Edit APIs

lib/account.php

@@ -289,11 +289,11 @@ function addActivationCodes($count): array
     $output = ["Status" => "Fail"]; // Default Status is "Fail"
 
     if (is_numeric($count) && $count > 0 && $_SESSION["privilege_level"] >= $routerConfig["user_admin_permission_level"] && isLoggedIn()) {
-        $stmt = $mysqli->prepare("UPDATE Users SET ActivationToken = ?, CreatedAt = NOW(), CreatedBy = ? WHERE ID = ?");
+        $stmt = $mysqli->prepare("INSERT INTO Users VALUES ActivationToken = ?, CreatedAt = NOW(), CreatedBy = ?");
 
         for ($i = 0; $i < $count; $i++) {
             $activationCode = generateActivationToken();
-            $stmt->bind_param("sii", $activationCode, $_SESSION["ID"], $_SESSION["ID"]);
+            $stmt->bind_param("si", $activationCode, $_SESSION["ID"]);
             $stmt->execute();
 
             if ($stmt->affected_rows > 0) {
@@ -342,20 +342,44 @@ function listActivationCodes(): array
 
     if (isUserAdmin()) {
         $activationCodes = [];
-        $result = $mysqli->query("SELECT ActivationToken, CreatedAt, CreatedBy FROM Users");
 
-        // Check if the query executed Successfully
-        if ($result) {
-            while ($row = $result->fetch_assoc()) {
-                $activationCodes[] = $row;
+        // Use placeholders in the query
+        $query = "SELECT ActivationToken, CreatedAt, CreatedBy FROM Users WHERE isActivated = 0";
+        $stmt = $mysqli->prepare($query);
+
+        if ($stmt) {
+            // Bind the result variables
+            $activationToken = "";
+            $createdAt = "";
+            $createdBy = "";
+            $stmt->bind_result($activationToken, $createdAt, $createdBy);
+
+            // Execute the prepared statement
+            $stmt->execute();
+
+            // Fetch the results into the bound variables
+            while ($stmt->fetch()) {
+                $activationCodes[] = [
+                    'ActivationToken' => $activationToken,
+                    'CreatedAt' => $createdAt,
+                    'CreatedBy' => $createdBy
+                ];
             }
-            $output["Status"] = "Success";
-            $output["ActivationCodes"] = $activationCodes;
+
+            // Check if any results were fetched
+            if (!empty($activationCodes)) {
+                $output["Status"] = "Success";
+                $output["ActivationCodes"] = $activationCodes;
+            }
+
+            // Close the statement
+            $stmt->close();
         }
     }
     return $output;
 }
 
+
 function deleteUser($userID): array
 {
     global $mysqli, $routerConfig;