diff --git a/actions/channel_sync.php b/actions/channel_sync.php
index d14dd9d..2f11e65 100644
--- a/actions/channel_sync.php
+++ b/actions/channel_sync.php
@@ -5,7 +5,7 @@
 
 if (isset($_POST['sync'])) {
 
-    foreach ($_POST as $key => $value) {  
+    foreach ($_POST as $key => $value) {
       if (substr($key, 0, 7) == "target_") {
 	      $target = ltrim($key, 'target_');
 	      $target_fields = explode("|", $target);
@@ -13,6 +13,13 @@
 	      $target_id=$target_fields[1];
 	      $target_id=str_replace("_com", ".com", $target_id);
 
+              // Database names cannot be parameterized in prepared statements (they are identifiers, not values)
+              // so we use a whitelist to validate the database name before using string interpolation
+              $allowed_dbs = explode(",", $dbname);
+              if (!in_array($target_db, $allowed_dbs)) {
+                  die("Invalid database");
+              }
+
               // Delete All Previous Trackings
 	      $stmt = $conn->prepare("DELETE FROM ".$target_db.".monsters WHERE id = ?");
 	      $rs = $stmt->bind_param("s", $target_id);
diff --git a/actions/set_language.php b/actions/set_language.php
index 492b43b..335230b 100644
--- a/actions/set_language.php
+++ b/actions/set_language.php
@@ -11,8 +11,10 @@
 
 // Update Language in DB
 
-$sql = "UPDATE humans set language  = '".$_GET['lng']."'  WHERE id = '" . $_SESSION['id'] . "'"; 
-$result = $conn->query($sql) or die(mysqli_error($conn));
+$stmt = $conn->prepare("UPDATE humans SET language = ? WHERE id = ?");
+$stmt->bind_param("ss", $_GET['lng'], $_SESSION['id']);
+$stmt->execute() or die(mysqli_error($conn));
+$stmt->close();
 
 header("Location: $redirect_url");
 
diff --git a/actions/set_location.php b/actions/set_location.php
index 9b8cd47..ed8f32a 100644
--- a/actions/set_location.php
+++ b/actions/set_location.php
@@ -10,16 +10,26 @@
   $lat = "0.0000000000";
   $lon = "0.0000000000";
 
-  $sql = "UPDATE monsters set distance = 0 WHERE id = '" . $_SESSION['id'] . "' AND profile_no = '".$_SESSION['profile']."'";
-  $result = $conn->query($sql);
-  $sql = "UPDATE raid set distance = 0 WHERE id = '" . $_SESSION['id'] . "' AND profile_no = '".$_SESSION['profile']."'";
-  $result = $conn->query($sql);
-  $sql = "UPDATE egg set distance = 0 WHERE id = '" . $_SESSION['id'] . "' AND profile_no = '".$_SESSION['profile']."'";
-  $result = $conn->query($sql);
-  $sql = "UPDATE quest set distance = 0 WHERE id = '" . $_SESSION['id'] . "' AND profile_no = '".$_SESSION['profile']."'";
-  $result = $conn->query($sql);
-  $sql = "UPDATE invasion set distance = 0 WHERE id = '" . $_SESSION['id'] . "' AND profile_no = '".$_SESSION['profile']."'";
-  $result = $conn->query($sql);
+  $stmt = $conn->prepare("UPDATE monsters set distance = 0 WHERE id = ? AND profile_no = ?");
+  $stmt->bind_param("si", $_SESSION['id'], $_SESSION['profile']);
+  $stmt->execute();
+  $stmt->close();
+  $stmt = $conn->prepare("UPDATE raid set distance = 0 WHERE id = ? AND profile_no = ?");
+  $stmt->bind_param("si", $_SESSION['id'], $_SESSION['profile']);
+  $stmt->execute();
+  $stmt->close();
+  $stmt = $conn->prepare("UPDATE egg set distance = 0 WHERE id = ? AND profile_no = ?");
+  $stmt->bind_param("si", $_SESSION['id'], $_SESSION['profile']);
+  $stmt->execute();
+  $stmt->close();
+  $stmt = $conn->prepare("UPDATE quest set distance = 0 WHERE id = ? AND profile_no = ?");
+  $stmt->bind_param("si", $_SESSION['id'], $_SESSION['profile']);
+  $stmt->execute();
+  $stmt->close();
+  $stmt = $conn->prepare("UPDATE invasion set distance = 0 WHERE id = ? AND profile_no = ?");
+  $stmt->bind_param("si", $_SESSION['id'], $_SESSION['profile']);
+  $stmt->execute();
+  $stmt->close();
 
