Fix SQL injection in the rest of the passman

passman-dev/php/passman/notes.php

@@ -50,13 +50,24 @@ if(isset($_POST['new_note']) && trim($_POST['new_note']) !='') {
 	//$sql_query = "INSERT INTO notes (login_user_id,note) VALUES " .
 	//			 "((SELECT id FROM login_users WHERE username='{$username}'),('{$new_note}'));";
 
-	$sql_query = "INSERT INTO notes (login_user_id, note) ".
-				 "VALUES ((SELECT id FROM login_users WHERE username='{$username}'), '{$new_note}')";
+    // Insert new note using a prepared statement to prevent SQL injection.
+    $sql_query = "INSERT INTO notes (login_user_id, note) ".
+                "VALUES ((SELECT id FROM login_users WHERE username = ?), ?)";
+
+    $stmt = $conn->prepare($sql_query);
+    if ($stmt === false) {
+        // Fail closed (do not leak DB details).
+        $conn->close();
+        die("Prepare failed.");
+    }
+
+    $stmt->bind_param("ss", $username, $new_note);
+    //echo $sql_query;
+
+    $result = $stmt->execute();
+    $stmt->close();
+    $conn->close();
 
-	//echo $sql_query;
-	
-	$result = $conn->query($sql_query);
-	$conn -> close();
 
 	// After processing, redirect to the same page to clear the form
 	unset($_POST['new_note']);