FIXSEC_ISSUE_SQL_INJECT

app/Controllers/ClientController.php

@@ -142,24 +142,38 @@ class ClientController extends AdminController
         return $this->response->setJSON(['isDuplicate' => $isDuplicate]);
     }
 
+    private const ALLOWED_DUPLICATE_CHECK_TABLES = [
+        'clients', 'client_branch', 'level_contacts', 'insurers', 'insurer_branch',
+        'tpa', 'tpa_branch', 'policies', 'client_policy', 'user_profiles',
+    ];
+
     public function checkDuplicateTableFieldValue()
     {
         $table = $this->request->getPost('table');
         $field = $this->request->getPost('field');
         $value = $this->request->getPost('value');
 
-        // Load the database if not already loaded
+        if (!in_array($table, self::ALLOWED_DUPLICATE_CHECK_TABLES, true)) {
-        $db = db_connect();
+            return $this->response->setJSON(['isDuplicate' => false, 'error' => 'Invalid table']);
+        }
+
+        $db = db_connect();
+        $tableFields = $db->getFieldNames($table);
 
-        // Perform the query
         $builder = $db->table($table);
         if (is_array($value)) {
-            $isDuplicate = $builder->where($value)->where('is_active', 1)->countAllResults() > 0;
+            $filteredValue = array_intersect_key($value, array_flip($tableFields));
+            if (empty($filteredValue)) {
+                return $this->response->setJSON(['isDuplicate' => false, 'error' => 'Invalid fields']);
+            }
+            $isDuplicate = $builder->where($filteredValue)->where('is_active', 1)->countAllResults() > 0;
         } else {
+            if (!in_array($field, $tableFields, true)) {
+                return $this->response->setJSON(['isDuplicate' => false, 'error' => 'Invalid field']);
+            }
             $isDuplicate = $builder->where($field, $value)->where('is_active', 1)->countAllResults() > 0;
         }
 
-        // Return the result
         return $this->response->setJSON(['isDuplicate' => $isDuplicate]);
     }
 

app/Controllers/EmpDataServiceController.php

@@ -4360,13 +4360,15 @@ class EmpDataServiceController extends BaseController
             {
                 $client_policy_id = $arrayData['client_policy_id'];
                 $cd_ac_pk = $this->clientPolicyModel->select('cd_ac_pk')->where('id',$client_policy_id)->first();
+                $sanitizedIds = array_map('intval', $arrayData['employeeIds']);
+                $placeholders = implode(',', array_fill(0, count($sanitizedIds), '?'));
                 $amount = $this->employeePolicyModel->query("
                         SELECT SUM(rata_premimum + gst) AS total_sum
                         FROM employee_polices
                         JOIN employees ON employees.id = employee_polices.employee_id
-                        WHERE employees.unit = '$unit'
+                        WHERE employees.unit = ?
-                        AND employee_polices.id IN (" . implode(',', $arrayData['employeeIds']) . ")
+                        AND employee_polices.id IN ($placeholders)
-                    ")->getRow();
+                    ", array_merge([$unit], $sanitizedIds))->getRow();
 
                 if($amount){      
 
@@ -4625,11 +4627,14 @@ class EmpDataServiceController extends BaseController
                 //         AND employee_polices.id IN (" . implode(',', $arrayData['employeeIds']) . ")
                 //     ")->getRow();
 
+                $sanitizedIds = array_map('intval', $arrayData['employeeIds']);
+                $placeholders = implode(',', array_fill(0, count($sanitizedIds), '?'));
+                $safeAddOneDay = (int)$add_one_day;
                 $amount = $this->employeePolicyModel->query("
                     SELECT 
                         SUM(ROUND(
-                            ((employee_polices.rata_premimum * (DATEDIFF(employee_polices.policy_end_date, emp_endorsement.new_value) + '$add_one_day')) / 365) + 
+                            ((employee_polices.rata_premimum * (DATEDIFF(employee_polices.policy_end_date, emp_endorsement.new_value) + ?)) / 365) + 
-                            (((employee_polices.rata_premimum * (DATEDIFF(employee_polices.policy_end_date, emp_endorsement.new_value) + '$add_one_day')) / 365) * 0.18), 
+                            (((employee_polices.rata_premimum * (DATEDIFF(employee_polices.policy_end_date, emp_endorsement.new_value) + ?)) / 365) * 0.18), 
                             2
                         )) AS total_sum
                     FROM 
@@ -4639,14 +4644,14 @@ class EmpDataServiceController extends BaseController
                     JOIN 
                         emp_endorsement ON emp_endorsement.pk = employee_polices.id
                     WHERE 
-                        employee_polices.id IN (" . implode(',', $arrayData['employeeIds']) . ")
+                        employee_polices.id IN ($placeholders)
-                        AND emp_endorsement.pk IN (" . implode(',', $arrayData['employeeIds']) . ")
+                        AND emp_endorsement.pk IN ($placeholders)
                         AND employee_polices.claim_status = 0
                         AND emp_endorsement.field_name = 'date_of_exit'
                         AND emp_endorsement.is_active = 1
                         AND emp_endorsement.actions = 'd'
-                        AND emp_endorsement.status != 'truncated';
+                        AND emp_endorsement.status != 'truncated'
-                ")->getRow();
+                ", array_merge([$safeAddOneDay, $safeAddOneDay], $sanitizedIds, $sanitizedIds))->getRow();
 
