
||||
padding: 8px;
|
||||
font-size: 16px;
|
||||
}
|
||||
</style><?php
|
||||
$pageTitle = 'Driver Training';
|
||||
$breadcrumbs = [['Home' => 'index.php']];
|
||||
require_once('components/banner.php');
|
||||
</style><?php
|
||||
$pageTitle = 'Driver Training';
|
||||
$breadcrumbs = [['Home' => 'index.php']];
|
||||
require_once('components/banner.php');
|
||||
?>
|
||||
|
||||
<!-- Product Details Start -->
|
||||
|
||||
Reference in New Issue
Block a user