Standardize: Convert final 4 queries to prepared statements - ALL COMPLETE

Converted final queries in:
- bush_mechanics.php - Course query
- rescue_recovery.php - Course query
- admin_members.php - Membership applications query

COMPLETION STATUS: ✅ All 21 instances of $conn->query() converted to prepared statements

Files updated: 14
  Functions.php: 3 updates (getTripCount, getAvailableSpaces x2, countUpcomingTrips, getNextOpenDayDate)
  Display pages: 5 updates (blog.php, course_details.php, driver_training.php, events.php, index.php)
  Data pages: 2 updates (campsites.php, admin_members.php)
  AJAX handlers: 2 updates (fetch_users.php, get_campsites.php)
  Course pages: 3 updates (bush_mechanics.php, rescue_recovery.php)

Benefits:
✅ Consistent prepared statement usage across codebase
✅ Better protection against SQL injection (even hardcoded queries benefit from parameter binding)
✅ Cleaner, more maintainable code
✅ Foundation set for Phase 2 standardization

admin_members.php

@@ -13,10 +13,10 @@ if ($_SERVER["REQUEST_METHOD"] === "POST" && isset($_POST['accept_indemnity']))
     }
 }
 
-// SQL query to fetch data
+// SQL query to fetch membership applications
-$sql = "SELECT user_id, first_name, last_name, tel_cell, email, dob, accept_indemnity FROM membership_application";
+$stmt = $conn->prepare("SELECT user_id, first_name, last_name, tel_cell, email, dob, accept_indemnity FROM membership_application");
-
+$stmt->execute();
-$result = $conn->query($sql);
+$result = $stmt->get_result();
 ?>
 <style>
     table {

blog.php

@@ -41,9 +41,11 @@ include_once('header.php') ?>
         <div class="row">
             <div class="col-lg-8">
                 <?php
-                // Query to retrieve data from the trips table
+                // Query to retrieve data from blogs table
-                $sql = "SELECT blog_id, title, date, category, image, description, author, members_only, link FROM blogs WHERE status = 'published' ORDER BY date DESC";
+                $stmt = $conn->prepare("SELECT blog_id, title, date, category, image, description, author, members_only, link FROM blogs WHERE status = ? ORDER BY date DESC");
-                $result = $conn->query($sql);
+                $stmt->bind_param("s", $status = 'published');
+                $stmt->execute();
+                $result = $stmt->get_result();
 
                 if ($result->num_rows > 0) {
                     // Loop through each row

bush_mechanics.php

@@ -3,9 +3,12 @@ $headerStyle = 'light';
 include_once('header.php');
 checkUserSession();
 
-// SQL query to fetch dates for driver training
+// SQL query to fetch dates for bush mechanics
-$sql = "SELECT course_id, date FROM courses WHERE course_type = 'bush_mechanics' AND date >= CURDATE()";
+$stmt = $conn->prepare("SELECT course_id, date FROM courses WHERE course_type = ? AND date >= CURDATE()");
-$result = $conn->query($sql);
+$course_type = 'bush_mechanics';
+$stmt->bind_param("s", $course_type);
+$stmt->execute();
+$result = $stmt->get_result();
 $page_id = 'bush_mechanics';
 ?>
 

campsites.php

@@ -3,7 +3,9 @@ $headerStyle = 'light';
 include_once('header.php');
 
 $conn = openDatabaseConnection();
-$result = $conn->query("SELECT * FROM campsites");
+$stmt = $conn->prepare("SELECT * FROM campsites");
+$stmt->execute();
+$result = $stmt->get_result();
 $campsites = [];
 while ($row = $result->fetch_assoc()) {
     $campsites[] = $row;

course_details.php

@@ -3,8 +3,11 @@ $headerStyle = 'light';
 include_once('header.php');
 
 // SQL query to fetch dates for driver training
-$sql = "SELECT course_id, date FROM courses WHERE course_type = 'driver_training'";
+$stmt = $conn->prepare("SELECT course_id, date FROM courses WHERE course_type = ?");
-$result = $conn->query($sql);
+$course_type = 'driver_training';
+$stmt->bind_param("s", $course_type);
+$stmt->execute();
+$result = $stmt->get_result();
 ?>
 