                 //  dd(db_connect()->getLastQuery(), $amount);
 

app/Helpers/excel_import_export_helper.php

@@ -766,18 +766,18 @@ if(!function_exists('query_construct_for_emp_policy_id')){
                 $gst_alise = '';
             }
             $subQuery .= "SELECT " . intval($index) . $row_id_alise;
-            $subQuery .= "'" . $employee[$col_index['emp_name']] . "'" . $emp_name_alise;
+            $subQuery .= $db->escape($employee[$col_index['emp_name']]) . $emp_name_alise;
-            $subQuery .= "'" . $employee[$col_index['emp_code']] . "'" . $emp_code_alise;
+            $subQuery .= $db->escape($employee[$col_index['emp_code']]) . $emp_code_alise;
-            $subQuery .= "'" . $employee[$col_index['emp_dob']] . "'" . $emp_dob_alise;
+            $subQuery .= $db->escape($employee[$col_index['emp_dob']]) . $emp_dob_alise;
-            $subQuery .= "'" . $employee[$col_index['emp_gender']] . "'" . $emp_gender_alise;
+            $subQuery .= $db->escape($employee[$col_index['emp_gender']]) . $emp_gender_alise;
-            $subQuery .= "'" . $employee[$col_index['pre_existing_alignments']] . "'" . $pre_existing_alignments_alise;
+            $subQuery .= $db->escape($employee[$col_index['pre_existing_alignments']]) . $pre_existing_alignments_alise;
-            $subQuery .= "'" . $employee[$col_index['basic_cover_si']] . "'" . $basic_cover_si_alise;
+            $subQuery .= $db->escape($employee[$col_index['basic_cover_si']]) . $basic_cover_si_alise;
-            $subQuery .= "'" . $employee[$col_index['emp_relationship']] . "'" . $emp_relationship_alise;
+            $subQuery .= $db->escape($employee[$col_index['emp_relationship']]) . $emp_relationship_alise;
-            $subQuery .= "'" . $employee[$col_index['policy_end_date']] . "'" . $policy_end_date_alise;
+            $subQuery .= $db->escape($employee[$col_index['policy_end_date']]) . $policy_end_date_alise;
-            $subQuery .= "'" . $employee[$col_index['days']] . "'" . $days_alise;
+            $subQuery .= $db->escape($employee[$col_index['days']]) . $days_alise;
-            $subQuery .= "'" . $employee[$col_index['premium']] . "'" . $premium_alise;
+            $subQuery .= $db->escape($employee[$col_index['premium']]) . $premium_alise;
-            $subQuery .= "'" . $employee[$col_index['rata_premimum']] . "'" . $rata_premimum_alise;
+            $subQuery .= $db->escape($employee[$col_index['rata_premimum']]) . $rata_premimum_alise;
-            $subQuery .= "'" . $employee[$col_index['gst']] . "'" . $gst_alise;
+            $subQuery .= $db->escape($employee[$col_index['gst']]) . $gst_alise;
         }
 
