FIX_SQl Injection which means - Data binding concept and FIND function Variable Convertion.

app/Controllers/AppContentManagementController.php

@@ -264,9 +264,9 @@ class AppContentManagementController extends AdminController
             
                 if (!empty($id)) {
                     if($returnType === 'web'){
-                        $row = $this->faqModel->find($id);
+                        $row = $this->faqModel->find((int)$id);
                     }else{
-                        $row = $this->faqModel->where('is_active', 1)->find($id);
+                        $row = $this->faqModel->where('is_active', 1)->find((int)$id);
                     }
                     
                     $data['faq_list'] = $row ? [$row] : [];

app/Controllers/BDSReportController.php

@@ -101,10 +101,10 @@ class BDSReportController extends AdminController
                 SELECT
                         ins.id,
                         ins.name AS insurers,
-                        COALESCE(SUM(CASE WHEN pt.action_type = 'inception' AND pt.insurer_id = ins.id AND ptp.policy_category = $insurerCategory THEN 1 ELSE 0 END), 0) AS Policies,
+                        COALESCE(SUM(CASE WHEN pt.action_type = 'inception' AND pt.insurer_id = ins.id AND ptp.policy_category = :insurerCategory: THEN 1 ELSE 0 END), 0) AS Policies,
-                        COALESCE(SUM(CASE WHEN ptp.policy_category = $insurerCategory AND pt_co.insurer_id = ins.id THEN (pt_co.cop_amt + pt_co.cotp_amt + pt_co.cotep_amt + pt_co.non_comm_per_amt) ELSE 0 END), 0) AS Premium,
+                        COALESCE(SUM(CASE WHEN ptp.policy_category = :insurerCategory: AND pt_co.insurer_id = ins.id THEN (pt_co.cop_amt + pt_co.cotp_amt + pt_co.cotep_amt + pt_co.non_comm_per_amt) ELSE 0 END), 0) AS Premium,
-                        COALESCE(SUM(CASE WHEN stmt.co_share_id = pt_co.id AND ptp.policy_category = $insurerCategory AND pt_co.insurer_id = ins.id THEN stmt.reward + stmt.actual_bp_brokerage_amt + stmt.actual_tep_brokerage_amt + stmt.actual_tp_brokerage_amt ELSE 0 END), 0) AS Revenue,
+                        COALESCE(SUM(CASE WHEN stmt.co_share_id = pt_co.id AND ptp.policy_category = :insurerCategory: AND pt_co.insurer_id = ins.id THEN stmt.reward + stmt.actual_bp_brokerage_amt + stmt.actual_tep_brokerage_amt + stmt.actual_tp_brokerage_amt ELSE 0 END), 0) AS Revenue,
-                        COALESCE(SUM(CASE WHEN ptp.policy_category = $insurerCategory AND pt_co.insurer_id = ins.id THEN pt_co.exp_amt ELSE 0 END), 0) AS Expected_amt
+                        COALESCE(SUM(CASE WHEN ptp.policy_category = :insurerCategory: AND pt_co.insurer_id = ins.id THEN pt_co.exp_amt ELSE 0 END), 0) AS Expected_amt
                     FROM
                         insurers ins
                     LEFT JOIN
@@ -112,16 +112,17 @@ class BDSReportController extends AdminController
                     LEFT JOIN
                         co_share_stmt_details stmt ON pt_co.id = stmt.co_share_id AND stmt.is_active = 1
                     LEFT JOIN
-                        policy_transaction pt ON pt_co.pt_id = pt.id AND pt.is_active = 1 AND pt.policy_issue_date >= '$fromDate' AND pt.policy_issue_date <= '$toDate'
+                        policy_transaction pt ON pt_co.pt_id = pt.id AND pt.is_active = 1 AND pt.policy_issue_date >= :fromDate: AND pt.policy_issue_date <= :toDate:
                     LEFT JOIN
-                        policy_type ptp ON pt.policy_type_id = ptp.id AND ptp.policy_category = $insurerCategory AND ptp.is_active = 1
+                        policy_type ptp ON pt.policy_type_id = ptp.id AND ptp.policy_category = :insurerCategory: AND ptp.is_active = 1
                     WHERE
-                        ins.is_active = 1 AND (ptp.policy_category = $insurerCategory OR ptp.policy_category IS NULL)
+                        ins.is_active = 1 AND (ptp.policy_category = :insurerCategory: OR ptp.policy_category IS NULL)
                     GROUP BY
                         ins.id;
             ";
 
-            $data['insurer_wise_data'] = $this->insurerModel->query($sql)->getResultArray();
+            $binds = ['insurerCategory'=>$insurerCategory,'fromDate'=>$fromDate,'toDate'=>$toDate];
+            $data['insurer_wise_data'] = $this->insurerModel->query($sql,$binds)->getResultArray();
             // log_message('error',$this->insurerModel->getLastQuery());
             // log_message('error',json_encode($data));
         } catch (\Exception $e) {
@@ -146,15 +147,16 @@ class BDSReportController extends AdminController
                     COALESCE(SUM(co.reward + co.actual_bp_brokerage_amt + co.actual_tep_brokerage_amt + co.actual_tp_brokerage_amt), 0) AS Revenue,
                     COALESCE(SUM(pt_co.exp_amt), 0) AS Expected_amt
                 FROM policy_type AS pot
-                LEFT JOIN policy_transaction AS pt ON pot.id = pt.policy_type_id AND pt.is_active = 1 AND pt.action_type = 'inception' and pt.policy_issue_date >= '$fromDate' and pt.policy_issue_date <= '$toDate'
+                LEFT JOIN policy_transaction AS pt ON pot.id = pt.policy_type_id AND pt.is_active = 1 AND pt.action_type = 'inception' and pt.policy_issue_date >= :fromDate: and pt.policy_issue_date <= :toDate:
                 LEFT JOIN pt_co_share_details AS pt_co ON pt.id = pt_co.pt_id AND pt_co.is_active = 1
                 LEFT JOIN co_share_stmt_details AS co ON pt_co.id = co.co_share_id AND co.is_active = 1
                 WHERE pot.is_active = 1
-                AND pot.policy_category = $insurerCategory
+                AND pot.policy_category = :insurerCategory:
                 GROUP BY pot.bap;
 
             ";
-            $data['bap_wise_data'] = $this->policyTypeModel->query($sql)->getResultArray();
+            $binds = ['insurerCategory'=>$insurerCategory,'fromDate'=>$fromDate,'toDate'=>$toDate];
+            $data['bap_wise_data'] = $this->policyTypeModel->query($sql,$binds)->getResultArray();
         } catch (\Exception $e) {
             $data['message'] = 'No Data Found';
             $this->myLogger->logme('error', $e->getMessage());

app/Controllers/ClientController.php

@@ -665,7 +665,7 @@ class ClientController extends AdminController
         $headerData['tab_name'] = 'Client Deposit';
         $headerData['page_name'] = 'Clients';
 
-        $data['clientName'] = $this->clientModel->where('id', $id)->find();
+        $data['clientName'] = $this->clientModel->where('id', (int)$id)->find();
         $data['clientData'] = $this->clientPolicyModel->getinsurerswithclientid($id, $policyId);
 
         $data['depositsummary'] = $this->clientPolicyModel->getDepositlistsummary($id);
@@ -1459,7 +1459,7 @@ class ClientController extends AdminController
         $rr_unit_count2 = 0;
         $total_count    = 0;
 
-        $list_of_branch_units = $this->clientBranchModel->find($id);
+        $list_of_branch_units = $this->clientBranchModel->find((int)$id);
         $units = json_decode($list_of_branch_units['units']);
 
         if (!is_array($units) || empty($units)) {
@@ -1483,7 +1483,7 @@ class ClientController extends AdminController
         if ($total_count > 0) {
             $units = (string) $this->request->getPost('units'); // Assuming 'units' is an array
 
-            $list_of_branch_units = $this->clientBranchModel->find($id);
+            $list_of_branch_units = $this->clientBranchModel->find((int)$id);
             $branch_units = json_decode($list_of_branch_units['units'], true);
             $units = json_decode($units);
 
@@ -3850,9 +3850,9 @@ class ClientController extends AdminController
         // $policy_status = $this->clientPolicyModel->where('id', $client_policy_id )->set('policy_status', 1)->update();
 
         $json_data = '';
-        $open_for_enrollment = $this->clientPolicyModel->where('id', $client_policy_id)->set('open_for_enrollment', $open_for_enrollment_update_value)->update();
+        $open_for_enrollment = $this->clientPolicyModel->where('id', (int)$client_policy_id)->set('open_for_enrollment', $open_for_enrollment_update_value)->update();
         if ($open_for_enrollment) {
-            $open_for_enrollment_1 = $this->clientPolicyModel->where('id', $client_policy_id)->find();
+            $open_for_enrollment_1 = $this->clientPolicyModel->where('id', (int)$client_policy_id)->find();
             $open_for_enrollment_value = $open_for_enrollment_1[0]['open_for_enrollment'];
             $client_policy_id_value = $client_policy_id;
 

app/Controllers/DashboardController.php

@@ -443,7 +443,7 @@ class DashboardController extends AdminController
         foreach ($client_policy_data as $client_policy) {
 
