From 61d63808619f76dc70795cd514d3c90433e303f5 Mon Sep 17 00:00:00 2001
From: Hamza-Ayed <hamzaayedflutter@gmail.com>
Date: Sat, 25 Jul 2026 17:57:52 +0300
Subject: [PATCH] Fix SQL injection and stale status matching in the wallet
 endpoints
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The three endpoints the driver app calls for its wallet built their queries by
interpolating the driver id straight into SQL. Anything the app sent went into
the statement, and these run against the payments database.

They also matched only status = 'Finished'. The current ride pipeline writes
'completed', so a driver's completed rides, pending payouts and weekly
earnings all read as zero regardless of how much they had driven — which is
what the wallet errors in the admin error log are sitting next to.

getAllPayment.php, driverStatistic.php and getCountRide.php now bind the id
and match either spelling. Verified no interpolated identifier remains and
every rewritten condition is balanced.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 .../ride/driverWallet/driverStatistic.php     | 92 ++++++++++---------
 .../v2/main/ride/payment/getAllPayment.php    | 20 ++--
 .../v2/main/ride/payment/getCountRide.php     | 58 ++++++------
 3 files changed, 90 insertions(+), 80 deletions(-)

diff --git a/payment_server/v2/main/ride/driverWallet/driverStatistic.php b/payment_server/v2/main/ride/driverWallet/driverStatistic.php
index 3ed653cc..9b08ca4b 100644
--- a/payment_server/v2/main/ride/driverWallet/driverStatistic.php
+++ b/payment_server/v2/main/ride/driverWallet/driverStatistic.php
@@ -1,46 +1,48 @@
-<?php
-include "../../connect.php";
-$driverID = filterRequest("driverID");
-
-$sql = "SELECT
-    YEAR(`driver_orders`.`created_at`) AS `year`,
-    MONTH(`driver_orders`.`created_at`) AS `month`,
-    COUNT(*) AS `total_orders`,
-    SUM(CASE WHEN `ride`.`status` = 'Finished' THEN 1 ELSE 0 END) AS `completed_orders`,
-    SUM(CASE WHEN `ride`.`status` = 'Apply' THEN 1 ELSE 0 END) AS `pending_orders`,
-    SUM(CASE WHEN `ride`.`status` = 'Cancel' THEN 1 ELSE 0 END) AS `canceled_orders`,
-    ROUND(SUM(CASE WHEN `ride`.`status` = 'Finished' THEN 1 ELSE 0 END) / COUNT(*) * 100, 2) AS `percent_completed`,
-    ROUND(SUM(CASE WHEN `ride`.`status` = 'Apply' THEN 1 ELSE 0 END) / COUNT(*) * 100, 2) AS `percent_pending`,
-    ROUND(SUM(CASE WHEN `ride`.`status` = 'Cancel' THEN 1 ELSE 0 END) / COUNT(*) * 100, 2) AS `percent_canceled`,
-    SUM(CASE WHEN `ride`.`status` = 'Refused' THEN 1 ELSE 0 END) AS `rejected_orders`,
-    ROUND(SUM(CASE WHEN `ride`.`status` = 'Refused' THEN 1 ELSE 0 END) / COUNT(*) * 100, 2) AS `percent_rejected`
-FROM
-    `driver_orders`
-LEFT JOIN `ride` ON `ride`.`id` = `driver_orders`.`order_id`
-WHERE
-    `driver_orders`.`driver_id` = '$driverID'
-    AND YEAR(`driver_orders`.`created_at`) = YEAR(CURDATE())
-    AND MONTH(`driver_orders`.`created_at`) = MONTH(CURDATE())
-GROUP BY
-    YEAR(`driver_orders`.`created_at`),
-    MONTH(`driver_orders`.`created_at`)
-ORDER BY
-    `year`,
-    `month`;
-
-";
-$stmt = $con->prepare($sql);
-$stmt->execute();
-
-if ($stmt->rowCount() > 0) {
-    // Fetch the record
-    $row = $stmt->fetchAll(PDO::FETCH_ASSOC);
-
-    printSuccess( $row);
-    
-}
-    else{
-    // Print a failure message
-    printFailure($message = "No wallet record found");
-}
+<?php
+include "../../connect.php";
+$driverID = filterRequest("driverID");
+
+$sql = "SELECT
+    YEAR(`driver_orders`.`created_at`) AS `year`,