 } else if ( isset($_GET['lat']) &&  isset($_GET['lon']) ) {
 
diff --git a/actions/switch_profile.php b/actions/switch_profile.php
index c99b9d4..8fa6d2e 100644
--- a/actions/switch_profile.php
+++ b/actions/switch_profile.php
@@ -11,23 +11,23 @@
 	  $_SESSION['profile'] = $_POST['profile'];
   }
 
-  if ( isset($_POST['activate']) ) { 
-
-	  $sql = "SELECT area, latitude, longitude from profiles WHERE id = '" . $_SESSION['id'] . "' AND profile_no = '".$_POST['profile']."'";
-          $result = $conn->query($sql); 
-	  while ($row = $result->fetch_assoc()) { 
-		  $area = $row['area']; 
-		  $latitude = $row['latitude']; 
-		  $longitude = $row['longitude']; 
+  if ( isset($_POST['activate']) ) {
+
+	  $stmt = $conn->prepare("SELECT area, latitude, longitude from profiles WHERE id = ? AND profile_no = ?");
+	  $stmt->bind_param("si", $_SESSION['id'], $_POST['profile']);
+	  $stmt->execute();
+	  $result = $stmt->get_result();
+	  while ($row = $result->fetch_assoc()) {
+		  $area = $row['area'];
+		  $latitude = $row['latitude'];
+		  $longitude = $row['longitude'];
 	  }
+	  $stmt->close();
 
-	  $sql = "UPDATE humans 
-		  SET area = '".$area."', 
-		      latitude = '".$latitude."', 
-		      longitude = '".$longitude."', 
-                      current_profile_no = '".$_POST['profile']."'
-		   WHERE id = '" . $_SESSION['id'] . "'";
-          $result = $conn->query($sql);
+	  $stmt = $conn->prepare("UPDATE humans SET area = ?, latitude = ?, longitude = ?, current_profile_no = ? WHERE id = ?");
+	  $stmt->bind_param("ssdis", $area, $latitude, $longitude, $_POST['profile'], $_SESSION['id']);
+	  $stmt->execute();
+	  $stmt->close();
 	  header("Location: $redirect_url?type=display&page=profiles&return=success_switch_profile_activate");
 
 
@@ -41,27 +41,32 @@
 
 	  // Get Next Profile Number
           #$sql = "SELECT IFNULL(max(profile_no),0)+1 next_profile from profiles WHERE id = '" . $_SESSION['id'] . "'";
-	  $sql = "SELECT MIN(t1.profile_no + 1) AS nextID
-                  FROM (select profile_no from profiles  WHERE id = '".$_SESSION['id']."' UNION select 0 profile_no) t1
-                  LEFT JOIN (select profile_no from profiles  WHERE id = '".$_SESSION['id']."' UNION select 0 profile_no) t2
+	  $stmt = $conn->prepare("SELECT MIN(t1.profile_no + 1) AS nextID
+                  FROM (select profile_no from profiles  WHERE id = ? UNION select 0 profile_no) t1
+                  LEFT JOIN (select profile_no from profiles  WHERE id = ? UNION select 0 profile_no) t2
                   ON t1.profile_no + 1 = t2.profile_no
-                  WHERE t2.profile_no IS NULL";
-
-	  $result = $conn->query($sql);
+                  WHERE t2.profile_no IS NULL");
+	  $stmt->bind_param("ss", $_SESSION['id'], $_SESSION['id']);
+	  $stmt->execute();
+	  $result = $stmt->get_result();
 	  while ($row = $result->fetch_assoc()) {
 		  $next_profile = $row['nextID'];
 	  }
+	  $stmt->close();
 