             // Fetch client data
-            $client_data = $this->clientModel->find($client_policy['client_id']);
+            $client_data = $this->clientModel->find((int)$client_policy['client_id']);
 
             // Fetch notification settings
             $notification_data = $this->notificationModel

app/Controllers/EmpDataServiceController.php

@@ -487,13 +487,18 @@ class EmpDataServiceController extends BaseController
                         WHEN `client_policy`.`policy_type_id` IN (2, 3, 4, 5) THEN 2
                         ELSE `client_policy`.`policy_type_id`
                     END
-                WHERE `client_policy`.`id` = '".$export_data['client_policy_id']."'
+                WHERE `client_policy`.`id` = :client_policy_id:
-                AND `insurer_excel_export_template`.`event_name` = '".$export_data['event_type']."'
+                AND `insurer_excel_export_template`.`event_name` = :event_name:
                 AND `insurer_excel_export_template`.`is_active` = 1
-                AND `insurer_excel_export_template`.`type_name` = '".$export_data['actions']."'
+                AND `insurer_excel_export_template`.`type_name` =  :type_name:
                 LIMIT 1";
-            
+
-            $query = db_connect()->query($sql);
+                $binds = [
+                    'client_policy_id' => (int)$export_data['client_policy_id'],
+                    'event_name'       => $export_data['event_type'],
+                    'type_name'        => $export_data['actions'],
+                ];
+            $query = db_connect()->query($sql,$binds);
             $template_json = $query->getRowArray();
         
             // dd(db_connect()->getLastQuery());
@@ -1095,13 +1100,15 @@ class EmpDataServiceController extends BaseController
                     WHEN `client_policy`.`policy_type_id` IN (2, 3, 4, 5) THEN 2
                     ELSE `client_policy`.`policy_type_id`
                 END
-            WHERE `client_policy`.`id` = '".$export_data['client_policy_id']."'
+            WHERE `client_policy`.`id` = :client_policy_id:
             AND `insurer_excel_export_template`.`event_name` = 'all'
             AND `insurer_excel_export_template`.`is_active` = 1
-            AND `insurer_excel_export_template`.`type_name` = '".$export_data['actions']."'
+            AND `insurer_excel_export_template`.`type_name` = :type_name:
             LIMIT 1";
         
-        $query = db_connect()->query($sql);
+            $binds = ['client_policy_id' => (int)$export_data['client_policy_id'],
+                             'type_name' => $export_data['actions']];
+        $query = db_connect()->query($sql,$binds);
         $template_json = $query->getRowArray();
 
 
@@ -1931,7 +1938,7 @@ class EmpDataServiceController extends BaseController
         $this->myLogger->logme('error', 'Inception Update TPA and UHID --  Function called');
 
         $file_id = $params['file_id'];
-        $file = $this->batchFileModel->find($file_id);
+        $file = $this->batchFileModel->find((int)$file_id);
         // dd($file);
 
         if (!$file) {
@@ -1940,10 +1947,10 @@ class EmpDataServiceController extends BaseController
                 'status' => 'failed-4',
             ];
 
-            $this->batchFileModel->where('id', $file_id)->set($data)->update();
+            $this->batchFileModel->where('id', (int)$file_id)->set($data)->update();
             $this->myLogger->logme('error', 'Inception Update TPA and UHID --   The Physical file not found --   File id : {data}', ['data' => $file_id]);
 
-            $file_data = $this->getDataByFileId($file_id, 'failure');
+            $file_data = $this->getDataByFileId((int)$file_id, 'failure');
             $this->setPullNotification($file_data);
 
             return ['status' => 'error', 'message' => 'Inception Update TPA and UHID --   The Physical file not found']; // Return error code if file not found
@@ -1958,17 +1965,17 @@ class EmpDataServiceController extends BaseController
         $user_id = $file['created_by'];
         $policy_issue_date = $file['policy_issue_date'];
 
-        $insurer_id = $this->clientPolicyModel->where('id', $client_policy_id)->first();
+        $insurer_id = $this->clientPolicyModel->where('id', (int)$client_policy_id)->first();
 
         $CD_Account_Number = $this->CDMasterModel
-                    ->where('client_id', $client_id)
+                    ->where('client_id', (int)$client_id)
-                    ->where('insurer_id', $insurer_id['insurer_id'])
+                    ->where('insurer_id', (int)$insurer_id['insurer_id'])
                     ->first();
 
         $get_policy_type = $this->clientPolicyModel
             ->select('client_policy.*, policy_type.policy_type')
             ->join('policy_type', 'policy_type.id = client_policy.policy_type_id', 'left')
-            ->where('client_policy.id', $client_policy_id)
+            ->where('client_policy.id', (int)$client_policy_id)
             ->first();
 
         // dd($get_policy_type);
@@ -2500,7 +2507,7 @@ class EmpDataServiceController extends BaseController
 
         $this->myLogger->logme('error', 'importCorrectionUpdateEndorsementID called');
 
-        $file_id = $params['file_id'];
+        $file_id = (int)$params['file_id'];
         $file = $this->batchFileModel->find($file_id);
         if (!$file) {
 
@@ -3135,7 +3142,7 @@ class EmpDataServiceController extends BaseController
 
         $this->myLogger->logme('error', 'SI Enhancement Update Endorsement ID --   Function called');
 
-        $file_id = $params['file_id'];
+        $file_id = (int)$params['file_id'];
         $file = $this->batchFileModel->find($file_id);
         if (!$file) {
 
@@ -3709,7 +3716,7 @@ class EmpDataServiceController extends BaseController
 
         $this->myLogger->logme('error', 'Deletion Update Endorsement ID --   Function called');
 
-        $file_id = $params['file_id'];
+        $file_id = (int)$params['file_id'];
         $file = $this->batchFileModel->find($file_id);
         if (!$file) {
 
@@ -4193,7 +4200,7 @@ class EmpDataServiceController extends BaseController
 
         $this->myLogger->logme('error', 'importCorrectionUpdateEndorsementID called');
 
-        $file_id = $params['file_id'];
+        $file_id = (int)$params['file_id'];
         $file = $this->batchFileModel->find($file_id);
         if (!$file) {
 
@@ -4454,11 +4461,12 @@ class EmpDataServiceController extends BaseController
                         SELECT SUM(rata_premimum + gst) AS total_sum
                         FROM employee_polices
                         JOIN employees ON employees.id = employee_polices.employee_id
-                        WHERE employees.unit = '{$unit}'
+                        WHERE employees.unit = :unit:
-                        AND employee_polices.id = '{$pk}'
+                        AND employee_polices.id = :pk:
                     ";
 
-                    $amount = $this->employeePolicyModel->query($query)->getRow();
+                    $binds = ['unit' => $unit,'pk' => $pk];
+                    $amount = $this->employeePolicyModel->query($query,$binds)->getRow();
 
                     if ($amount && $amount->total_sum > 0) {
                         if ($si_adjustment == 2) {

app/Controllers/EmployeeController.php

@@ -177,7 +177,7 @@ class EmployeeController extends AdminController
         // die();
         // $file_id = $this->request->getGet();
         // echo $file_id;die();
-        $file = $this->fileModel->find($file_id);
+        $file = $this->fileModel->find((int)$file_id);
         // print_r($result);die();
         if (!isset($file)) {
             return $this->respond(['dataStatus' => false, 'code' => 404, 'message' => 'no data found'], 200);
@@ -412,7 +412,7 @@ class EmployeeController extends AdminController
                             if (in_array($role_id, [2, 3])) {
             
                                 // If the user is a Account Manager or Manager, filter by user_id
-                                $query->where('cr.user_id', $user_id);
+                                $query->where('cr.user_id', (int)$user_id);
                             }
                             // ->where('files.created_by', get_session_userid())
                             $data['fileList'] = $query->groupBy("files.id")->orderBy('files.created_at', 'desc')
@@ -463,7 +463,7 @@ class EmployeeController extends AdminController
                             if (in_array($role_id, [2, 3])) {
             
                                 // If the user is a Account Manager or Manager, filter by user_id
-                                $query2->where('cr.user_id', $user_id);
+                                $query2->where('cr.user_id', (int)$user_id);
                             }
                             // ->where('files.created_by', get_session_userid())
                             $data['batch_list'] = $query2->groupBy("batch_files.id")->orderBy('batch_files.id', 'desc')
@@ -1167,7 +1167,7 @@ class EmployeeController extends AdminController
     public function downloadFullExcelErrorFile($file_id, $rowIndex = 1, $colIndex = 1)
     {
         // Get file data from the database
-        $file_data = $this->fileModel->find($file_id);
+        $file_data = $this->fileModel->find((int)$file_id);
 
         $error =  json_decode($file_data['reason']);
         //    echo '<pre>';
@@ -1779,7 +1779,7 @@ class EmployeeController extends AdminController
         $this->myLogger->logme('error', 'File id for truncate : -- FILE ID : {data} --', ['data' => $file_id]);
 
         //get the files data
-        $file = $this->fileModel->find($file_id);
+        $file = $this->fileModel->find((int)$file_id);
 