         // Complete the query
@@ -893,18 +893,18 @@ if(!function_exists('query_construct_second_stage')){
                 $gst_alise = '';
             }
             $subQuery .= "SELECT " . intval($index) . $row_id_alise;
-            $subQuery .= "'" . $employee[$col_index['emp_name']] . "'" . $emp_name_alise;
+            $subQuery .= $db->escape($employee[$col_index['emp_name']]) . $emp_name_alise;
-            $subQuery .= "'" . $employee[$col_index['emp_code']] . "'" . $emp_code_alise;
+            $subQuery .= $db->escape($employee[$col_index['emp_code']]) . $emp_code_alise;
-            $subQuery .= "'" . $employee[$col_index['emp_dob']] . "'" . $emp_dob_alise;
+            $subQuery .= $db->escape($employee[$col_index['emp_dob']]) . $emp_dob_alise;
-            $subQuery .= "'" . $employee[$col_index['emp_gender']] . "'" . $emp_gender_alise;
+            $subQuery .= $db->escape($employee[$col_index['emp_gender']]) . $emp_gender_alise;
-            $subQuery .= "'" . $employee[$col_index['pre_existing_alignments']] . "'" . $pre_existing_alignments_alise;
+            $subQuery .= $db->escape($employee[$col_index['pre_existing_alignments']]) . $pre_existing_alignments_alise;
-            $subQuery .= "'" . $employee[$col_index['basic_cover_si']] . "'" . $basic_cover_si_alise;
+            $subQuery .= $db->escape($employee[$col_index['basic_cover_si']]) . $basic_cover_si_alise;
-            $subQuery .= "'" . $employee[$col_index['emp_relationship']] . "'" . $emp_relationship_alise;
+            $subQuery .= $db->escape($employee[$col_index['emp_relationship']]) . $emp_relationship_alise;
-            $subQuery .= "'" . $employee[$col_index['policy_end_date']] . "'" . $policy_end_date_alise;
+            $subQuery .= $db->escape($employee[$col_index['policy_end_date']]) . $policy_end_date_alise;
-            $subQuery .= "'" . $employee[$col_index['days']] . "'" . $days_alise;
+            $subQuery .= $db->escape($employee[$col_index['days']]) . $days_alise;
-            $subQuery .= "'" . $employee[$col_index['premium']] . "'" . $premium_alise;
+            $subQuery .= $db->escape($employee[$col_index['premium']]) . $premium_alise;
-            $subQuery .= "'" . $employee[$col_index['rata_premimum']] . "'" . $rata_premimum_alise;
+            $subQuery .= $db->escape($employee[$col_index['rata_premimum']]) . $rata_premimum_alise;
-            $subQuery .= "'" . $employee[$col_index['gst']] . "'" . $gst_alise;
+            $subQuery .= $db->escape($employee[$col_index['gst']]) . $gst_alise;
         }
 
         // Complete the query

app/Libraries/DataServiceSqlite.php

@@ -65,12 +65,23 @@ class DataServiceSqlite
         $this->sqliteDb->exec($sql);
     }
 
+    private const ALLOWED_TABLES = ['http', 'log'];
+
     public function insertData(array $data, string $tableName): bool
     {
         log_message('error', 'SQLite insert called: ');
+
+        if (!in_array($tableName, self::ALLOWED_TABLES, true)) {
+            log_message('error', 'SQLite insert rejected: invalid table name: ' . $tableName);
+            return false;
+        }
+
         unset($data['context']);
-        $columns = implode(', ', array_keys($data));
+
-        // print_r($columns);
+        $safeColumns = array_map(function ($col) {
+            return preg_replace('/[^a-zA-Z0-9_]/', '', $col);
+        }, array_keys($data));
+        $columns = implode(', ', $safeColumns);
         $placeholders = implode(', ', array_fill(0, count($data), '?'));
 
         $sql = "INSERT INTO $tableName ($columns) VALUES ($placeholders)";

app/Models/ClientModel.php

@@ -228,8 +228,14 @@ class ClientModel extends Model
         return $result;
     }
 
+    private const ALLOWED_CONTACT_FIELDS = ['email', 'mobile', 'phone', 'name', 'contact_name', 'contact_email', 'contact_mobile'];
+
     public function isDuplicateByClientBranch($value, $field, $clientId, $branchId)
     {
+        if (!in_array($field, self::ALLOWED_CONTACT_FIELDS, true)) {
+            throw new \InvalidArgumentException("Invalid field name: {$field}");
+        }
+
         $builder = $this->db->table('level_contacts lc')
             ->select('lc.id')
             ->join('client_branch cb', 'lc.ref_id = cb.id', 'left')

app/Models/EmployeePolicyModel.php

@@ -1146,6 +1146,8 @@ class EmployeePolicyModel extends Model
 
             $endorsement_condition = "{$insurer_or_tpa}" === 'tpa' ? "AND (a.endorsement_id IS NULL OR a.endorsement_id = '')" : "AND (a.endorsement_id IS NULL OR a.endorsement_id = '')";
 