 	  if ( $next_profile == 1 ) {
              // Get Info on currently active Profile
-             $sql = "SELECT area, latitude, longitude from humans WHERE id = '" . $_SESSION['id'] . "'";
-             $result = $conn->query($sql);
+             $stmt = $conn->prepare("SELECT area, latitude, longitude from humans WHERE id = ?");
+	     $stmt->bind_param("s", $_SESSION['id']);
+	     $stmt->execute();
+             $result = $stmt->get_result();
              while ($row = $result->fetch_assoc()) {
                   $area = $row['area'];
                   $latitude = $row['latitude'];
 		  $longitude = $row['longitude'];
 		  $_SESSION['profile_name'] = $_POST['profile_name'];
              }
+	     $stmt->close();
 	  } else {
 		  $area = "[]";
 		  $latitude = "0.0000000000";
@@ -153,26 +158,32 @@
 
           // Change Active Profile if Deleting Active one
 
-          $sql = "select current_profile_no FROM humans WHERE id = '" . $_SESSION['id'] . "'";
-          $result = $conn->query($sql);
+          $stmt = $conn->prepare("SELECT current_profile_no FROM humans WHERE id = ?");
+          $stmt->bind_param("s", $_SESSION['id']);
+          $stmt->execute();
+          $result = $stmt->get_result();
           while ($row = $result->fetch_assoc()) {
              $current_profile = $row['current_profile_no'];
           }
+          $stmt->close();
 
           if ( $current_profile == $_SESSION['profile'])  {
-                  $sql = "UPDATE humans set current_profile_no =
-                          (select IFNULL(min(profile_no),1) from profiles where id = '".$_SESSION['id']."')
-			  WHERE id = '" . $_SESSION['id'] . "'";
-                  $result = $conn->query($sql); 
+                  $stmt = $conn->prepare("UPDATE humans set current_profile_no = (select IFNULL(min(profile_no),1) from profiles where id = ?) WHERE id = ?");
+                  $stmt->bind_param("ss", $_SESSION['id'], $_SESSION['id']);
+                  $stmt->execute();
+                  $stmt->close();
           }
 
 	  // Check for smaller Profiles and redirect
 
-          $sql = "select IFNULL(min(profile_no),1) min from profiles WHERE id = '" . $_SESSION['id'] . "'";
-	  $result = $conn->query($sql);
+          $stmt = $conn->prepare("SELECT IFNULL(min(profile_no),1) min from profiles WHERE id = ?");
+          $stmt->bind_param("s", $_SESSION['id']);
+          $stmt->execute();
+          $result = $stmt->get_result();
           while ($row = $result->fetch_assoc()) {
              $_SESSION['profile'] = $row['min'];
           }
+          $stmt->close();
 
           header("Location: $redirect_url?type=display&page=profiles&return=success_delete_profile");
 
diff --git a/admin_connect.php b/admin_connect.php
index 9bdf287..74fd96e 100644
--- a/admin_connect.php
+++ b/admin_connect.php
@@ -46,8 +46,10 @@
 }
 
 $conn = new mysqli($dbhost.":".$dbport, $dbuser, $dbpass, $_SESSION['dbname']);
-$sql = "select id, name, type, notes FROM humans WHERE id = '".$search_id."'"; 
-$result = $conn->query($sql);
+$stmt = $conn->prepare("SELECT id, name, type, notes FROM humans WHERE id = ?");
+$stmt->bind_param("s", $search_id);
+$stmt->execute();
+$result = $stmt->get_result();
 
 if ($result->num_rows == 0) {
 	header("Location: $redirect_url?return=user_not_found");
@@ -60,6 +62,7 @@
         $_SESSION['type']=$row['type'];
         $_SESSION['notes']=$row['notes'];
 }
+$stmt->close();
 
 // Get Config Items from API and Store in Session Variables
 
@@ -108,11 +111,14 @@
 
 // Switch to active Profile
 
-$sql = "SELECT current_profile_no FROM humans WHERE id = '" . $_SESSION['id'] . "'";
-$result = $conn->query($sql);
+$stmt = $conn->prepare("SELECT current_profile_no FROM humans WHERE id = ?");
+$stmt->bind_param("s", $_SESSION['id']);
+$stmt->execute();
+$result = $stmt->get_result();
 while ($row = $result->fetch_assoc()) {
     $_SESSION['profile'] = $row['current_profile_no'];
 }
+$stmt->close();
 
 header("Location: $redirect_url");
 
diff --git a/admin_sync.php b/admin_sync.php
index c6176ca..2b5a0a5 100644
--- a/admin_sync.php
+++ b/admin_sync.php
@@ -94,8 +94,10 @@
                     foreach ($dbnames as &$db) {
 