         $client_id = $file['client_id'];
         $client_policy_id = $file['policy_id'];
@@ -1837,9 +1837,11 @@ class EmployeeController extends AdminController
                         $query = "
                             UPDATE employee_polices 
                             SET employee_polices.status = 'truncated', employee_polices.is_active = 0 
-                            WHERE employee_polices.file_id = $file_id
+                            WHERE employee_polices.file_id == :file_id:  
                         ";
-                        $db->query($query);
+
+                        $binds = ["file_id" => $file_id];
+                        $db->query($query,$binds);
                         $affectedRows = $db->affectedRows();
                         $this->myLogger->logme('error', '---- employee_polices table update query : {data} ----', ['data' => $query]);
                         $this->myLogger->logme('error', '---- employee_polices table updated - Affected Rows : {data} ----', ['data' => $affectedRows]);
@@ -1931,12 +1933,13 @@ class EmployeeController extends AdminController
                     $dependent_policies = '(' . implode(',', $dependent_policies) . ')';
                     $query = "
                                 UPDATE employee_polices 
-                                JOIN employees ON employees.id = employee_polices.employee_id and employees.emp_code in $emp_codes 
+                                JOIN employees ON employees.id = employee_polices.employee_id and employees.emp_code in :emp_codes:
                                 SET employee_polices.status = 'truncated', employee_polices.is_active = 0 
-                                WHERE employee_polices.client_policy_id in $dependent_policies
+                                WHERE employee_polices.client_policy_id in :dependent_policies:
                             ";
                     // print_r($query); die;
-                    $db->query($query);
+                    $binds = ["emp_codes" => $emp_codes , "dependent_policies" => $dependent_policies];
+                    $db->query($query,$binds);
                     $affectedRows = $db->affectedRows();
 
                     // dd($affectedRows);
@@ -2060,7 +2063,7 @@ class EmployeeController extends AdminController
     {
         $file_id = $this->request->uri->getSegment(3);
         // $file_id = 747;
-        $file = $this->fileModel->find($file_id);
+        $file = $this->fileModel->find((int)$file_id);
         $client_id = $file['client_id'];
         $client_policy_id = $file['policy_id'];
         $loggedInUserID = get_session_userid();
@@ -2124,10 +2127,11 @@ class EmployeeController extends AdminController
                     $query = "
                                 UPDATE employee_polices 
                                 SET employee_polices.status = 'truncated', employee_polices.is_active = 0 
-                                WHERE employee_polices.file_id = $file_id
+                                WHERE employee_polices.file_id = :file_id:
                             ";
                 
-                    $db->query($query);
+                    $binds = ["file_id" => $file_id];
+                    $db->query($query,$binds);
                     $affectedRows = $db->affectedRows();
                     $this->myLogger->logme('error', 'employee_polices table update query : {data}', ['data' => $query]);
                     $this->myLogger->logme('error', 'employee_polices table updated - Affected Rows : {data}', ['data' => $affectedRows]);
@@ -2189,11 +2193,12 @@ class EmployeeController extends AdminController
                     $dependent_policies = '(' . implode(',', $dependent_policies) . ')';
                     $query = "
                                 UPDATE employee_polices 
-                                JOIN employees ON employees.id = employee_polices.employee_id and employees.emp_code in $emp_codes 
+                                JOIN employees ON employees.id = employee_polices.employee_id and employees.emp_code in :emp_codes:
                                 SET employee_polices.status = 'truncated', employee_polices.is_active = 0 
-                                WHERE employee_polices.client_policy_id in $dependent_policies
+                                WHERE employee_polices.client_policy_id in :dependent_policies:
                             ";
-                    $db->query($query);
+                    $binds = ["emp_codes" => $emp_codes , "dependent_policies" => $dependent_policies];
+                    $db->query($query,$binds);
                     $affectedRows = $db->affectedRows();
 
                     // dd($affectedRows);
@@ -2422,7 +2427,7 @@ class EmployeeController extends AdminController
     public function hasPolicyConfigCompleted()
     {
         $client_policy_id = $this->request->uri->getSegment(3);
-        $policy_details = $this->clientPolicyModel->find($client_policy_id);
+        $policy_details = $this->clientPolicyModel->find((int)$client_policy_id);
         $insurer_details = $this->insurerModel->where('id', $policy_details['insurer_id'])->first();
         $policy_terms = isset($policy_details['policy_terms']) ? true : false;
 

app/Controllers/EmployeeMultiEventServiceController.php

@@ -1018,7 +1018,7 @@ class EmployeeMultiEventServiceController extends BaseController
         $this->myLogger->logme('error', 'Excel Multievent File Formate Validation function START: ' . json_encode(['params' => $params]));
         helper('excel_util_helper');
         $file_id = $params['file_id'];
-        $file = $this->fileModel->find($file_id);
+        $file = $this->fileModel->find((int)$file_id);
 
         if (!isset($file)) {
             //file not found in DB
@@ -1182,7 +1182,7 @@ class EmployeeMultiEventServiceController extends BaseController
 
         helper('excel_util_helper');
         $file_id = $params['file_id'];
-        $file = $this->fileModel->find($file_id);
+        $file = $this->fileModel->find((int)$file_id);
 
         if (!isset($file)) {
             //file not found in DB
@@ -1291,7 +1291,7 @@ class EmployeeMultiEventServiceController extends BaseController
         helper('excel_util_helper');
 
         $file_id = $params['file_id'];
-        $file = $this->fileModel->find($file_id);
+        $file = $this->fileModel->find((int)$file_id);
 
         if (!isset($file)) {
             //file not found in DB
@@ -1387,7 +1387,7 @@ class EmployeeMultiEventServiceController extends BaseController
         // dd($params);
         //get file name
         $file_id = $params['file_id'];
-        $file = $this->fileModel->find($file_id);
+        $file = $this->fileModel->find((int)$file_id);
         $file['action'] = $params['action'];
         // dd($file);
 
@@ -1604,7 +1604,7 @@ class EmployeeMultiEventServiceController extends BaseController
 
         //get file name
         $file_id = $params['file_id'];
-        $file = $this->fileModel->find($file_id);
+        $file = $this->fileModel->find((int)$file_id);
         $file['action'] = $params['action'];
         // Kint::dump($file);
 
@@ -1805,7 +1805,7 @@ class EmployeeMultiEventServiceController extends BaseController
         {
             //get file name
             $file_id = $params['file_id'];
-            $file = $this->fileModel->find($file_id);
+            $file = $this->fileModel->find((int)$file_id);
             $file['action'] = $params['action'];
             // dd($file);
             $return = [];
@@ -1910,7 +1910,7 @@ class EmployeeMultiEventServiceController extends BaseController
             // $this->setPullNotification($this->getFileMetaDataByFileId($file_id, 'success'));
         } else if (isset($params['client_policy_id'])) //handle data from enrollment to inception
         {
-            $client_policy_id = $params['client_policy_id'];
+            $client_policy_id = (int)$params['client_policy_id'];
             //get client id
             $client_id = ($this->clientPolicyModel->select('client_id')->find($client_policy_id))['client_id'];
             // dd($client_id);
@@ -1956,7 +1956,7 @@ class EmployeeMultiEventServiceController extends BaseController
 
         //get file name
         $file_id = $params['file_id'];
-        $file = $this->fileModel->find($file_id);
+        $file = $this->fileModel->find((int)$file_id);
         $file['action'] = $params['action'];
         // dd($file);
 
@@ -1975,7 +1975,7 @@ class EmployeeMultiEventServiceController extends BaseController
         $endorsement_data = [];
         $policy_terms = $this->clientPolicyModel->getPolicyDetails($file['client_id'], $file['policy_id']);
         $insurer = new InsurerModel();
-        $insurer = ($insurer->find($policy_terms[0]->insurer_id));
+        $insurer = ($insurer->find((int)$policy_terms[0]->insurer_id));
         // kint::dump($insurer);
 
         //make closure funciton which is going to use only by this method
@@ -2095,7 +2095,7 @@ class EmployeeMultiEventServiceController extends BaseController
         helper('excel_util_helper');
         //get file name
         $file_id = $params['file_id'];
-        $file = $this->fileModel->find($file_id);
+        $file = $this->fileModel->find((int)$file_id);
         $file['action'] = $params['action'];
         
 
@@ -2173,7 +2173,7 @@ class EmployeeMultiEventServiceController extends BaseController
         helper('excel_util_helper');
         //get file name
         $file_id = $params['file_id'];
-        $file = $this->fileModel->find($file_id);
+        $file = $this->fileModel->find((int)$file_id);
         $file['action'] = $params['action'];
 
         // $file_name_with_path = WRITEPATH . "/uploads/excel/" . $file['file_name'];
@@ -2470,7 +2470,7 @@ class EmployeeMultiEventServiceController extends BaseController
     {
 
         try {
-            $file = $this->fileModel->find($file_id);
+            $file = $this->fileModel->find((int)$file_id);
             // $error_data = json_decode($file['reason'], true);
             $error_data = $res;
             // dd($error_data);
@@ -2632,7 +2632,7 @@ class EmployeeMultiEventServiceController extends BaseController
         // dd($this->request);
         helper('excel_util_helper');
         //get file name
-        $file_id = $params['file_id'];
+        $file_id = (int)$params['file_id'];
         $file = $this->fileModel->find($file_id);
         // dd($file);
         $return = [];

app/Controllers/EmployeeRestController.php

@@ -2220,7 +2220,7 @@ class EmployeeRestController extends AdminController
         // dd($client_policy_id);
 
