Code vulnerable for SQL injections

Nobody has claimed this yet.

Hi,

I see a lot of lines like this function:
```php
public function getBatch ( $id ) {
$id *= 1 ;
$ret = array('commands'=>array()) ;
$db = $this->getDB() ;
$sql = "SELECT * FROM command WHERE batch_id=$id" ;
if(!$result = $db->query($sql)) return $this->setErrorMessage ( 'There was an error running the query [' . $db->error . ']'."\n$sql" ) ;
while ( $o = $result->fetch_object() ) {
$j = json_decode ( $o->json ) ;
$j->_meta = $o ;
unset ( $j->_meta->json ) ;
$ret['commands'][$o->num] = $j ;
}
return $ret ;
}
```

If one would simply set $id to `0;DROP TABLE COMMAND;`, the command table will be gone. Easy as that.. Please, for the love of god; use SQL prepared statements. See: https://www.w3schools.com/php/php_mysql_prepared_statements.asp

The report points to getBatch($id) and shows a raw SQL query; start by locating that function and reviewing the other similar query constructions. No file or test is named, so trace the affected call paths and verify that injected input is treated as data; done means the reported queries no longer allow SQL injection.

Written by the indexing model from the issue text.