# SQL Injection Fix Rollback Plan

## Overview
This document provides a rollback plan in case the SQL injection fixes cause issues in production.

## Changes Made
1. **Created**: `backend/src/utils/sqlSecurity.js` - Central security utilities
2. **Modified**: `backend/src/routes/adminDashboard.js` - Replaced whereRaw with parameterized queries
3. **Modified**: `backend/src/routes/adminPhotos.js` - Added LIKE pattern escaping
4. **Modified**: `backend/src/routes/adminEvents.js` - Added LIKE pattern escaping

## Quick Rollback Steps

### Step 1: Revert Code Changes
If issues occur, run these commands to revert:

```bash
# Navigate to backend directory
cd backend

# Revert specific files
git checkout HEAD -- src/routes/adminDashboard.js
git checkout HEAD -- src/routes/adminPhotos.js
git checkout HEAD -- src/routes/adminEvents.js

# Remove the new security utility file
rm src/utils/sqlSecurity.js
```

### Step 2: Restart Services
```bash
# If using Docker
docker-compose restart backend

# If using PM2
pm2 restart picpeak-backend
```

## Verification After Rollback

1. Check admin dashboard loads: `/admin/dashboard`
2. Test event search functionality
3. Test photo search functionality
4. Verify analytics charts display correctly

## Symptoms That May Require Rollback

1. **Dashboard Statistics Not Loading**
   - Empty or NaN values in stats
   - Analytics charts not rendering

2. **Search Features Broken**
   - Event search returns no results
   - Photo search returns errors
   - Special characters in search causing issues

3. **Date Filtering Issues**
   - Activity logs not showing correct date ranges
   - Analytics showing incorrect time periods

## Safe Testing Before Production

1. **Test in Development First**:
   ```bash
   cd backend
   npm run dev
   ```

2. **Test Key Features**:
   - Admin dashboard stats: `http://localhost:3001/api/admin/dashboard/stats`
   - Analytics: `http://localhost:3001/api/admin/dashboard/analytics?days=7`
   - Event search: `http://localhost:3001/api/admin/events?search=test`
   - Photo search: `http://localhost:3001/api/admin/events/1/photos?search=test`

3. **Monitor Logs**:
   ```bash
   # Docker logs
   docker-compose logs -f backend

   # PM2 logs
   pm2 logs picpeak-backend
   ```

## Emergency Contacts
- Keep database backups before deploying
- Have monitoring alerts for 500 errors
- Document any custom SQL queries in use

## Post-Rollback Actions
If rollback is needed:
1. Document the specific issue encountered
2. Create test cases for the failure scenario
3. Fix the issue in development
4. Re-test thoroughly before re-deploying