 
-        $client_id = ($this->clientPolicyModel->select('client_id')->find($client_policy_id))['client_id'];
+        $client_id = ($this->clientPolicyModel->select('client_id')->find((int)$client_policy_id))['client_id'];
         // get policy and rack details
         $policy_terms = $this->clientPolicyModel->getPolicyDetails($client_id, $client_policy_id);
         $policy_type = $policy_terms[0]->is_addon;
@@ -3274,7 +3274,7 @@ class EmployeeRestController extends AdminController
                         // Check if the update was successful
                         if ($db->affectedRows() > 0) {
                             // Fetch the updated employee data
-                            $updated_employee = $this->employeeModel->find($id);
+                            $updated_employee = $this->employeeModel->find((int)$id);
                             return $this->respond(['status' => 'success', 'code' => 200, 'data' => $updated_employee], 200);
                         } else {
                             log_message('error', 'Update failed. No rows affected.');
@@ -3650,15 +3650,16 @@ class EmployeeRestController extends AdminController
 
             from employees emp 
 
-            left join employees empl on empl.id = $insured_emp_id and empl.is_active = 1 and empl.emp_status = 'active'
+            left join employees empl on empl.id = :insured_emp_id: and empl.is_active = 1 and empl.emp_status = 'active'
-            left join employee_polices emp_pol on empl.id = emp_pol.employee_id and emp_pol.client_policy_id = $client_policy_id and emp_pol.is_active = 1 
+            left join employee_polices emp_pol on empl.id = emp_pol.employee_id and emp_pol.client_policy_id = :client_policy_id: and emp_pol.is_active = 1 
             left join client_policy cp on cp.id = emp_pol.client_policy_id and cp.is_active = 1
             left join client_rm cl_rm on cl_rm.client_id = empl.client_id and cl_rm.is_active = 1 and cl_rm.level = 3 
 
-        where emp.id = $employee_id and emp.is_active = 1 and emp.emp_status = 'active'
+        where emp.id = :employee_id: and emp.is_active = 1 and emp.emp_status = 'active'
         limit 1 ";
 
-        $emp_ticket_data = $this->employeeModel->query($sql)->getResultArray();
+        $binds = ['insured_emp_id'=>$insured_emp_id,'client_policy_id'=>(int)$client_policy_id,'$employee_id'=>$employee_id ];
+        $emp_ticket_data = $this->employeeModel->query($sql,$binds)->getResultArray();
         // print_r(db_connect()->getLastQuery()); die;
 
         if (!empty($emp_ticket_data)) {
@@ -4614,7 +4615,7 @@ class EmployeeRestController extends AdminController
             ];
 
             // Check if record exists
-            $record = $this->hrFileUploadModel->find($id);
+            $record = $this->hrFileUploadModel->find((int)$id);
             if (!$record) {
                 return $this->failNotFound("Record with ID {$id} not found.");
             }
@@ -4640,7 +4641,7 @@ class EmployeeRestController extends AdminController
             $file_id = $this->request->getGet('id') ?? $id;
 
             // Find record
-            $record = $this->hrFileUploadModel->where('id', $file_id)->find();
+            $record = $this->hrFileUploadModel->where('id', (int)$file_id)->find();
 
             // print_rr( $record);die;
 

app/Controllers/EmployeeServiceController.php

@@ -784,7 +784,7 @@ class EmployeeServiceController extends AdminController
         //get file name
         // check_dob_diff('4-APr-1990');die();
         $file_id = $params['file_id'];
-        $file = $this->fileModel->find($file_id);
+        $file = $this->fileModel->find((int)$file_id);
         // dd($file);
         $return = [];
         if(!isset($file))
@@ -1062,7 +1062,7 @@ class EmployeeServiceController extends AdminController
         helper('excel_util_helper');
         //get file name
         $file_id = $params['file_id'];
-        $file = $this->fileModel->find($file_id);
+        $file = $this->fileModel->find((int)$file_id);
         // dd($file);
         $return = [];
         if(!isset($file))
@@ -1322,7 +1322,7 @@ class EmployeeServiceController extends AdminController
         {
                     //get file name
                     $file_id = $params['file_id'];
-                    $file = $this->fileModel->find($file_id);
+                    $file = $this->fileModel->find((int)$file_id);
                     // dd($file);
                     $return = [];
                     if(!isset($file))
@@ -1424,7 +1424,7 @@ class EmployeeServiceController extends AdminController
          {
             $client_policy_id = $params['client_policy_id'];
             //get client id
-            $client_id = ($this->clientPolicyModel->select('client_id')->find($client_policy_id))['client_id'];
+            $client_id = ($this->clientPolicyModel->select('client_id')->find((int)$client_policy_id))['client_id'];
             // dd($client_id);
 
             // get policy and rack details
@@ -1470,7 +1470,7 @@ class EmployeeServiceController extends AdminController
          helper('excel_util_helper');
         //get file name
         $file_id = $params['file_id'];
-        $file = $this->fileModel->find($file_id);
+        $file = $this->fileModel->find((int)$file_id);
         // dd($file);
 
         $file_name_with_path = WRITEPATH."/uploads/excel/".$file['file_name'];
@@ -1489,7 +1489,7 @@ class EmployeeServiceController extends AdminController
         $endorsement_data = [];
         $policy_terms = $this->clientPolicyModel->getPolicyDetails($file['client_id'],$file['policy_id']);
         $insurer = new InsurerModel();
-        $insurer = ($insurer->find($policy_terms[0]->insurer_id));
+        $insurer = ($insurer->find((int)$policy_terms[0]->insurer_id));
         // kint::dump($insurer);
         //make closure funciton which is going to use only by this method
         $endorsement = function($data,$file,$row) use ($insurer){
@@ -1621,7 +1621,7 @@ class EmployeeServiceController extends AdminController
          helper('excel_util_helper');
         //get file name
         $file_id = $params['file_id'];
-        $file = $this->fileModel->find($file_id);
+        $file = $this->fileModel->find((int)$file_id);
         // dd($file);
 
         $file_name_with_path = WRITEPATH."/uploads/excel/".$file['file_name'];
@@ -1700,7 +1700,7 @@ class EmployeeServiceController extends AdminController
         helper('excel_util_helper');
         //get file name
         $file_id = $params['file_id'];
-        $file = $this->fileModel->find($file_id);
+        $file = $this->fileModel->find((int)$file_id);
         // dd($file);
 
         $file_name_with_path = WRITEPATH . "/uploads/excel/" . $file['file_name'];
@@ -2028,7 +2028,7 @@ class EmployeeServiceController extends AdminController
     {
 
         try {
-            $file = $this->fileModel->find($file_id);
+            $file = $this->fileModel->find((int)$file_id);
             $error_data = json_decode($file['reason']);
             // dd($error_data);
             //  return $error_data;
@@ -2187,7 +2187,7 @@ class EmployeeServiceController extends AdminController
             helper('excel_util_helper');
             //get file name
             $file_id = $params['file_id'];
-            $file = $this->fileModel->find($file_id);
+            $file = $this->fileModel->find((int)$file_id);
             // dd($file);
             $return = [];
             if(!isset($file))

app/Controllers/GoogleDriveController.php

@@ -116,7 +116,7 @@ class GoogleDriveController extends BaseController
             }
 
         //if not in cache then get it from grdrive    
-        $client = $this->clientModel->find($client_id);
+        $client = $this->clientModel->find((int)$client_id);
         $clientShortName = $client['short_name']; // Assuming short_name is the column for client's short name
         }
         else if($client_policy_id)

app/Controllers/LeadsController.php

@@ -2538,7 +2538,7 @@ class LeadsController extends BaseController
     public function calculateMembersDemography($params, $returnType = null)
     {
         $lead_id = $params['lead_id'];
-        $lead_data = $this->leadsModel->find($lead_id);
+        $lead_data = $this->leadsModel->find((int)$lead_id);
         $file_name_with_path = WRITEPATH . "/uploads/lead_files/" . $lead_data['file_name'];
 
         if (!$lead_data) {
@@ -2999,7 +2999,7 @@ class LeadsController extends BaseController
 
         // print_r($params); die;
 
-        $lead_id = $params['lead_id'];
+        $lead_id = (int)$params['lead_id'];
         $file_type  = $params['file_type']; //rfq or qcr
         $recipient_type = $params['recipient_type']; //insurer or client or internal or placement  
         $recipient_mail = $params['recipient_mail']; // - only primary key of contacts
@@ -3033,7 +3033,7 @@ class LeadsController extends BaseController
 
         if ($recipient_type === 'placement') {
 
-            $lead_data = $this->leadsModel->find($lead_id);
+            $lead_data = $this->leadsModel->find((int)$lead_id);
 
             $data = [];
 