+            $add_one_day = (int)$add_one_day;
+
             $query = $this->db->query("
             SELECT DISTINCT
                 a.id as endorsement_primarykey,
@@ -1688,30 +1690,29 @@ class EmployeePolicyModel extends Model
     public function bulkUpdate($emp_details)
     {
         // Extract IDs, tpa_ids, and uhids
-        $ids = array_column($emp_details, 'id');
+        $ids = array_map('intval', array_column($emp_details, 'id'));
         $tpa_ids = array_column($emp_details, 'tpa_id');
         $uhids = array_column($emp_details, 'uhid');
 
-        // Escape values for SQL
+        // Escape string values for SQL
-        $escapedIds = array_map([$this->db, 'escape'], $ids);
         $escapedTpaIds = array_map([$this->db, 'escape'], $tpa_ids);
         $escapedUhids = array_map([$this->db, 'escape'], $uhids);
 
-        // Construct the CASE statements
+        // Construct the CASE statements with int-cast IDs
         $caseTpaId = array_map(function($id, $tpa_id) {
-            return "WHEN id = $id THEN $tpa_id";
+            return "WHEN id = {$id} THEN {$tpa_id}";
-        }, $escapedIds, $escapedTpaIds);
+        }, $ids, $escapedTpaIds);
 
         $caseUhid = array_map(function($id, $uhid) {
-            return "WHEN id = $id THEN $uhid";
+            return "WHEN id = {$id} THEN {$uhid}";
-        }, $escapedIds, $escapedUhids);
+        }, $ids, $escapedUhids);
 
         // Convert cases to a string
         $caseTpaIdString = implode(' ', $caseTpaId);
         $caseUhidString = implode(' ', $caseUhid);
 
         // Convert ids to a string
-        $idsString = implode(', ', $escapedIds);
+        $idsString = implode(', ', $ids);
 
         // Construct the SQL query
         $sql = "
@@ -1837,18 +1838,19 @@ class EmployeePolicyModel extends Model
         $groupKeys = [];
     
         foreach ($endorsement_details as $row) {
-            $groupKey = $this->db->escape($row['group_key']);
+            $groupKey = (int)$row['group_key'];
             $endorsementId = $this->db->escape($row['endorsement_id']);
             $caseParts[] = "WHEN group_key = {$groupKey} THEN {$endorsementId}";
             $groupKeys[] = $groupKey;
         }
     
+        $groupKeysStr = implode(', ', $groupKeys);
         $sql = "
             UPDATE emp_endorsement
             SET 
                 endorsement_id = CASE " . implode(' ', $caseParts) . " END,
                 status = 'complete'
-            WHERE group_key IN (" . implode(', ', $groupKeys) . ")
+            WHERE group_key IN ({$groupKeysStr})
         ";
     
         $this->db->query($sql);
@@ -1866,26 +1868,37 @@ class EmployeePolicyModel extends Model
 
     public function bulkUpdateForCorrection($emp_details){
 
+        $ids = [];
+        $caseStatements = [];
+
+        $employeeTableFields = $this->db->getFieldNames('employees');
+
         foreach ($emp_details as $employee) {
-            $id = $this->db->escape($employee['id']);
+            $id = (int)$employee['id'];
             $ids[] = $id;
         
             foreach ($employee as $field => $value) {
                 if ($field === 'id') continue;
-                $escapedValue = $this->db->escape($value);
 
-                if (!isset($caseStatements[$field])) {
+                $safeField = preg_replace('/[^a-zA-Z0-9_]/', '', $field);
-                    $caseStatements[$field] = [];
+                if (!in_array($safeField, $employeeTableFields, true)) {
+                    continue;
                 }
 
-                $caseStatements[$field][] = "WHEN id = $id THEN $escapedValue";
+                $escapedValue = $this->db->escape($value);
+        
+                if (!isset($caseStatements[$safeField])) {
+                    $caseStatements[$safeField] = [];
+                }
+        
+                $caseStatements[$safeField][] = "WHEN id = {$id} THEN {$escapedValue}";
             }
         }
         