+    MONTH(`driver_orders`.`created_at`) AS `month`,
+    COUNT(*) AS `total_orders`,
+    SUM(CASE WHEN LOWER(`ride`.`status`) IN ('finished','completed') THEN 1 ELSE 0 END) AS `completed_orders`,
+    SUM(CASE WHEN `ride`.`status` = 'Apply' THEN 1 ELSE 0 END) AS `pending_orders`,
+    SUM(CASE WHEN `ride`.`status` = 'Cancel' THEN 1 ELSE 0 END) AS `canceled_orders`,
+    ROUND(SUM(CASE WHEN LOWER(`ride`.`status`) IN ('finished','completed') THEN 1 ELSE 0 END) / COUNT(*) * 100, 2) AS `percent_completed`,
+    ROUND(SUM(CASE WHEN `ride`.`status` = 'Apply' THEN 1 ELSE 0 END) / COUNT(*) * 100, 2) AS `percent_pending`,
+    ROUND(SUM(CASE WHEN `ride`.`status` = 'Cancel' THEN 1 ELSE 0 END) / COUNT(*) * 100, 2) AS `percent_canceled`,
+    SUM(CASE WHEN `ride`.`status` = 'Refused' THEN 1 ELSE 0 END) AS `rejected_orders`,
+    ROUND(SUM(CASE WHEN `ride`.`status` = 'Refused' THEN 1 ELSE 0 END) / COUNT(*) * 100, 2) AS `percent_rejected`
+FROM
+    `driver_orders`
+LEFT JOIN `ride` ON `ride`.`id` = `driver_orders`.`order_id`
+WHERE
+    `driver_orders`.`driver_id` = :driverID
+    AND YEAR(`driver_orders`.`created_at`) = YEAR(CURDATE())
+    AND MONTH(`driver_orders`.`created_at`) = MONTH(CURDATE())
+GROUP BY
+    YEAR(`driver_orders`.`created_at`),
+    MONTH(`driver_orders`.`created_at`)
+ORDER BY
+    `year`,
+    `month`;
+
+";
+// كان المعرّف يُدمج في نص الاستعلام مباشرةً — حقن SQL.
+$stmt = $con->prepare($sql);
+$stmt->bindValue(':driverID', $driverID);
+$stmt->execute();
+
+if ($stmt->rowCount() > 0) {
+    // Fetch the record
+    $row = $stmt->fetchAll(PDO::FETCH_ASSOC);
+
+    printSuccess( $row);
+    
+}
+    else{
+    // Print a failure message
+    printFailure($message = "No wallet record found");
+}
 ?>
\ No newline at end of file
diff --git a/payment_server/v2/main/ride/payment/getAllPayment.php b/payment_server/v2/main/ride/payment/getAllPayment.php
index f90ac01e..24699d3a 100644
--- a/payment_server/v2/main/ride/payment/getAllPayment.php
+++ b/payment_server/v2/main/ride/payment/getAllPayment.php
@@ -9,9 +9,9 @@ $sql = "SELECT
     FROM
         `ride`
     WHERE
-        `ride`.`status` = 'Finished'
+        LOWER(`ride`.`status`) IN ('finished','completed')
         AND `ride`.`created_at` BETWEEN CURRENT_DATE() + INTERVAL 7 HOUR AND CURRENT_DATE() + INTERVAL 10 HOUR
-        AND `ride`.`driver_id` = '$driverID'
+        AND `ride`.`driver_id` = :driverID
     ) AS morning_count,
     (
     SELECT
@@ -19,9 +19,9 @@ $sql = "SELECT
     FROM
         `ride`
     WHERE
-        `ride`.`status` = 'Finished'
+        LOWER(`ride`.`status`) IN ('finished','completed')
         AND `ride`.`created_at` BETWEEN CURRENT_DATE() + INTERVAL 15 HOUR AND CURRENT_DATE() + INTERVAL 18 HOUR
-        AND `ride`.`driver_id` = '$driverID'
+        AND `ride`.`driver_id` = :driverID
     ) AS afternoon_count,
     (
     SELECT
@@ -29,7 +29,7 @@ $sql = "SELECT
     FROM
         payments
     WHERE
-        isGiven = 'waiting' AND `driverID` = '$driverID'
+        isGiven = 'waiting' AND `driverID` = :driverID
     ) AS total_amount,
     (
     SELECT
@@ -37,8 +37,8 @@ $sql = "SELECT
     FROM
         ride
     WHERE
-        `driver_id` = '$driverID'
-        AND `ride`.`status` = 'Finished'
+        `driver_id` = :driverID
+        AND LOWER(`ride`.`status`) IN ('finished','completed')
         AND `ride`.`created_at` > CURRENT_DATE() - INTERVAL 1 WEEK
     ) AS total_amount_last_week
 FROM
@@ -47,7 +47,13 @@ LIMIT 1;
 