@@ -5320,7 +5320,7 @@ class LeadsController extends BaseController
     public function handleMemberDataGPATotalSumInsurerFromExcel($params)
     {
         $lead_id = $params['lead_id'];
-        $lead_data = $this->leadsModel->find($lead_id);
+        $lead_data = $this->leadsModel->find((int)$lead_id);
         // dd($lead_data);
         $file_name_with_path = WRITEPATH . "/uploads/lead_files/" . $lead_data['file_name'];
         //  dd($file_name_with_path);

app/Controllers/MasterController.php

@@ -1197,7 +1197,7 @@ class MasterController extends AdminController
         // print_r($id);die;
             foreach ($policies as $policy) {
                 // Retrieve the insurer information
-                $insurer = $this->insurerModel->find($policy['insurer_id']);
+                $insurer = $this->insurerModel->find((int)$policy['insurer_id']);
 
                 // print_r($insurer);die;
                 // Add the insurer information to the editData array

app/Controllers/PayoutController.php

@@ -147,7 +147,7 @@ class PayoutController extends BaseController
                 $summary_data = $this->invoiceModel->utrSummary($invoice_id);
                 if($summary_data['invoice_amount'] == $summary_data['total_utr_amount']){
                     $sql = "UPDATE partner_invoice SET payout_status = 2 WHERE id = ?";
-                    db_connect()->query($sql, [$invoice_id]);
+                    db_connect()->query($sql, [(int)$invoice_id]);
                 }
 
                 return $this->respond(['status' => true, 'code' => 200, 'data' => $payout_edit_data, "message" => "UTR successfully updated"], 200);
@@ -166,7 +166,7 @@ class PayoutController extends BaseController
                 $summary_data = $this->invoiceModel->utrSummary($invoice_id);
                 if($summary_data['invoice_amount'] == $summary_data['total_utr_amount']){
                     $sql = "UPDATE partner_invoice SET payout_status = 2 WHERE id = ?";
-                    db_connect()->query($sql, [$invoice_id]);
+                    db_connect()->query($sql, [(int)$invoice_id]);
                 }
 
                 return $this->respond(['status' => true, 'code' => 200, 'data' => $payout_data, "message" => "UTR added successfully"], 200);

app/Controllers/PolicyTransactionController.php

@@ -3639,7 +3639,7 @@
             helper('excel_util_helper');
             //get file info
             $file_id = $params['file_id'];
-            $file = $this->insurerStatements->find($file_id);
+            $file = $this->insurerStatements->find((int)$file_id);
             // dd($file);
             $date = new \DateTime($file['month']);
 
@@ -3757,7 +3757,7 @@
             try {
 
                 //get file info
-                $file = $this->insurerStatements->find($file_id);
+                $file = $this->insurerStatements->find((int)$file_id);
                 // dd($file);
 
                 $date = new \DateTime($file['month']);
@@ -3910,7 +3910,7 @@
             helper('excel_util_helper');
             //get file info
             $file_id = $params['file_id'];
-            $file = $this->insurerStatements->find($file_id);
+            $file = $this->insurerStatements->find((int)$file_id);
             // dd($file);
             $date = new \DateTime($file['month']);
 
@@ -4075,7 +4075,7 @@
         {
             $statement_id = $this->request->getUri()->getSegment(4);
 
-            $inv_details = $this->insurerStatements->find($statement_id);
+            $inv_details = $this->insurerStatements->find((int)$statement_id);
             $inv_payment_details = $this->invPaymentDetailsModel
                 ->where('statement_id', $statement_id)
                 ->where('is_active', 1)
@@ -4212,7 +4212,7 @@
         public function getFileErr()
         {
             $file_id = $this->request->getUri()->getSegment(4);
-            $file = $this->insurerStatements->find($file_id);
+            $file = $this->insurerStatements->find((int)$file_id);
             return $this->respond(['dataStatus' => true, 'code' => 200, 'data' => $file['reason']], 200);
         }
 

app/Controllers/SalesController.php

@@ -128,7 +128,7 @@ class SalesController extends BaseController
     public function updateLead($id)
     {
         try {
-            if (!$this->leadModel->find($id)) {
+            if (!$this->leadModel->find((int)$id)) {
                 return $this->failNotFound('Lead not found');
             }
 
@@ -158,7 +158,7 @@ class SalesController extends BaseController
     public function deleteLead($id)
     {
         try {
-            if (!$this->leadModel->find($id)) {
+            if (!$this->leadModel->find((int)$id)) {
                 return $this->failNotFound('Lead not found');
             }
 
@@ -228,7 +228,7 @@ class SalesController extends BaseController
             }
 
             $contactId = $this->contactModel->getInsertID();
-            $contact = $this->contactModel->find($contactId);
+            $contact = $this->contactModel->find((int)$contactId);
 
             return $this->respondCreated([
                 'status' => 'success',
@@ -247,18 +247,18 @@ class SalesController extends BaseController
     public function updateContact($id)
     {
         try {
-            if (!$this->contactModel->find($id)) {
+            if (!$this->contactModel->find((int)$id)) {
                 return $this->failNotFound('Contact not found');
             }
 
             $data = $this->request->getJSON(true);
             $data['updated_by'] = $this->getUserId();
 
-            if (!$this->contactModel->update($id, $data)) {
+            if (!$this->contactModel->update((int)$id, $data)) {
                 return $this->fail($this->contactModel->errors(), ResponseInterface::HTTP_BAD_REQUEST);
             }
 
-            $contact = $this->contactModel->find($id);
+            $contact = $this->contactModel->find((int)$id);
 
             return $this->respond([
                 'status' => 'success',
@@ -277,11 +277,11 @@ class SalesController extends BaseController
     public function deleteContact($id)
     {
         try {
-            if (!$this->contactModel->find($id)) {
+            if (!$this->contactModel->find((int)$id)) {
                 return $this->failNotFound('Contact not found');
             }
 
-            $this->contactModel->delete($id);
+            $this->contactModel->delete((int)$id);
 
             return $this->respondDeleted([
                 'status' => 'success',
@@ -299,7 +299,7 @@ class SalesController extends BaseController
     public function setPrimaryContact($id)
     {
         try {
-            $contact = $this->contactModel->find($id);
+            $contact = $this->contactModel->find((int)$id);
             
             if (!$contact) {
                 return $this->failNotFound('Contact not found');
@@ -425,7 +425,7 @@ class SalesController extends BaseController
             }
 
             $activityId = $this->activityModel->getInsertID();
-            $activity = $this->activityModel->find($activityId);
+            $activity = $this->activityModel->find((int)$activityId);
 
             return $this->respondCreated([
                 'status' => 'success',
@@ -444,7 +444,7 @@ class SalesController extends BaseController
     public function updateActivity($id)
     {
         try {
-            if (!$this->activityModel->find($id)) {
+            if (!$this->activityModel->find((int)$id)) {
                 return $this->failNotFound('Activity not found');
             }
 
@@ -455,7 +455,7 @@ class SalesController extends BaseController
                 return $this->fail($this->activityModel->errors(), ResponseInterface::HTTP_BAD_REQUEST);
             }
 
-            $activity = $this->activityModel->find($id);
+            $activity = $this->activityModel->find((int)$id);
 
             return $this->respond([
                 'status' => 'success',
@@ -474,7 +474,7 @@ class SalesController extends BaseController
     public function completeActivity($id)
     {
         try {
-            $activity = $this->activityModel->find($id);
+            $activity = $this->activityModel->find((int)$id);
             
             if (!$activity) {
                 return $this->failNotFound('Activity not found');
@@ -487,7 +487,7 @@ class SalesController extends BaseController
             $data = $this->request->getJSON(true);
             $data['updated_by'] = $this->getUserId();
 
-            $this->activityModel->completeActivity($id, $data);
+            $this->activityModel->completeActivity((int)$id, $data);
 
             // Create follow-up activity if requested
             if (!empty($data['create_followup']) && $data['create_followup'] === true) {
@@ -505,7 +505,7 @@ class SalesController extends BaseController
                 $this->activityModel->insert($followupData);
             }
 
-            $updatedActivity = $this->activityModel->find($id);
+            $updatedActivity = $this->activityModel->find((int)$id);
 
             return $this->respond([
                 'status' => 'success',
@@ -524,11 +524,11 @@ class SalesController extends BaseController
     public function deleteActivity($id)
     {
         try {
-            if (!$this->activityModel->find($id)) {
+            if (!$this->activityModel->find((int)$id)) {
                 return $this->failNotFound('Activity not found');
             }
 
-            $this->activityModel->delete($id);
+            $this->activityModel->delete((int)$id);
 
             return $this->respondDeleted([
                 'status' => 'success',
@@ -595,7 +595,7 @@ class SalesController extends BaseController
             }
 
             $noteId = $this->noteModel->getInsertID();
-            $note = $this->noteModel->find($noteId);
+            $note = $this->noteModel->find((int)$noteId);
 
             return $this->respondCreated([
                 'status' => 'success',
@@ -614,7 +614,7 @@ class SalesController extends BaseController
     public function updateNote($id)
     {
         try {
-            $note = $this->noteModel->find($id);
+            $note = $this->noteModel->find((int)$id);
             
             if (!$note) {
                 return $this->failNotFound('Note not found');
@@ -632,7 +632,7 @@ class SalesController extends BaseController
                 return $this->fail($this->noteModel->errors(), ResponseInterface::HTTP_BAD_REQUEST);
             }
 