                        $conn = new mysqli($dbhost.":".$dbport, $dbuser, $dbpass, $db);
-                       $sql = "select id, name, type FROM humans WHERE type like 'discord:channel' AND id <> '".$_SESSION['id']."' ORDER by name";
-                       $result = $conn->query($sql);
+                       $stmt = $conn->prepare("SELECT id, name, type FROM humans WHERE type like 'discord:channel' AND id <> ? ORDER by name");
+                       $stmt->bind_param("s", $_SESSION['id']);
+                       $stmt->execute();
+                       $result = $stmt->get_result();
                        ?>
 
                     <?php if ($result->num_rows <> 0) { ?>
@@ -145,8 +147,10 @@
                     foreach ($dbnames as &$db) {
 
                        $conn = new mysqli($dbhost.":".$dbport, $dbuser, $dbpass, $db);
-      		       $sql = "select id, name, type FROM humans WHERE type in ('telegram:channel','telegram:group') AND id <> '".$_SESSION['id']."' ORDER by name";
-                       $result = $conn->query($sql);
+      		       $stmt = $conn->prepare("SELECT id, name, type FROM humans WHERE type in ('telegram:channel','telegram:group') AND id <> ? ORDER by name");
+                       $stmt->bind_param("s", $_SESSION['id']);
+                       $stmt->execute();
+                       $result = $stmt->get_result();
                        ?>
 
                     <?php if ($result->num_rows <> 0) { ?>
@@ -196,8 +200,10 @@
                     foreach ($dbnames as &$db) {
 
                        $conn = new mysqli($dbhost.":".$dbport, $dbuser, $dbpass, $db);
-                       $sql = "select id, name, type FROM humans WHERE type like 'webhook' AND id <> '".$_SESSION['id']."' ORDER by name";
-                       $result = $conn->query($sql);
+                       $stmt = $conn->prepare("SELECT id, name, type FROM humans WHERE type like 'webhook' AND id <> ? ORDER by name");
+                       $stmt->bind_param("s", $_SESSION['id']);
+                       $stmt->execute();
+                       $result = $stmt->get_result();
                        ?>
 
                     <?php if ($result->num_rows <> 0) { ?>
diff --git a/header.php b/header.php
index dcc8b8d..b6e407a 100644
--- a/header.php
+++ b/header.php
@@ -31,26 +31,34 @@
 // Set Profile to current if not yet set
 
 if (!isset($_SESSION['profile']) && isset($_SESSION['id'])) {
-   $sql = "SELECT current_profile_no FROM humans WHERE id = '" . $_SESSION['id'] . "'";
-   $result = $conn->query($sql);
+   $stmt = $conn->prepare("SELECT current_profile_no FROM humans WHERE id = ?");
+   $stmt->bind_param("s", $_SESSION['id']);
+   $stmt->execute();
+   $result = $stmt->get_result();
    while ($row = $result->fetch_assoc()) {
        $_SESSION['profile'] = $row['current_profile_no'];
    }
+   $stmt->close();
 }
 
 // Check if user has Multiple Profiles
 
 if (isset($_SESSION['id'])) {
-   $sql = "SELECT name FROM profiles WHERE id = '" . $_SESSION['id'] . "'";
-   $result = $conn->query($sql);
+   $stmt = $conn->prepare("SELECT name FROM profiles WHERE id = ?");
+   $stmt->bind_param("s", $_SESSION['id']);
+   $stmt->execute();
+   $result = $stmt->get_result();
    $_SESSION['number_of_profiles'] = $result->num_rows;
+   $stmt->close();
 }
 
