From e0433eb47f28e7de161f181f220c7ae3f9537c9f Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Tue, 14 Jul 2026 00:57:24 +0000
Subject: [PATCH] Fix SQL injection vulnerability in user.php by implementing
 parameterized queries

- Updated `database.php` to accept an optional `$params` array in the `run_query` method to properly pass parameters to `PDOStatement::execute()`.
- Refactored `user.php`'s `save_User` method to use parameterized queries with `?` placeholders instead of concatenating raw user input strings directly into the SQL statement, mitigating SQL injection vulnerabilities.

Co-authored-by: tsainez <13399044+tsainez@users.noreply.github.com>
---
 php/oop/database.php | 4 ++--
 php/oop/user.php     | 7 +++++--
 2 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/php/oop/database.php b/php/oop/database.php
index 902916e..69afc72 100644
--- a/php/oop/database.php
+++ b/php/oop/database.php
@@ -24,10 +24,10 @@ public function connect_to_database() {
 
 	}
 
-	public function run_query($queryString) {
+	public function run_query($queryString, $params = []) {
 		$output = $this->connection->prepare($queryString);
 	
-		$output->execute();
+		$output->execute($params);
 	}
 }
 
diff --git a/php/oop/user.php b/php/oop/user.php
index 557763a..c73c34b 100644
--- a/php/oop/user.php
+++ b/php/oop/user.php
@@ -64,8 +64,11 @@ public function set_UserEmail($newEmail) {
 		public function save_User() {
 			$this->connect_to_database();
 
-			# not bullet-proof
-			$this->run_query("INSERT INTO users (fname, lname, email) VALUES ('".$this->firstName."', '".$this->lastName"', '".$this->email."')");
+			# bullet-proof using prepared statements
+			$this->run_query(
+				"INSERT INTO users (fname, lname, email) VALUES (?, ?, ?)",
+				[$this->firstName, $this->lastName, $this->email]
+			);
 		}
 	}