         // Construct the CASE strings
         $caseStrings = [];
         foreach ($caseStatements as $field => $cases) {
-            $caseStrings[] = "$field = CASE " . implode(' ', $cases) . " END";
+            $caseStrings[] = "{$field} = CASE " . implode(' ', $cases) . " END";
         }
         
         // Convert ids to a string
@@ -1941,7 +1954,7 @@ class EmployeePolicyModel extends Model
             ->getRowArray();
 
         // Determine if one day should be added for deletion
-        $add_one_day = (!empty($result) && $result['deletion_add_day'] == 1) ? 1 : 0;
+        $add_one_day = (int)((!empty($result) && $result['deletion_add_day'] == 1) ? 1 : 0);
 
 
         $query = $this->db->query("
@@ -2130,14 +2143,17 @@ class EmployeePolicyModel extends Model
         $caseEndorsementId = "CASE ";
         $ids = [];
         foreach ($array as $item) {
-            $caseStatus .= "WHEN id = {$item['id']} THEN '{$item['status']}' ";
+            $safeId = (int)$item['id'];
-            $caseEndorsementId .= "WHEN id = {$item['id']} THEN '{$item['endorsement_id']}' ";
+            $safeStatus = $this->db->escape($item['status']);
-            $ids[] = $item['id'];
+            $safeEndorsementId = $this->db->escape($item['endorsement_id']);
+            $caseStatus .= "WHEN id = {$safeId} THEN {$safeStatus} ";
+            $caseEndorsementId .= "WHEN id = {$safeId} THEN {$safeEndorsementId} ";
+            $ids[] = $safeId;
         }
         $caseStatus .= "END";
         $caseEndorsementId .= "END";
         $ids = implode(',', $ids);
-        $query = "UPDATE emp_endorsement SET status = $caseStatus, endorsement_id = $caseEndorsementId WHERE id IN ($ids);"; // Execute the query 
+        $query = "UPDATE emp_endorsement SET status = $caseStatus, endorsement_id = $caseEndorsementId WHERE id IN ($ids);";
         $this->db->query($query);
     }
 

app/Models/PolicyTransactionModel.php

@@ -127,6 +127,22 @@
             return $data;
         }
 
+        private const ALLOWED_DATE_TYPES = [
+            'policy_issue_date',
+            'policy_start_date',
+            'policy_end_date',
+            'created_at',
+            'updated_at',
+        ];
+
+        private function validateDateType($date_type)
+        {
+            if (!in_array($date_type, self::ALLOWED_DATE_TYPES, true)) {
+                throw new \InvalidArgumentException("Invalid date_type: {$date_type}");
+            }
+            return $date_type;
+        }
+
         // BDS Report OLD Functin for QUERY
         // public function getBDSReportList($client_id, $policy_id, $branch_id, $issuer)
         public function getBDSReportListOld($start_date = 0, $end_date = 0, $client_id = 0, $insurer_id = 0, $policy_type_id = 0, $date_type = 0, $issuer = 0)
@@ -282,6 +298,7 @@
             // Check if the start date and end date are provided
             if ($start_date != 0 && $end_date != 0 && $date_type != 0) {
 
+                $this->validateDateType($date_type);
                 $startDate = date('Y-m-d 00:00:00', strtotime($start_date));
                 $endDate = date('Y-m-d 23:59:59', strtotime($end_date));
 
@@ -835,12 +852,10 @@
             // Check if the start date and end date are provided
             if ($start_date != 0 && $end_date != 0 && $date_type != 0 && $date_type != 'statement_month') {
 
+                $this->validateDateType($date_type);
                 $startDate = date('Y-m-d 00:00:00', strtotime($start_date));
                 $endDate = date('Y-m-d 23:59:59', strtotime($end_date));
 
-                // $builder->where('policy_transaction.' . $date_type . '>=', $startDate)
-                //     ->where('policy_transaction.' . $date_type . '<=', $endDate);
-
                 if($date_type == "policy_issue_date"){
                     $builder->where("pt_co_share_details.pt_policy_issue_date >=", $startDate)
                         ->where("pt_co_share_details.pt_policy_issue_date <=", $endDate);
@@ -1064,6 +1079,7 @@
             // Optimize Date Filtering
             if (!empty($start_date) && !empty($end_date) && !empty($date_type)) {
 
+                $this->validateDateType($date_type);
                 $startDate = change_date_format($start_date, 'd/m/Y', 'Y-m-d 00:00:00');
                 $endDate = change_date_format($end_date, 'd/m/Y', 'Y-m-d 23:59:59');
 
