# Sales Tax ERP security and PHP 8.3 conversion report

## Scope reviewed

- 1,519 application and asset files
- 537 PHP files
- 61 database tables in the supplied SQL dump
- Authentication, database wrapper, customer/payment/expense/invoice persistence paths, reports, PDF generation, loaders and public upload locations

## Malware review

No injected web shell, obfuscated backdoor, executable disguised as an image, or suspicious PHP payload was identified in the supplied archive. The small `index.php` files inside asset and class folders are access-prevention placeholders, not malware.

Legitimate compression and encoding calls remain in FPDF, SMTP and application utility code. These were reviewed in context and are not injected payloads.

## Security issue corrected

The legacy PDF uploader accepted arbitrary content, retained a user-controlled filename and placed the result in a public folder. It now:

- accepts only successful HTTP uploads;
- enforces a 10 MB maximum;
- verifies MIME type and the `%PDF-` signature;
- creates a cryptographically random `.pdf` filename;
- blocks PHP and other script execution in upload directories.

## PHP 8.3 compatibility corrections

- Replaced active short PHP opening tags.
- Corrected MySQLi connection arguments and result-object handling.
- Removed calls to the deleted magic-quotes API.
- Prevented failed queries from being treated as successful operations.
- Added safe handling for missing login records and unavailable database connections.
- Updated session initialization and cookie flags.
- Updated PHPMailer to 7.1.1 through a compatibility loader.
- Retained the existing FPDF layouts while correcting PHP 8 constructor and removed-function issues.
- Replaced remote PDF logo URLs with local filesystem paths.
- Added loader fallbacks compatible with modern jQuery/browser event handling.
- Updated jQuery to 3.7.1 and included jQuery Migrate 3.4.1 for the existing theme.
- Normalized customer-payment report calculations and two-decimal output.

## Database review

The supplied SQL dump contains 61 tables and does not contain `CREATE DATABASE`, `USE`, stored routine `DEFINER`, trigger or event statements that commonly cause cPanel import permission failures. It can be imported into a database selected in phpMyAdmin.

Six table constants refer to optional/legacy production tables absent from this dump. They were not changed because altering them could change dormant workflows; verify any production screens that use those optional tables after deployment.

## Deployment verification checklist

- Login and logout
- Customer and supplier create/update
- Purchase and purchase payment
- Sales Tax invoice draft/validate/print
- Customer payment and withholding fields
- General, mart and tax expenses
- Bank transactions and petty cash
- Stock, production and batch workflows
- Report filters, totals, CSV and PDF output
- Attendance, loan and payroll screens

Keep cPanel **Errors** open during first acceptance testing. Database failures are now logged with their MySQL error number instead of being hidden behind the generic warning.