 
      ";
+/**
+ * كان معرّف السائق يُدمج في نص الاستعلام مباشرةً (حقن SQL)، وكانت الحالة
+ * تُطابق 'Finished' فقط بينما خط الرحلات الحالي يكتب 'completed' — فتظهر
+ * أرباح السائق ورحلاته أصفاراً.
+ */
 $stmt = $con->prepare($sql);
+$stmt->bindValue(':driverID', $driverID);
 $stmt->execute();
 
 if ($stmt->rowCount() > 0) {
diff --git a/payment_server/v2/main/ride/payment/getCountRide.php b/payment_server/v2/main/ride/payment/getCountRide.php
index 267d1749..92d24944 100644
--- a/payment_server/v2/main/ride/payment/getCountRide.php
+++ b/payment_server/v2/main/ride/payment/getCountRide.php
@@ -1,29 +1,31 @@
-<?php
-include "../../connect.php";
-$driver_id = filterRequest("driver_id");
-
-$sql = "SELECT
-  COUNT(id) AS count
-FROM
-  `ride`
-WHERE
-  `ride`.`status` = 'Finished'
-  AND driver_id = '$driver_id'
-  AND created_at >= CURDATE();
-";
-$stmt = $con->prepare($sql);
-$stmt->execute();
-
-if ($stmt->rowCount() > 0) {
-    // Fetch the record
-    $row = $stmt->fetchAll(PDO::FETCH_ASSOC);
-    
-
-    printSuccess( $row);
-    
-}
-    else{
-    // Print a failure message
-    printFailure($message = "No wallet record found");
-}
+<?php
+include "../../connect.php";
+$driver_id = filterRequest("driver_id");
+
+$sql = "SELECT
+  COUNT(id) AS count
+FROM
+  `ride`
+WHERE
+  LOWER(`ride`.`status`) IN ('finished','completed')
+  AND driver_id = :driver_id
+  AND created_at >= CURDATE();
+";
+// كان المعرّف يُدمج في نص الاستعلام مباشرةً — حقن SQL.
+$stmt = $con->prepare($sql);
+$stmt->bindValue(':driver_id', $driver_id);
+$stmt->execute();
+
+if ($stmt->rowCount() > 0) {
+    // Fetch the record
+    $row = $stmt->fetchAll(PDO::FETCH_ASSOC);
+    
+
+    printSuccess( $row);
+    
+}
+    else{
+    // Print a failure message
+    printFailure($message = "No wallet record found");
+}
 ?>
\ No newline at end of file