@@ -1165,6 +1181,7 @@
 
             if ($start_date != 0 && $end_date != 0 && $date_type != 0) {
 
+                $this->validateDateType($date_type);
                 $startDate = change_date_format($start_date, 'd/m/Y', 'Y-m-d 00:00:00');
                 $endDate = change_date_format($end_date, 'd/m/Y', 'Y-m-d 23:59:59');
 
@@ -1349,12 +1366,10 @@
 
             if ($start_date != 0 && $end_date != 0 && $date_type != 0) {
 
+                $this->validateDateType($date_type);
                 $startDate = date('Y-m-d 00:00:00', strtotime($start_date));
                 $endDate = date('Y-m-d 23:59:59', strtotime($end_date));
 
-                // $builder->where('policy_transaction.' . $date_type . '>=', $startDate)
-                //     ->where('policy_transaction.' . $date_type . '<=', $endDate);
-
                 if($date_type == "policy_issue_date"){
                     $builder->where("pt_co_share_details.pt_policy_issue_date >=", $startDate)
                         ->where("pt_co_share_details.pt_policy_issue_date <=", $endDate);
@@ -1463,12 +1478,10 @@
 
             if ($start_date != 0 && $end_date != 0 && $date_type != 0) {
 
+                $this->validateDateType($date_type);
                 $startDate = date('Y-m-d 00:00:00', strtotime($start_date));
                 $endDate = date('Y-m-d 23:59:59', strtotime($end_date));
 
-                // $builder->where('policy_transaction.' . $date_type . '>=', $startDate)
-                //     ->where('policy_transaction.' . $date_type . '<=', $endDate);
-
                 if($date_type == "policy_issue_date"){
                     $builder->where("pt_co_share_details.pt_policy_issue_date >=", $startDate)
                         ->where("pt_co_share_details.pt_policy_issue_date <=", $endDate);
@@ -1574,12 +1587,10 @@
 
             if ($start_date != 0 && $end_date != 0 && $date_type != 0) {
 
+                $this->validateDateType($date_type);
                 $startDate = date('Y-m-d 00:00:00', strtotime($start_date));
                 $endDate = date('Y-m-d 23:59:59', strtotime($end_date));
 
-                // $builder->where('policy_transaction.' . $date_type . '>=', $startDate)
-                //     ->where('policy_transaction.' . $date_type . '<=', $endDate);
-
                 if($date_type == "policy_issue_date"){
                     $builder->where("pt_co_share_details.pt_policy_issue_date >=", $startDate)
                         ->where("pt_co_share_details.pt_policy_issue_date <=", $endDate);
@@ -1689,12 +1700,10 @@
 
             // Date range filtering
             if ($start_date != 0 && $end_date != 0 && $date_type != 0) {
+                $this->validateDateType($date_type);
                 $startDate = date('Y-m-d 00:00:00', strtotime($start_date));
                 $endDate = date('Y-m-d 23:59:59', strtotime($end_date));
 
-                // $builder->where('policy_transaction.' . $date_type . '>=', $startDate)
-                //     ->where('policy_transaction.' . $date_type . '<=', $endDate);
-
                 if($date_type == "policy_issue_date"){
                     $builder->where("pt_co_share_details.pt_policy_issue_date >=", $startDate)
                         ->where("pt_co_share_details.pt_policy_issue_date <=", $endDate);
@@ -2364,6 +2373,7 @@
             }
 
             if ($start_date != 0 && $end_date != 0 && $date_type != 0 && $date_type != 'statement_month') {
+                $this->validateDateType($date_type);
                 $startDate = date('Y-m-d 00:00:00', strtotime($start_date));
                 $endDate   = date('Y-m-d 23:59:59', strtotime($end_date));
 
@@ -2489,6 +2499,7 @@
             // 3. Date condition (except statement_month)
             if ($start_date != 0 && $end_date != 0 && $date_type != 0 && $date_type != 'statement_month') {
 
+                $this->validateDateType($date_type);
                 $startDate = date('Y-m-d 00:00:00', strtotime($start_date));
                 $endDate   = date('Y-m-d 23:59:59', strtotime($end_date));
 
@@ -3080,6 +3091,7 @@
             // 3. Date condition (except statement_month)
             if ($start_date != 0 && $end_date != 0 && $date_type != 0 && $date_type != 'statement_month') {
 