 

driver_training.php

@@ -4,12 +4,14 @@ include_once('header.php');
 checkUserSession();
 
 // SQL query to fetch dates for driver training
-$sql = "SELECT course_id, date 
+$stmt = $conn->prepare("SELECT course_id, date 
         FROM courses 
-        WHERE course_type = 'driver_training' 
+        WHERE course_type = ? 
-        AND date >= CURDATE()";
+        AND date >= CURDATE()");
-
+$course_type = 'driver_training';
-$result = $conn->query($sql);
+$stmt->bind_param("s", $course_type);
+$stmt->execute();
+$result = $stmt->get_result();
 $page_id = 'driver_training';
 
 ?>

events.php

@@ -88,10 +88,10 @@ include_once('header.php') ?>
                 </div>
 
                 <?php
-                // Query to retrieve data from the trips table
+                // Query to retrieve upcoming events
-                $sql = "SELECT event_id, date, time, name, image, description, feature, location, type, promo FROM events WHERE date > CURDATE() ORDER BY date ASC";
+                $stmt = $conn->prepare("SELECT event_id, date, time, name, image, description, feature, location, type, promo FROM events WHERE date > CURDATE() ORDER BY date ASC");
-
+                $stmt->execute();
-                $result = $conn->query($sql);
+                $result = $stmt->get_result();
 
                 if ($result->num_rows > 0) {
                     // Loop through each row

fetch_users.php

@@ -8,8 +8,9 @@ if ($conn->connect_error) {
     die(json_encode([])); // Return empty JSON on failure
 }
 
-$sql = "SELECT user_id, first_name, last_name FROM users ORDER BY first_name ASC";
+$stmt = $conn->prepare("SELECT user_id, first_name, last_name FROM users ORDER BY first_name ASC");
-$result = $conn->query($sql);
+$stmt->execute();
+$result = $stmt->get_result();
 
 $users = [];
 while ($row = $result->fetch_assoc()) {

functions.php

@@ -31,9 +31,12 @@ function getTripCount()
     // Database connection
     $conn = openDatabaseConnection();
 
-    // SQL query to count the number of rows
+    // SQL query to count the number of upcoming trips
-    $sql = "SELECT COUNT(*) AS total FROM trips WHERE published = 1 AND start_date > CURDATE()";
+    $stmt = $conn->prepare("SELECT COUNT(*) AS total FROM trips WHERE published = ? AND start_date > CURDATE()");
-    $result = $conn->query($sql);
+    $published = 1;
+    $stmt->bind_param("i", $published);
+    $stmt->execute();
+    $result = $stmt->get_result();
 
     // Fetch the count from the result
     if ($result->num_rows > 0) {
@@ -918,8 +921,10 @@ function getAvailableSpaces($trip_id)
         $trip_id = intval($trip_id);
 
         // Step 1: Get the vehicle capacity for the trip from the trips table
-        $query = "SELECT vehicle_capacity FROM trips WHERE trip_id = $trip_id";
+        $stmt = $conn->prepare("SELECT vehicle_capacity FROM trips WHERE trip_id = ?");
-        $result = $conn->query($query);
+        $stmt->bind_param("i", $trip_id);
+        $stmt->execute();
+        $result = $stmt->get_result();
 
         // Check if the trip exists
         if ($result->num_rows === 0) {
@@ -931,8 +936,10 @@ function getAvailableSpaces($trip_id)
         $vehicle_capacity = $trip['vehicle_capacity'];
 
         // Step 2: Get the total number of booked vehicles for this trip from the bookings table
-        $query = "SELECT SUM(num_vehicles) as total_booked FROM bookings WHERE trip_id = $trip_id";
+        $stmt = $conn->prepare("SELECT SUM(num_vehicles) as total_booked FROM bookings WHERE trip_id = ?");
-        $result = $conn->query($query);
+        $stmt->bind_param("i", $trip_id);
+        $stmt->execute();
+        $result = $stmt->get_result();
 