-            $updatedNote = $this->noteModel->find($id);
+            $updatedNote = $this->noteModel->find((int)$id);
 
             return $this->respond([
                 'status' => 'success',
@@ -651,7 +651,7 @@ class SalesController extends BaseController
     public function deleteNote($id)
     {
         try {
-            $note = $this->noteModel->find($id);
+            $note = $this->noteModel->find((int)$id);
             
             if (!$note) {
                 return $this->failNotFound('Note not found');
@@ -662,7 +662,7 @@ class SalesController extends BaseController
                 return $this->failUnauthorized('You are not authorized to delete this note');
             }
 
-            $this->noteModel->delete($id);
+            $this->noteModel->delete((int)$id);
 
             return $this->respondDeleted([
                 'status' => 'success',

app/Controllers/ThzController.php

@@ -238,7 +238,7 @@ class ThzController extends BaseController
                 
                 $accManagerId = $this->getAcmIdUsingClientId($clientId ?? null);
                
-                $accManager = $this->userModel->find($accManagerId);
+                $accManager = $this->userModel->find((int)$accManagerId);
 
             if (!empty($result['master'])) {
                 $notes = $this->thzMasterNotesModel->ticketConversationList($thz_id, $returnType);

app/Controllers/TicketController.php

@@ -1292,8 +1292,9 @@ class TicketController extends BaseController
         } elseif ($action == 3) {
             $table_id = (int)$this->request->getPost('id');
 
-            $sql = "update ticket_mail_template set is_active = 0 where id = $table_id ";
+            $sql = "update ticket_mail_template set is_active = 0 where id = :table_id: ";
-            $status = $this->ticketMailTemplateModel->query($sql);
+            $binds = ['table_id'=>$table_id];
+            $status = $this->ticketMailTemplateModel->query($sql,$binds);
             if ($status) {
                 return $this->respond(['status' => true], 200);
             } else {
@@ -1774,11 +1775,12 @@ class TicketController extends BaseController
             
         
         WHERE 
-            th.ticket_id = $ticket_id
+            th.ticket_id = :ticket_id:
             AND th.is_active = 1
         ORDER BY 
             th.created_at DESC";
-        $data = $this->ticketHistoryModel->query($sql)->getResultArray();
+        $binds = ['ticket_id'=>(int)$ticket_id];
+        $data = $this->ticketHistoryModel->query($sql,$binds)->getResultArray();
         // dd(db_connect()->getLastQuery());
         $priorityType = $this->priorityType;
         $relationshipType = $this->relationshipType;

app/Controllers/TicketServiceController.php

@@ -1144,7 +1144,7 @@ class TicketServiceController extends BaseController
     {
         //get file name
         $file_id = $params['file_id'];
-        $file = $this->claimDumpFileModel->find($file_id);
+        $file = $this->claimDumpFileModel->find((int)$file_id);
         $this->myLogger->logme('error', "Start the claim dump File Data Validataion with the file id : " . $file_id);
         // dd($file);
 
@@ -1329,7 +1329,7 @@ class TicketServiceController extends BaseController
     {
         //get file name
         $file_id = $params['file_id'];
-        $file = $this->claimDumpFileModel->find($file_id);
+        $file = $this->claimDumpFileModel->find((int)$file_id);
         $this->myLogger->logme('error', "Start the claim dump OnBoard Process with the file id : " . $file_id);
         // dd($file);
 

app/Controllers/UserController.php

@@ -599,7 +599,7 @@ class UserController extends AdminController
                 
                 // don't forgot same means just unset the key because partner_staff some UNIQUE KEY sets in table thats why
                 if ($id) {
-                    $existing = $this->partnerStaffModel->find($id);
+                    $existing = $this->partnerStaffModel->find((int)$id);
                     if ($existing) {
                         if ($data['email'] === $existing['email']) { unset($data['email']); }
                         if ($data['mobile'] === $existing['mobile']) { unset($data['mobile']); }
@@ -667,7 +667,7 @@ class UserController extends AdminController
                         return $this->response->setJSON(['status'  => 'error', 'message' => 'ID is required'])->setStatusCode(400);
                     }
 
-                    $staff = $this->partnerStaffModel->find($id);
+                    $staff = $this->partnerStaffModel->find((int)$id);
                     if (!$staff) {
                         return $this->response->setJSON(['status'  => 'error','message' => 'Staff not found'])->setStatusCode(404);
                     }
@@ -783,7 +783,7 @@ class UserController extends AdminController
                         return $this->response->setJSON(['status'  => 'error', 'message' => 'ID is required'])->setStatusCode(400);
                     }
 
-                    $files = $this->partnerManagerIncentiveFileModel->find($id);
+                    $files = $this->partnerManagerIncentiveFileModel->find((int)$id);
                     if (!$files) {
                         return $this->response->setJSON(['status'  => 'error','message' => 'No Records found'])->setStatusCode(404);
                     }

app/Helpers/ChatbotHelper.php

@@ -59,7 +59,7 @@ class ChatbotHelper
         // $policy_id = 0;
         // $relationship ='Father';
         $EmployeeModel = new EmployeeModel();
-        $data = $EmployeeModel->find($emp_id);
+        $data = $EmployeeModel->find((int)$emp_id);
         if(isset($data) && isset($data['email_corporate']))
         {
             $message = SELF::ReimbursementProcessMailTemplate();

app/Helpers/excel_util_helper.php

@@ -1128,7 +1128,7 @@ if (!function_exists('premium_calculation_manager_old')) {
         //if curent action is dependent addition OR addition then pull insurer master to set whether add one day from employee date of coverage
         if ($emp_data['temp']['action'] == 'DA' || $emp_data['temp']['action'] == 'A') {
             $insurer = new InsurerModel();
-            $insurer = ($insurer->find($policy_terms['insurer_id']));
+            $insurer = ($insurer->find((int)$policy_terms['insurer_id']));
             if (isset($insurer['addition_add_day']) && $insurer['addition_add_day'] == true) {
                 // $emp_data['policy_details']['date_coverage'] = (new DateTime($emp_data['policy_details']['date_coverage']))->modify('+1 day')->format('Y-m-d');
 
@@ -1535,7 +1535,7 @@ if (!function_exists('premium_calculation_manager')) {
         //if curent action is dependent addition OR addition then pull insurer master to set whether add one day from employee date of coverage
         if ($emp_data['temp']['action'] == 'DA' || $emp_data['temp']['action'] == 'A') {
             $insurer = new InsurerModel();
-            $insurer = ($insurer->find($policy_terms['insurer_id']));
+            $insurer = ($insurer->find((int)$policy_terms['insurer_id']));
             if (isset($insurer['addition_add_day']) && $insurer['addition_add_day'] == true) {
                 // $emp_data['policy_details']['date_coverage'] = (new DateTime($emp_data['policy_details']['date_coverage']))->modify('+1 day')->format('Y-m-d');
 
@@ -2000,8 +2000,9 @@ if (!function_exists('get_emp_records_from_audit_history')) {
     function get_emp_records_from_audit_history($employee_id)
     {
         $db = db_connect();
-        $query = "SELECT min(id) as id,pk,table_name,field_name,old_value FROM auditing_history where pk  = $employee_id and table_name = 'employees' and field_name in ('name','dob','gender','mobile','email_corporate','relationship') group by field_name order by id asc";
+        $query = "SELECT min(id) as id,pk,table_name,field_name,old_value FROM auditing_history where pk  = :employee_id: and table_name = 'employees' and field_name in ('name','dob','gender','mobile','email_corporate','relationship') group by field_name order by id asc";
-        $res = $db->query($query);
+        $binds = ['employee_id'=>(int)$employee_id];
+        $res = $db->query($query,$binds);
         // echo $db->getLastQuery();
         $res = $res->getResultArray();
         if (count($res)) {
@@ -2019,8 +2020,9 @@ if (!function_exists('get_emp_policy_records_from_audit_history')) {
     function get_emp_policy_records_from_audit_history($emp_policy_id)
     {
         $db = db_connect();
-        $query = "SELECT min(id) as id,pk,table_name,field_name,old_value FROM auditing_history where pk  = $emp_policy_id and table_name = 'employee_polices' and field_name in ('basic_cover_si','premium','gst') group by field_name order by id asc";
+        $query = "SELECT min(id) as id,pk,table_name,field_name,old_value FROM auditing_history where pk  = :emp_policy_id: and table_name = 'employee_polices' and field_name in ('basic_cover_si','premium','gst') group by field_name order by id asc";
-        $res = $db->query($query);
+        $binds = ['emp_policy_id'=>(int)$emp_policy_id];
+        $res = $db->query($query,$binds);
         // echo $db->getLastQuery();
         $res = $res->getResultArray();
         if (count($res)) {

app/Models/ClientPolicyModel.php

@@ -409,15 +409,16 @@ class ClientPolicyModel extends Model
             JOIN (
                 SELECT MAX(id) AS max_id
                 FROM cash_deposit
-                WHERE is_active = 1 AND client_id = $id
+                WHERE is_active = 1 AND client_id = :id:
                 GROUP BY insurer_id, cd_ac_pk
             ) latest ON latest.max_id = cd.id
             JOIN insurers on cd.insurer_id = insurers.id
-            WHERE cd.is_active = 1 AND cd.client_id = $id AND cdm.is_active = 1
+            WHERE cd.is_active = 1 AND cd.client_id = :id: AND cdm.is_active = 1
             ORDER BY cd.insurer_id;
         ";
 
