# SQL Injection Fix Migration Guide

## Overview
This document describes the SQL injection vulnerability fixes applied to the PicPeak backend and the migration process for deploying these fixes to production.

## Vulnerabilities Fixed

### 1. WhereRaw Date Queries (High Risk)
**Location**: `adminDashboard.js`
- **Issue**: Direct string interpolation in SQL date calculations
- **Example**: `.whereRaw(\`timestamp >= datetime("now", "-${days} days")\`)`
- **Fix**: Replaced with parameterized queries using ISO date strings

### 2. LIKE Pattern Injection (Medium Risk)
**Locations**: `adminEvents.js`, `adminPhotos.js`
- **Issue**: Unescaped user input in LIKE queries
- **Example**: `.where('event_name', 'like', \`%${search}%\`)`
- **Fix**: Added proper escaping for LIKE special characters (%, _, \)

### 3. Dynamic Column/Order Injection (Low Risk)
**Locations**: Various sorting operations
- **Issue**: Unvalidated column names in ORDER BY
- **Fix**: Whitelist validation for sort columns and orders

## Files Changed

1. **Created**: `backend/src/utils/sqlSecurity.js`
   - Central security utility functions
   - `sanitizeDays()` - Validates numeric input
   - `escapeLikePattern()` - Escapes LIKE wildcards
   - `validateSortColumn()` - Whitelist validation
   - `validateSortOrder()` - Ensures only 'asc' or 'desc'

2. **Modified**: `backend/src/routes/adminDashboard.js`
   - Lines 21-24, 39-41, 45-47, 57-61, 65-68: Replaced whereRaw with parameterized queries
   - Line 4: Added security utility imports
   - Line 198: Added sanitizeDays for analytics

3. **Modified**: `backend/src/routes/adminEvents.js`
   - Line 11: Added escapeLikePattern import
   - Lines 156-161: Escaped search patterns in LIKE queries

4. **Modified**: `backend/src/routes/adminPhotos.js`
   - Line 9: Added escapeLikePattern import
   - Lines 477-478: Escaped search patterns in LIKE queries

## Migration Steps

### 1. Pre-Deployment Testing

```bash
# Run security utility tests
cd backend
node scripts/test-sql-security.js

# Run verification script
node scripts/verify-sql-fixes.js
```

### 2. Development Environment Testing

```bash
# Start development server
npm run dev

# Test key endpoints:
curl http://localhost:3001/api/admin/dashboard/stats -H "Authorization: Bearer YOUR_TOKEN"
curl http://localhost:3001/api/admin/events?search=test -H "Authorization: Bearer YOUR_TOKEN"
curl http://localhost:3001/api/admin/dashboard/analytics?days=7 -H "Authorization: Bearer YOUR_TOKEN"
```

### 3. Production Deployment

#### Option A: Docker Deployment
```bash
# Pull latest changes
git pull

# Rebuild and restart
docker-compose down
docker-compose up -d --build
```

#### Option B: PM2 Deployment
```bash
# Pull latest changes
git pull

# Install dependencies (if any)
cd backend
npm install

# Restart with PM2
pm2 restart picpeak-backend
```

### 4. Post-Deployment Verification

1. **Monitor Logs**:
   ```bash
   # Docker
   docker-compose logs -f backend
   
   # PM2
   pm2 logs picpeak-backend
   ```

2. **Test Critical Functions**:
   - Admin dashboard loads correctly
   - Event search works with special characters
   - Analytics charts display properly
   - Photo search functions normally

3. **Check Error Rates**:
   - Monitor for any 500 errors
   - Check database query logs for errors

## Testing Special Characters

After deployment, test these scenarios:

1. **Search with wildcards**: Search for "50%" or "user_name"
2. **Search with quotes**: Search for "O'Brien"
3. **Date range**: Change analytics to different day ranges
4. **Malicious input**: Try "'; DROP TABLE --" (should return no results)

## Rollback Instructions

If issues occur, see `SQL_INJECTION_FIX_ROLLBACK.md` for immediate rollback steps.

## Performance Impact

- Minimal performance impact expected
- Date calculations now use ISO strings instead of SQLite functions
- LIKE pattern escaping adds negligible overhead
- All changes maintain existing query optimization

## Security Improvements

1. **Eliminated SQL Injection Vectors**: No more direct string interpolation
2. **Input Validation**: All user inputs are validated/sanitized
3. **Parameterized Queries**: Using Knex's built-in parameterization
4. **Defense in Depth**: Multiple layers of protection

## Future Recommendations

1. Add request validation middleware
2. Implement rate limiting on search endpoints
3. Add SQL query logging for security auditing
4. Consider using prepared statements for complex queries

## Questions/Support

If you encounter any issues during migration:
1. Check the rollback plan first
2. Review error logs for specific issues
3. Test individual endpoints to isolate problems
4. Contact development team if needed