 // Get Profile Name
 
 if (isset($_SESSION['id'])) {
-   $sql = "SELECT name FROM profiles WHERE id = '" . $_SESSION['id'] . "' AND profile_no = '" . $_SESSION['profile'] . "'";
-   $result = $conn->query($sql);
+   $stmt = $conn->prepare("SELECT name FROM profiles WHERE id = ? AND profile_no = ?");
+   $stmt->bind_param("si", $_SESSION['id'], $_SESSION['profile']);
+   $stmt->execute();
+   $result = $stmt->get_result();
    if ($result->num_rows > 0) {
       while ($row = $result->fetch_assoc()) {
          $_SESSION['profile_name'] = $row['name'];
@@ -58,68 +66,95 @@
    } else {
          $_SESSION['profile_name'] = i8ln("Default");
    }
+   $stmt->close();
 }
 
 // Get Active Profile
 
 if (isset($_SESSION['id'])) {
-   $sql = "SELECT current_profile_no from humans WHERE id = '" . $_SESSION['id'] . "'";
-   $result = $conn->query($sql);
+   $stmt = $conn->prepare("SELECT current_profile_no from humans WHERE id = ?");
+   $stmt->bind_param("s", $_SESSION['id']);
+   $stmt->execute();
+   $result = $stmt->get_result();
    while ($row = $result->fetch_assoc()) {
       $_SESSION['current_profile'] = $row['current_profile_no'];
    }
+   $stmt->close();
 }
 
 // Check for Cleaned
 
 if (isset($_SESSION['id'])) {
 
-   $sql = "select min(clean) clean FROM monsters WHERE id = '" . $_SESSION['id'] . "'";
-   $result = $conn->query($sql);
+   $stmt = $conn->prepare("SELECT min(clean) clean FROM monsters WHERE id = ?");
+   $stmt->bind_param("s", $_SESSION['id']);
+   $stmt->execute();
+   $result = $stmt->get_result();
    while ($row = $result->fetch_assoc()) {
        $all_mon_cleaned = $row['clean'];
    }
-   
-   $sql = "select min(clean) clean FROM (select id, clean from raid UNION select id, clean from egg) raidegg WHERE id = '" . $_SESSION['id'] . "'";
-   $result = $conn->query($sql);
+   $stmt->close();
+
+   $stmt = $conn->prepare("SELECT min(clean) clean FROM (select id, clean from raid UNION select id, clean from egg) raidegg WHERE id = ?");
+   $stmt->bind_param("s", $_SESSION['id']);
+   $stmt->execute();
+   $result = $stmt->get_result();
    while ($row = $result->fetch_assoc()) {
        $all_raid_cleaned = $row['clean'];
    }
-   
-   $sql = "select min(clean) clean FROM quest WHERE id = '" . $_SESSION['id'] . "'";
-   $result = $conn->query($sql);
+   $stmt->close();
+
+   $stmt = $conn->prepare("SELECT min(clean) clean FROM quest WHERE id = ?");
+   $stmt->bind_param("s", $_SESSION['id']);
+   $stmt->execute();
+   $result = $stmt->get_result();
    while ($row = $result->fetch_assoc()) {
        $all_quest_cleaned = $row['clean'];
    }
+   $stmt->close();
 
-   $sql = "select min(clean) clean FROM invasion WHERE id = '" . $_SESSION['id'] . "'";
-   $result = $conn->query($sql);
+   $stmt = $conn->prepare("SELECT min(clean) clean FROM invasion WHERE id = ?");
+   $stmt->bind_param("s", $_SESSION['id']);
+   $stmt->execute();
+   $result = $stmt->get_result();
    while ($row = $result->fetch_assoc()) {
        $all_invasion_cleaned = $row['clean'];
    }
+   $stmt->close();
 
-   $sql = "select min(clean) clean FROM lures WHERE id = '" . $_SESSION['id'] . "'";
-   $result = $conn->query($sql);
+   $stmt = $conn->prepare("SELECT min(clean) clean FROM lures WHERE id = ?");
+   $stmt->bind_param("s", $_SESSION['id']);
+   $stmt->execute();
+   $result = $stmt->get_result();
    while ($row = $result->fetch_assoc()) {
        $all_lures_cleaned = $row['clean'];
    }
+   $stmt->close();
 