-        return $this->db->query($sql)->getResult();
+        $binds = ['id'=>(int)$id];
+        return $this->db->query($sql,$binds)->getResult();
 
     }
 
@@ -464,10 +465,12 @@ class ClientPolicyModel extends Model
             FROM client_policy
             JOIN policies ON policies.id = client_policy.policy_id
             JOIN policy_type ON policy_type.id = policies.policy_type_id
-            WHERE policy_type.policy_type = '{$type}'        
+            WHERE policy_type.policy_type = :type:
-            AND client_policy.client_id = {$client_id}";
+            AND client_policy.client_id = :client_id:";
 
-        $result = $this->db->query($query)->getResult();
+        $binds = ['type' =>$type,'client_id'=>(int)$client_id];
+            
+        $result = $this->db->query($query,$binds)->getResult();
 
         return $result;
     }

app/Models/EmpEndorsementModel.php

@@ -94,10 +94,11 @@ class EmpEndorsementModel extends Model
             FROM emp_endorsement
         JOIN employee_polices ON employee_polices.id = emp_endorsement.pk
         JOIN client_policy ON client_policy.id = employee_polices.client_policy_id
-        WHERE group_key = '{$group_key}'
+        WHERE group_key = :group_key:
         ";
 
-        $results = $this->db->query($query)->getResult();
+        $binds['group_key'] = $group_key;
+        $results = $this->db->query($query,$binds)->getResult();
         return $results;
 
     }
@@ -191,10 +192,10 @@ class EmpEndorsementModel extends Model
                             e1.field_name = 'status'
                     ) ee ON aa.emp_code = ee.emp_code
             ) AS deletiondata ON a.emp_code = deletiondata.emp_code 
-            WHERE group_key = '{$group_key}';
+            WHERE group_key = :group_key: ;
             ";
-
+        $binds['group_key'] = $group_key;
-        $results = $this->db->query($query)->getResult();
+        $results = $this->db->query($query,$binds)->getResult();
         return $results;
 
     }

app/Models/EmployeeModel.php

@@ -223,12 +223,13 @@ class EmployeeModel extends Model
                             emp_code,
                             COUNT(*) AS family_member_count,
                             MAX(TIMESTAMPDIFF(YEAR, dob, CURDATE())) AS max_age
-                        FROM employees where emp_code = '{$emp_code}'
+                        FROM employees where emp_code = :emp_code:
                         GROUP BY emp_code
                     ) AS family_stats
                     ORDER BY family_member_count DESC, max_age DESC
                     LIMIT 1;";
-        $results = $this->db->query($query)->getResultArray();
+        $binds['emp_code'] = $emp_code;
+        $results = $this->db->query($query,$binds)->getResultArray();
         return $results;
     }
 

app/Models/EmployeePolicyModel.php

@@ -430,7 +430,7 @@ class EmployeePolicyModel extends Model
                 employees.gender AS emp_gender,
                 employees.relationship AS emp_relationship,
                 employees.relationship_code AS emp_relationship_code,
-                '$datas' as event_type_data,
+                :datas: as event_type_data,
                 employees.change_event AS change_event,
 
 
@@ -483,24 +483,30 @@ class EmployeePolicyModel extends Model
                     batch_files.batch_code as bf
                 FROM batch_files 
                 LEFT JOIN batch_list ON batch_files.batch_code = batch_list.batch_code 
-                WHERE batch_files.event_type = '{$event}' 
+                WHERE batch_files.event_type = :event:
                     AND batch_files.actions = 'export' 
-                    AND batch_files.insurer_or_tpa = '{$insurer_or_tpa}'
+                    AND batch_files.insurer_or_tpa = :insurer_or_tpa:
-                    AND batch_files.client_policy_id = '{$client_policy_id}'
+                    AND batch_files.client_policy_id = :client_policy_id:
-                    AND batch_files.client_policy_id = '{$client_id}'
+                    AND batch_files.client_policy_id = :client_id:
                     
             ) as batch_data ON employee_polices.id = batch_data.emp_policy_id
-            WHERE employee_polices.client_policy_id = '{$client_policy_id}'
+            WHERE employee_polices.client_policy_id = :client_policy_id:
-                AND (employee_polices.{$id} IS NULL OR employee_polices.{$id} = '')
+                AND (employee_polices.:id: IS NULL OR employee_polices.:id: = '')
-                AND employees.client_branch_id = '{$client_branch_id}'
+                AND employees.client_branch_id = :client_branch_id:
                 AND employee_polices.is_active = 1
                 AND employee_polices.status = 'active'
                 AND employees.is_active = 1
                 AND employees.emp_status = 'active'
         ";
 
+        $binds = ["datas" => $datas,"event" => $event
+            ,"insurer_or_tpa" => $insurer_or_tpa
+            ,"client_policy_id" => $client_policy_id
+            ,"client_branch_id" => $client_branch_id
+            ,"client_id" => $client_id,"id" => $id];
+
             // Get the result set
-            $query = $this->db->query($sql);
+            $query = $this->db->query($sql,$binds);
             
             if($return_type == 1){
                 $results = $query->getResultArray();
@@ -573,9 +579,9 @@ class EmployeePolicyModel extends Model
                         employees ON employees.id = emp_endorsement.pk
                     LEFT JOIN 
                         employee_polices ON employees.id = employee_polices.employee_id
-                    WHERE employees.client_id = '{$client_id}'
+                    WHERE employees.client_id = :client_id:
-                    AND employee_polices.client_policy_id = '{$client_policy_id}'
+                    AND employee_polices.client_policy_id = :client_policy_id:
-                    AND employees.client_branch_id = '{$client_branch_id}'
+                    AND employees.client_branch_id = :client_branch_id:
                     AND emp_endorsement.actions = 'c'
                     AND emp_endorsement.status != 'truncated'
                     AND emp_endorsement.is_active = 1
@@ -585,8 +591,10 @@ class EmployeePolicyModel extends Model
                     AND employees.emp_status = 'active'
                     $endorsement_condition";
 
+                    $binds = ["client_policy_id" => $client_policy_id,"client_branch_id" => $client_branch_id,"client_id" => $client_id];
+
                 // Execute the raw query
-                $query = $this->db->query($sql);
+                $query = $this->db->query($sql,$binds);
 
                 // Get the result set
                 if($return_type == 1){
@@ -1284,12 +1292,12 @@ class EmployeePolicyModel extends Model
                     (
                         SELECT employees.id
                         FROM employees
-                        WHERE client_id = '$client_id'
+                        WHERE client_id = :client_id:
-                            AND client_branch_id = '$client_branch_id'
+                            AND client_branch_id = :client_branch_id:
                             AND is_active = 1
                             AND emp_status = 'active'
-                            AND emp_code = '$emp_code'
+                            AND emp_code = :emp_code:
-                            AND name = '$emp_name'
+                            AND name = :emp_name:
                         LIMIT 1
                     ) AS employees_id,
 
@@ -1318,10 +1326,10 @@ class EmployeePolicyModel extends Model
                     JOIN employee_polices AS ep ON ep.id = ee.pk
                     JOIN employees AS e ON e.emp_code = ee.emp_code
                 WHERE
-                    ee.emp_code = '$emp_code'
+                    ee.emp_code = :emp_code:
-                    AND ep.client_policy_id = '$client_policy_id'
+                    AND ep.client_policy_id = :client_policy_id:
-                    AND e.client_branch_id = '$client_branch_id'
+                    AND e.client_branch_id = :client_branch_id:
-                    AND ee.name = '$emp_name'
+                    AND ee.name = :emp_name:
                     AND ee.field_name IN ('date_of_exit', 'reason_for_exit', 'status', 'claim_status')
                     AND ep.is_active = 1
                     AND ep.status = 'active'
@@ -1331,10 +1339,15 @@ class EmployeePolicyModel extends Model
                     ee.group_key
         ";
 
+        $binds = ['client_policy_id' => $client_policy_id,
+        'client_branch_id' => $client_branch_id,
+        'client_id' => $client_id,
+        'emp_name' => $emp_name,
+        'emp_code' => $emp_code];
         // dd($sql);
 
         // Execute the raw SQL query
-        $query = $this->db->query($sql);
+        $query = $this->db->query($sql,$binds);
 
         // Fetch and return results
          $row = $query->getRowArray();
@@ -1358,12 +1371,12 @@ class EmployeePolicyModel extends Model
 
       
         $query = "UPDATE employee_polices
-                    SET employee_polices.basic_cover_si = '{$basic_cover_si}'
+                    SET employee_polices.basic_cover_si = :basic_cover_si:
-                    , employee_polices.premium = '{$premium}'
+                    , employee_polices.premium = :premium:
-                    WHERE employee_polices.employee_id = '{$employee_id}'
+                    WHERE employee_polices.employee_id = :employee_id:
-                    AND employee_polices.client_policy_id = '{$client_policy_id}'";
+                    AND employee_polices.client_policy_id = :client_policy_id:";
-
+        $binds = ["client_policy_id"=>$client_policy_id, "employee_id"=>$employee_id,"basic_cover_si"=>$basic_cover_si,"premium"=>$premium];
-        $this->query($query);
+        $this->query($query,$binds);
     }
 
