Mike Swanson
1aa9fcecad
- 2026-06-05-tom-reply2-draft.md (SENT): web-DB rearchitecture ack, CVV-no-paper correction, key-backup/escrow guidance, least-priv sync-job note - 2026-06-05-tom-quo-checklist.txt: clean 80-site quo() list sent to Tom - session log: TimeForce 2005->2008->2016 payroll chain (load-bearing, preserve) - guru-rmm submodule pointer -> dashboard redesign doc set (local) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
58 lines
2.7 KiB
Plaintext
58 lines
2.7 KiB
Plaintext
GLAZTECH WEBSITE - PAGES WITH IN-LINE SQL TO CONVERT TO STORED PROCS
|
|
=====================================================================
|
|
|
|
These are the spots in the LIVE site (D:\web\glaztech_4) that build SQL by
|
|
stitching text together (the quo() helper). Converting each of these to a stored
|
|
procedure / parameters is what closes the SQL-injection exposure. It's a
|
|
mechanical, repetitive change - no redesign.
|
|
|
|
- 80 call sites across 15 live files (line numbers below).
|
|
- The duplicate copies under Old_bin\ and Old_code\ are NOT in this list (not the
|
|
live code) - those can just be removed during your dead-page cleanup.
|
|
- Suggested order: the payment / order / quote pages first (that's where customer
|
|
input flows), then the rest.
|
|
- Test each page after converting it.
|
|
- online-payment-old.aspx.vb looks like a legacy page - if it's one of the dead
|
|
ones you're removing, just delete it rather than fixing it.
|
|
|
|
COUNT PER FILE
|
|
--------------
|
|
15 ach.aspx.vb
|
|
14 customer-login\online-payment-pnc.aspx.vb
|
|
14 customer-login\online-payment-ach-na.aspx.vb
|
|
12 customer-login\quote-detail.aspx.vb
|
|
12 customer-login\order-detail.aspx.vb
|
|
2 quick-pay.aspx.vb
|
|
2 quick-pay-ach.aspx.vb
|
|
2 quick-pay-pnc.aspx.vb
|
|
1 customer-login\Order-acknowledgements.aspx.vb
|
|
1 customer-login\order-acknowledgements-approval.aspx.vb
|
|
1 customer-login\online-payment-old.aspx.vb
|
|
1 customer-login\settings.aspx.vb
|
|
1 customer-login\CustomExportPdf.aspx.vb
|
|
1 gs\appearance-makeup.aspx.vb
|
|
1 gs\performance-makeup.aspx.vb
|
|
|
|
FULL LIST (file : line numbers)
|
|
-------------------------------
|
|
ach.aspx.vb: 224, 276, 277, 278, 279, 280, 282, 283, 284, 285, 286, 634, 671, 1246, 1248
|
|
customer-login\online-payment-pnc.aspx.vb: 1151, 1326, 1383, 1384, 1385, 1386, 1387, 1389, 1390, 1391, 1392, 1394, 1593, 1629
|
|
customer-login\online-payment-ach-na.aspx.vb: 1208, 1388, 1444, 1445, 1446, 1447, 1448, 1450, 1451, 1452, 1453, 1454, 1653, 1692
|
|
customer-login\quote-detail.aspx.vb: 96, 97, 98, 101, 102, 103, 286, 288, 310, 312, 1625, 1627
|
|
customer-login\order-detail.aspx.vb: 113, 114, 115, 118, 119, 120, 299, 301, 321, 323, 1712, 1714
|
|
quick-pay.aspx.vb: 880, 882
|
|
quick-pay-ach.aspx.vb: 888, 890
|
|
quick-pay-pnc.aspx.vb: 656, 658
|
|
customer-login\Order-acknowledgements.aspx.vb: 384
|
|
customer-login\order-acknowledgements-approval.aspx.vb: 39
|
|
customer-login\online-payment-old.aspx.vb: 1152
|
|
customer-login\settings.aspx.vb: 167
|
|
customer-login\CustomExportPdf.aspx.vb: 564
|
|
gs\appearance-makeup.aspx.vb: 211
|
|
gs\performance-makeup.aspx.vb: 175
|
|
|
|
Note: quo() is defined per-page (each page has its own local copy), so once a
|
|
page's call sites are converted you can remove that page's quo() definition.
|
|
|
|
- Arizona Computer Guru
|