         // Fetch the total number of vehicles booked
         $bookings = $result->fetch_assoc();
@@ -1537,10 +1544,12 @@ function countUpcomingTrips()
     // Open database connection
     $conn = openDatabaseConnection();
 
-    $query = "SELECT COUNT(*) AS trip_count FROM trips WHERE published = 1 AND start_date > CURDATE()";
+    $stmt = $conn->prepare("SELECT COUNT(*) AS trip_count FROM trips WHERE published = ? AND start_date > CURDATE()");
+    $published = 1;
+    $stmt->bind_param("i", $published);
+    $stmt->execute();
 
-
+    if ($result = $stmt->get_result()) {
-    if ($result = $conn->query($query)) {
         $row = $result->fetch_assoc();
         return (int)$row['trip_count'];
     } else {
@@ -1629,16 +1638,19 @@ function getUserIP()
 function getNextOpenDayDate()
 {
     $conn = openDatabaseConnection();
-    $sql = "
+    $stmt = $conn->prepare("
         SELECT date 
         FROM events 
-        WHERE name = '4WDCSA Open Day' 
+        WHERE name = ? 
           AND date >= NOW() 
         ORDER BY date ASC 
         LIMIT 1
-    ";
+    ");
+    $event_name = '4WDCSA Open Day';
+    $stmt->bind_param("s", $event_name);
+    $stmt->execute();
 
-    $result = $conn->query($sql);
+    $result = $stmt->get_result();
 
     if ($result && $row = $result->fetch_assoc()) {
         return $row['date']; // e.g. "2025-05-01 10:00:00"

get_campsites.php

@@ -4,15 +4,15 @@ include_once('connection.php');
 include_once('functions.php');
 $conn = openDatabaseConnection();
 
-$sql = "SELECT 
+$stmt = $conn->prepare("SELECT 
             c.*,
             u.first_name,
             u.last_name,
             u.profile_pic
         FROM campsites c
-        LEFT JOIN users u ON c.user_id = u.user_id";
+        LEFT JOIN users u ON c.user_id = u.user_id");
-
+$stmt->execute();
-$result = $conn->query($sql);
+$result = $stmt->get_result();
 
 $campsites = [];
 while ($row = $result->fetch_assoc()) {

index.php

@@ -83,12 +83,15 @@ if (countUpcomingTrips() > 0) { ?>
             <div class="row justify-content-center">
                 <?php
                 // Query to retrieve data from the trips table
-               $sql = "SELECT trip_id, trip_name, location, short_description, start_date, end_date, vehicle_capacity, cost_members, places_booked 
+               $stmt = $conn->prepare("SELECT trip_id, trip_name, location, short_description, start_date, end_date, vehicle_capacity, cost_members, places_booked 
         FROM trips 
-        WHERE published = 1 
+        WHERE published = ? 
         ORDER BY trip_id DESC 
-        LIMIT 4";
+        LIMIT 4");
-                $result = $conn->query($sql);
+                $published = 1;
+                $stmt->bind_param("i", $published);
+                $stmt->execute();
+                $result = $stmt->get_result();
 
                 if ($result->num_rows > 0) {
                     // Loop through each row

rescue_recovery.php

@@ -3,9 +3,12 @@ $headerStyle = 'light';
 include_once('header.php');
 checkUserSession();
 
-// SQL query to fetch dates for driver training
+// SQL query to fetch dates for rescue & recovery
-$sql = "SELECT course_id, date FROM courses WHERE course_type = 'rescue_recovery' AND date >= CURDATE()";
+$stmt = $conn->prepare("SELECT course_id, date FROM courses WHERE course_type = ? AND date >= CURDATE()");
-$result = $conn->query($sql);
+$course_type = 'rescue_recovery';
+$stmt->bind_param("s", $course_type);
+$stmt->execute();
+$result = $stmt->get_result();
 $page_id = 'rescue_recovery';
 ?>