 

app/Models/PolicesModel.php

@@ -67,7 +67,7 @@ class PolicesModel extends Model
                     {
                         $grid_id = $value['policy_grid_id'];
                         $policyGridModel = new PolicyGridModel();
-                        $grid_type = $policyGridModel->find($grid_id);
+                        $grid_type = $policyGridModel->find((int)$grid_id);
                         $premium_slab_data[$key]['grid_master'] = $grid_type;
                     }
                      $premium_slab_data[$key]['grid_master'] = $grid_type;
@@ -78,7 +78,7 @@ class PolicesModel extends Model
             {
                 $additional_grid_id = $additional_premium_slab_data[0]['policy_grid_id'];
                 $policyGridModel = new PolicyGridModel();
-                $additional_grid_type = $policyGridModel->find($additional_grid_id);    
+                $additional_grid_type = $policyGridModel->find((int)$additional_grid_id);    
             }
 
 

app/Models/PolicyTransactionModel.php

@@ -2421,12 +2421,13 @@
             $sql1 = $builder2->getCompiledSelect();
             $sql2 = $builder->getCompiledSelect();
 
-            $finalSql = "($sql1) UNION ALL ($sql2) 
+            $finalSql = "(:sql1:) UNION ALL (:sql2:) 
                                 ORDER BY policy_no DESC, insurer_branch_name ASC, statement_uploaded ASC,
                                         STR_TO_DATE(policy_issue_month, '%b %Y') ASC";
 
 
-            $result = $this->db->query($finalSql)->getResultArray();
+            $binds = ['sql1'=>$sql1,'sql2'=>$sql1];
+            $result = $this->db->query($finalSql,$binds)->getResultArray();
             // dd($this->db->getLastQuery());
             return $result;
         }

app/Models/ThzMasterNotesModel.php

@@ -85,7 +85,6 @@ class ThzMasterNotesModel extends Model
             $ticketTypeFilter = "AND thz_master_notes.notes_type = 'External' ";
         } 
 
-        $integer_ticket_id = (int)$thz_id;
 
         $notes_sql = "SELECT 
                             thz_master_notes.*,
@@ -103,11 +102,12 @@ class ThzMasterNotesModel extends Model
                     LEFT JOIN thz_master 
                             ON thz_master.thz_id = thz_master_notes.thz_id 
                         AND LOWER(thz_master_notes.notes_by) = 'user'
-                    WHERE thz_master_notes.thz_id = ". $integer_ticket_id ."
+                    WHERE thz_master_notes.thz_id = :integerTicketId:
                     $ticketTypeFilter
                     ORDER BY thz_master_notes.created_at DESC";
 
-        $result = $this->db->query($notes_sql)->getResultArray();
+        $binds = ["integerTicketId" => (int)$thz_id];
+        $result = $this->db->query($notes_sql,$binds)->getResultArray();
 
         return $result;
     }

app/Models/TicketMasterModel.php

@@ -589,15 +589,17 @@ class TicketMasterModel extends Model
     {
         $ticket_type_data_1 = "";
         $ticket_type_data_2 = "";
+        $statusBinds = [];
 
         if (!empty($policy_type)) {
-            $ticket_type_data_1 = "AND ticket_type = $policy_type";
+            $ticket_type_data_1 = "AND ticket_type = :policy_type:";
-            $ticket_type_data_2 = "AND master.ticket_type_id = $policy_type";
+            $ticket_type_data_2 = "AND master.ticket_type_id = :policy_type:";
+            $statusBinds['policy_type'] = $policy_type;
         }
 
         // Fetch claim statuses dynamically
         $statusQuery = "SELECT id, claim_status FROM ticket_claim_status WHERE is_active = 1 $ticket_type_data_1";
-        $statusResult = $this->db->query($statusQuery)->getResultArray();
+        $statusResult = $this->db->query($statusQuery, $statusBinds)->getResultArray();
 
         // Initialize dynamic query parts
         $dynamicSelect = '';
@@ -649,7 +651,7 @@ class TicketMasterModel extends Model
             JOIN 
                 tpa ON master.tpa_id = tpa.id AND tpa.is_active = 1
             WHERE 
-                master.created_at BETWEEN '$start_date' AND '$end_date'
+                master.created_at BETWEEN :start_date: AND :end_date:
                 AND master.is_active = 1
                 $ticket_type_data_2
             GROUP BY 
@@ -657,7 +659,8 @@ class TicketMasterModel extends Model
         ";
 
         // Execute the query
-        $result = $this->db->query($sql)->getResultArray();
+        $binds = ["start_date"=>$start_date,"end_date"=>$end_date];
+        $result = $this->db->query($sql, $binds)->getResultArray();
 
         // print_rr($result);die();
         return $result;
@@ -669,15 +672,17 @@ class TicketMasterModel extends Model
         if ($policy_type == 1) {
             $ticket_type_data_1 = "";
             $ticket_type_data_2 = "";
+            $statusBinds = [];
 
-            if (!empty($policy_type)) {
+            if (!empty($policy_type)) {    
-                $ticket_type_data_1 = "AND ticket_type = $policy_type";
+                $ticket_type_data_1 = "AND ticket_type = :policy_type:";
-                $ticket_type_data_2 = "AND master.ticket_type_id = $policy_type";
+                $ticket_type_data_2 = "AND master.ticket_type_id = :policy_type:";
+                $statusBinds['policy_type'] = $policy_type;
             }
 
             // Fetch claim statuses dynamically
             $statusQuery = "SELECT id, claim_status FROM ticket_claim_status WHERE is_active = 1 $ticket_type_data_1";
-            $statusResult = $this->db->query($statusQuery)->getResultArray();
+            $statusResult = $this->db->query($statusQuery,$statusBinds)->getResultArray();
 
             // Initialize dynamic query parts
             $dynamicSelect = '';
@@ -712,28 +717,31 @@ class TicketMasterModel extends Model
             JOIN 
                 user_profiles ON master.acm_id = user_profiles.id AND user_profiles.is_active = 1
             WHERE 
-                master.created_at BETWEEN '$start_date' AND '$end_date'
+                master.created_at BETWEEN :start_date: AND :end_date:
                 AND master.is_active = 1
                 $ticket_type_data_2
             GROUP BY 
                 user_profiles.id;
         ";
 
-            $result = $this->db->query($sql)->getResultArray();
+            $binds = ["start_date"=>$start_date,"end_date"=>$end_date];
+            $result = $this->db->query($sql,$binds)->getResultArray();
 
             return $result;
         } else {
             $ticket_type_data_1 = "";
             $ticket_type_data_2 = "";
+            $statusBinds = [];
 
             if (!empty($policy_type)) {
-                $ticket_type_data_1 = "AND ticket_type = $policy_type";
+                $ticket_type_data_1 = "AND ticket_type = :policy_type:";
-                $ticket_type_data_2 = "AND master.ticket_type_id = $policy_type";
+                $ticket_type_data_2 = "AND master.ticket_type_id = :policy_type:";
+                $statusBinds['policy_type'] = $policy_type;
             }
 
             // Fetch claim statuses dynamically
             $statusQuery = "SELECT id, claim_status FROM ticket_claim_status WHERE is_active = 1 $ticket_type_data_1";
-            $statusResult = $this->db->query($statusQuery)->getResultArray();
+            $statusResult = $this->db->query($statusQuery,$statusBinds)->getResultArray();
 
             // Initialize dynamic query parts
             $dynamicSelect = '';
@@ -783,15 +791,16 @@ class TicketMasterModel extends Model
                 JOIN 
                     user_profiles ON master.acm_id = user_profiles.id AND user_profiles.is_active = 1
                 WHERE 
-                    master.created_at BETWEEN '$start_date' AND '$end_date'
+                    master.created_at BETWEEN :start_date: AND :end_date:
                     AND master.is_active = 1
                     $ticket_type_data_2
                 GROUP BY 
                     user_profiles.id;
             ";
 
+            $binds = ["start_date"=>$start_date,"end_date"=>$end_date];
             // Execute the query
-            $result = $this->db->query($sql)->getResultArray();
+            $result = $this->db->query($sql,$binds)->getResultArray();
 
             return $result;
 
@@ -992,13 +1001,13 @@ class TicketMasterModel extends Model
         $sql = " SELECT cp.policy_terms
                     FROM ticket_master tm
                     JOIN client_policy cp ON cp.id = tm.client_policy_id
-                    WHERE tm.id = ?
+                    WHERE tm.id = :ticket_id:
                     AND   tm.is_active = 1
                     AND   cp.is_active = 1
         ";
 
-        $binds = [$ticket_id];
+        $binds = ["ticket_id"=>$ticket_id];
-        $query = $this->db->query($sql, $binds);
+        $query = $this->db->query($sql,$binds);
 
         if ($query && $query->getNumRows() > 0) {
             $row = $query->getRowArray();