-   $sql = "select min(clean) clean FROM nests WHERE id = '" . $_SESSION['id'] . "'";
-   $result = $conn->query($sql);
+   $stmt = $conn->prepare("SELECT min(clean) clean FROM nests WHERE id = ?");
+   $stmt->bind_param("s", $_SESSION['id']);
+   $stmt->execute();
+   $result = $stmt->get_result();
    while ($row = $result->fetch_assoc()) {
        $all_nests_cleaned = $row['clean'];
    }
+   $stmt->close();
 
-   $sql = "select min(clean) clean FROM gym WHERE id = '" . $_SESSION['id'] . "'";
-   $result = $conn->query($sql);
+   $stmt = $conn->prepare("SELECT min(clean) clean FROM gym WHERE id = ?");
+   $stmt->bind_param("s", $_SESSION['id']);
+   $stmt->execute();
+   $result = $stmt->get_result();
    while ($row = $result->fetch_assoc()) {
        $all_gyms_cleaned = $row['clean'];
    }
+   $stmt->close();
 
 
    // Get Areas, Lat, long and Enabled from Humans Table
-   $sql = "select area, latitude, longitude, enabled, admin_disable, disabled_date from humans WHERE id = '" . $_SESSION['id'] . "'";
-   $result = $conn->query($sql);
+   $stmt = $conn->prepare("SELECT area, latitude, longitude, enabled, admin_disable, disabled_date from humans WHERE id = ?");
+   $stmt->bind_param("s", $_SESSION['id']);
+   $stmt->execute();
+   $result = $stmt->get_result();
    while ($row = $result->fetch_assoc()) {
        $area_set = $row['area'];
        $latitude = $row['latitude'];
@@ -128,11 +163,14 @@
        $admin_disable = $row['admin_disable'];
        $disabled_date = $row['disabled_date'];
    }
+   $stmt->close();
 
    // Overwrite with Profile info if a profile is available
 
-   $sql = "select area, latitude, longitude from profiles WHERE id = '" . $_SESSION['id'] . "' AND profile_no = '". $_SESSION['profile'] ."'";
-   $result = $conn->query($sql);
+   $stmt = $conn->prepare("SELECT area, latitude, longitude from profiles WHERE id = ? AND profile_no = ?");
+   $stmt->bind_param("si", $_SESSION['id'], $_SESSION['profile']);
+   $stmt->execute();
+   $result = $stmt->get_result();
 
    if ($result->num_rows > 0) {
       while ($row = $result->fetch_assoc()) {
@@ -141,6 +179,7 @@
           $longitude = $row['longitude'];
       }
    }
+   $stmt->close();
 
 }
 
@@ -159,17 +198,20 @@
 
     if (isset($enable_admin_dis) && $enable_admin_dis == "False" && isset($_SESSION['admin_id']) && $_SESSION['id'] <> $_SESSION['admin_id'])
     {
-	    $subs_clause .= " AND admin_disable = 0";
+	    $stmt = $conn->prepare("SELECT * from humans WHERE id = ? AND admin_disable = 0");
+    } else {
+	    $stmt = $conn->prepare("SELECT * from humans WHERE id = ?");
     }
-
-    $sql = "SELECT * from humans WHERE id = '" . $_SESSION['id'] . "' ".@$subs_clause;
-    $result = $conn->query($sql);
-    if ($result->num_rows == 0) { 
-         if (strpos($_SERVER['REQUEST_URI'],$redirect_page) == false) { 
-		 header("Location: $redirect_url/$redirect_page"); 
+    $stmt->bind_param("s", $_SESSION['id']);
+    $stmt->execute();
+    $result = $stmt->get_result();
+    if ($result->num_rows == 0) {
+         if (strpos($_SERVER['REQUEST_URI'],$redirect_page) == false) {
+		 header("Location: $redirect_url/$redirect_page");
 		 exit();
-	 } 
-    } 
+	 }
+    }
+    $stmt->close(); 
 
 } else { 
      // If not logged in import login page
@@ -231,11 +273,14 @@
 // Check if IV + PvP is used
 