+                $this->validateDateType($date_type);
                 $startDate = date('Y-m-d 00:00:00', strtotime($start_date));
                 $endDate   = date('Y-m-d 23:59:59', strtotime($end_date));
 

app/Models/TicketMasterModel.php

@@ -1,5 +1,4 @@
 <?php
-
 namespace App\Models;
 
 use CodeIgniter\Model;
@@ -98,7 +97,6 @@ class TicketMasterModel extends Model
 
     ];
 
-
     // Callbacks
     protected $allowCallbacks = true;
     protected $beforeInsert   = ["checkAndADDCreatedByValue"];
@@ -273,7 +271,6 @@ class TicketMasterModel extends Model
     //     $dynamicSelect = rtrim($dynamicSelect, ', ');
     //     // dd($dynamicSelect);
 
-
     //     // Construct the full SQL query
     //     $sql = "
     //         SELECT
@@ -422,7 +419,6 @@ class TicketMasterModel extends Model
     //     $dynamicSelect = rtrim($dynamicSelect, ', ');
     //     // dd($dynamicSelect);
 
-
     //     // Construct the full SQL query
     //     $sql = "
     //     SELECT
@@ -517,7 +513,7 @@ class TicketMasterModel extends Model
             'Above 20 Days',
             '13-20 Days',
             '7-12 Days',
-            '0-6 Days'
+            '0-6 Days',
         ];
 
         // Initialize the result array with all TAT categories
@@ -561,7 +557,7 @@ class TicketMasterModel extends Model
                     )) BETWEEN 13 AND 20 THEN "13-20 Days"
                     ELSE "Above 20 Days"
                 END AS tat_category',
-                'COUNT(*) AS count'
+                'COUNT(*) AS count',
             ])
             ->join('ticket_claim_status tcs', 'tcs.id = tm.claim_status_id AND tcs.is_active = 1')
             ->where('tm.is_active', 1)
@@ -624,7 +620,7 @@ class TicketMasterModel extends Model
                 'UNDER PROCESS - INVESTIGATION STATUS',
                 'UNDER PROCESS - QUERY DOCUMENT RECEIVED',
                 'APPROVED',
-                'PAYMENT INITIATED'
+                'PAYMENT INITIATED',
             ])) {
                 $dynamicTotal .= "COUNT(CASE WHEN master.claim_status_id = {$status['id']} THEN master.id END) + ";
             }
@@ -701,7 +697,6 @@ class TicketMasterModel extends Model
                 $dynamicSelect .= "
                 COUNT(CASE WHEN master.claim_status_id = {$status['id']} THEN master.id END) AS `{$status['claim_status']}`, ";
 
-
                 // Include in total count
                 $dynamicTotal .= "COUNT(CASE WHEN master.claim_status_id = {$status['id']} THEN master.id END) + ";
 
@@ -773,7 +768,7 @@ class TicketMasterModel extends Model
                     'INSURER PENDING',
                     'INVESTIGATION',
                     'APPROVED',
-                    'ON HOLD'
+                    'ON HOLD',
                 ])) {
                     $dynamicTotal .= "COUNT(CASE WHEN master.claim_status_id = {$status['id']} THEN master.id END) + ";
                 }
@@ -822,7 +817,6 @@ class TicketMasterModel extends Model
             //  print_rr($this->db->lastQuery);die();
             return $result;
 
-
         }
     }
 
@@ -923,7 +917,6 @@ class TicketMasterModel extends Model
 
                         $total++;
 
-                        
                     }
                 }
 
@@ -1010,7 +1003,7 @@ class TicketMasterModel extends Model
         // Return the count and comma-separated ticket IDs
         return [
             'count'      => count($ticketIds),
-            'ticket_ids' => $ticketIdsString
+            'ticket_ids' => $ticketIdsString,
         ];
     }
 
@@ -1044,7 +1037,6 @@ class TicketMasterModel extends Model
         $tpa_short_name     = $params['tpa_short_name'] ?? null;
         $policy_no          = $params['policy_no'] ?? null;
 
-
         $builder = $this->db->table('client_policy');
         $builder->select('client_policy.*');
         $builder->join('clients c', 'client_policy.client_id = c.id');
@@ -1124,7 +1116,6 @@ class TicketMasterModel extends Model
         // $emp_name     = "Lokesh";
         // $policy_no    = "GMC-1999/2000/2021/2022";
 
-
         $builder = $this->db->table('employees e');
         $builder->select("
             e.id as emp_id,