====================================================================================================
XSS PREVENTION AUDIT
====================================================================================================

🔍 SCANNING VIEW FILES
----------------------------------------------------------------------------------------------------
  Scanned 956 view files
  Found 5868 variable outputs
  Safe outputs (escaped): 397
  Unsafe outputs: 5471

🚨 POTENTIAL XSS VULNERABILITIES FOUND
----------------------------------------------------------------------------------------------------

  📄 views/messaging/index.php (24 issues)
     Line 209: class="channel-item <?= $isActive ? 'active' : '' ?> d-flex justify-content-between align-items-center">
     Line 211: <?= $channel['type'] === 'direct' ? '<i class="bi bi-person-fill me-1"></i>' : '' ?>
     Line 215: <span class="unread-badge"><?= $channel['unread_count'] ?></span>
     Line 236: <?= $activeChannel['type'] === 'direct' ? '' : '#' ?>
     Line 263: <div class="message-item" data-message-id="<?= $message['id'] ?>">
     Line 264: <div class="message-avatar" data-initial="<?= $msgInitial ?>">
     Line 266: <img src="<?= $msgAvatarUrl ?>" alt=""
     Line 270: <?= $msgInitial ?>
     Line 310: <div class="message-reactions" data-message-id="<?= $message['id'] ?>">
     Line 324: <button class="reaction" onclick="addReaction(<?= $message['id'] ?>, '<?= $emoji ?>')">
     Line 324: <button class="reaction" onclick="addReaction(<?= $message['id'] ?>, '<?= $emoji ?>')">
     Line 325: <?= $emoji ?> <span class="count"><?= $count ?></span>
     Line 325: <?= $emoji ?> <span class="count"><?= $count ?></span>
     Line 330: <button class="btn btn-sm btn-link add-reaction-btn" onclick="showReactionPicker(<?= $message['id'] ?>)" title="Add reaction">
     Line 335: <button class="btn btn-sm btn-link" onclick="showThread(<?= $message['id'] ?>)">
     Line 336: <?= $message['reply_count'] ?> replies
     Line 357: <span class="emoji-item" onclick="insertEmoji('<?= $emoji ?>')"><?= $emoji ?></span>
     Line 357: <span class="emoji-item" onclick="insertEmoji('<?= $emoji ?>')"><?= $emoji ?></span>
     Line 363: <input type="hidden" name="channel_id" value="<?= $activeChannelId ?>">
     Line 423: <div class="message-avatar" style="width:28px; height:28px; font-size:12px;" data-initial="<?= $memberInitial ?>">
     Line 425: <img src="<?= $memberAvatarUrl ?>" alt=""
     Line 429: <?= $memberInitial ?>
     Line 439: <button class="btn btn-sm btn-link text-danger p-0" onclick="removeMember(<?= $member['user_id'] ?>)" title="Remove member">
     Line 443: <div class="status-dot status-<?= $member['status'] ?? 'offline' ?>"></div>

  📄 views/boms/create.php (2 issues)
     Line 26: <option value="<?= $product['id'] ?>">#<?= $product['id'] ?> - <?= e($product['name']) ?> (<?= e($product['sku']) ?>)</option>
     Line 26: <option value="<?= $product['id'] ?>">#<?= $product['id'] ?> - <?= e($product['name']) ?> (<?= e($product['sku']) ?>)</option>

  📄 views/boms/trash.php (2 issues)
     Line 12: <div class="alert alert-<?= $flash['type'] ?? 'info' ?> alert-dismissible fade show">
     Line 13: <?= $flash['message'] ?? $flash ?>

  📄 views/boms/view.php (8 issues)
     Line 51: <div class="alert alert-<?= $flash['type'] ?? 'info' ?> alert-dismissible fade show">
     Line 64: <span class="badge badge-outline-<?= $bom['status'] == 'active' ? 'success' : 'secondary' ?> ms-2">
     Line 79: <span class="badge badge-outline-<?= $maxProducible >= $bom['quantity_to_produce'] ? 'success' : 'danger' ?>">
     Line 112: <option value="<?= $product['id'] ?>">
     Line 175: <span class="<?= $isLowStock ? 'text-warning' : '' ?>">
     Line 190: onclick="editComponent(<?= $component['id'] ?>, <?= $component['quantity'] ?>, '<?= e($component['component_name']) ?>')">
     Line 190: onclick="editComponent(<?= $component['id'] ?>, <?= $component['quantity'] ?>, '<?= e($component['component_name']) ?>')">
     Line 223: <div class="alert alert-<?= $maxProducible >= $bom['quantity_to_produce'] ? 'success' : 'warning' ?>">

  📄 views/boms/index.php (3 issues)
     Line 17: <div class="alert alert-<?= $flash['type'] ?? 'info' ?> alert-dismissible fade show">
     Line 18: <?= $flash['message'] ?? $flash ?>
     Line 45: <span class="badge badge-outline-<?= $class ?>"><?= ucfirst(e($bom['status'])) ?></span>

  📄 views/boms/edit.php (6 issues)
     Line 21: <option value="<?= $product['id'] ?>" <?= $product['id'] == $bom['product_id'] ? 'selected' : '' ?>>
     Line 21: <option value="<?= $product['id'] ?>" <?= $product['id'] == $bom['product_id'] ? 'selected' : '' ?>>
     Line 22: #<?= $product['id'] ?> - <?= e($product['name']) ?> (<?= e($product['sku']) ?>)
     Line 60: <option value="draft" <?= $bom['status'] == 'draft' ? 'selected' : '' ?>>Draft</option>
     Line 61: <option value="active" <?= $bom['status'] == 'active' ? 'selected' : '' ?>>Active</option>
     Line 62: <option value="inactive" <?= $bom['status'] == 'inactive' ? 'selected' : '' ?>>Inactive</option>

  📄 views/companies/create_backup.php (5 issues)
     Line 66: <option value="<?= $client['id'] ?>"
     Line 276: <option value="<?= $st ?>" <?= old('billing_state') === $st ? 'selected' : '' ?>><?= $st ?></option>
     Line 276: <option value="<?= $st ?>" <?= old('billing_state') === $st ? 'selected' : '' ?>><?= $st ?></option>
     Line 361: <option value="<?= $st ?>" <?= old('shipping_state') === $st ? 'selected' : '' ?>><?= $st ?></option>
     Line 361: <option value="<?= $st ?>" <?= old('shipping_state') === $st ? 'selected' : '' ?>><?= $st ?></option>
  ... and 5421 more issues

  Total Issues: 5471

📊 STATISTICS
----------------------------------------------------------------------------------------------------
  View Files Scanned:      956
  Variable Outputs Found:  5868
  Safe Outputs:            397 (6.8%)
  Unsafe Outputs:          5471

💡 RECOMMENDATIONS
----------------------------------------------------------------------------------------------------
  1. Wrap all user-generated content in esc() function
  2. Use htmlspecialchars() for HTML context
  3. Never output raw database values without escaping
  4. Be especially careful with user input and database content

  Example fix:
    ❌ <?= $row['name'] ?>
    ✅ <?= esc($row['name']) ?>

====================================================================================================
AUDIT COMPLETE
====================================================================================================