 $sql = "SELECT * FROM monsters
-	WHERE (min_iv > 0 or max_iv < 100 or atk > 0 or def > 0 or sta > 0 or max_atk < 15 or max_def < 15 or max_sta < 15) 
+	WHERE (min_iv > 0 or max_iv < 100 or atk > 0 or def > 0 or sta > 0 or max_atk < 15 or max_def < 15 or max_sta < 15)
 	AND pvp_ranking_league <> 0
-        AND id = '" . $_SESSION['id'] . "'";
+        AND id = ?";
 
-$result = $conn->query($sql);
+$stmt = $conn->prepare($sql);
+$stmt->bind_param("s", $_SESSION['id']);
+$stmt->execute();
+$result = $stmt->get_result();
 
 if (!empty($result) && $result->num_rows > 0) {
    $config_alarm="<div class='alert alert-danger fade show mb-2' role='alert' style='background-color:darkred; color:white;'>";
@@ -244,6 +289,7 @@
    $config_alarm.=i8ln("Alarms will only be triggered if ALL Filters are met").".<br>";
    $config_alarm.="</div>";
 }
+$stmt->close();
 
 // Check If Distance Map should be displayed
 
diff --git a/include/db_mad.php b/include/db_mad.php
index 51d6873..4f902fc 100644
--- a/include/db_mad.php
+++ b/include/db_mad.php
@@ -116,12 +116,15 @@ function get_raid_bosses() {
 function get_gym_by_id($id) {
 
         global $scan_conn;
-        $sql = "SELECT name from gymdetails where gym_id = '".$id."'";
-        $result = $scan_conn->query($sql);
+        $stmt = $scan_conn->prepare("SELECT name from gymdetails where gym_id = ?");
+        $stmt->bind_param("s", $id);
+        $stmt->execute();
+        $result = $stmt->get_result();
 
         while($row = $result->fetch_assoc()) {
                 $gym_name = $row['name'];
         }
+        $stmt->close();
 
         return $gym_name;
 
@@ -130,12 +133,15 @@ function get_gym_by_id($id) {
 function get_gym_url($id) {
 
         global $scan_conn;
-        $sql = "SELECT url from gymdetails where gym_id = '".$id."'";
-        $result = $scan_conn->query($sql);
+        $stmt = $scan_conn->prepare("SELECT url from gymdetails where gym_id = ?");
+        $stmt->bind_param("s", $id);
+        $stmt->execute();
+        $result = $stmt->get_result();
 
         while($row = $result->fetch_assoc()) {
                 $gym_url = $row['url'];
         }
+        $stmt->close();
 
         return $gym_url;
 
diff --git a/include/db_rdm.php b/include/db_rdm.php
index 2180734..4a9f644 100644
--- a/include/db_rdm.php
+++ b/include/db_rdm.php
@@ -119,12 +119,15 @@ function get_raid_bosses() {
 function get_gym_by_id($id) {
 
 	global $scan_conn;
-	$sql = "SELECT name from gym where id = '".$id."'";
-	$result = $scan_conn->query($sql);
+	$stmt = $scan_conn->prepare("SELECT name from gym where id = ?");
+	$stmt->bind_param("s", $id);
+	$stmt->execute();
+	$result = $stmt->get_result();
 
 	while($row = $result->fetch_assoc()) {
 		$gym_name = $row['name'];
 	}
+	$stmt->close();
 
 	return $gym_name;
 
@@ -133,12 +136,15 @@ function get_gym_by_id($id) {
 function get_gym_url($id) {
 
         global $scan_conn;
-        $sql = "SELECT url from gym where id = '".$id."'";
-        $result = $scan_conn->query($sql);
+        $stmt = $scan_conn->prepare("SELECT url from gym where id = ?");
+        $stmt->bind_param("s", $id);
+        $stmt->execute();
+        $result = $stmt->get_result();
 
         while($row = $result->fetch_assoc()) {
                 $gym_url = $row['url'];
         }
+        $stmt->close();
 
         return $gym_url;
 
diff --git a/include/functions.php b/include/functions.php
index ce895a2..d979bf8 100644
--- a/include/functions.php
+++ b/include/functions.php
@@ -396,13 +396,16 @@ function set_locale() {
    if (isset($_SESSION['id'])) {
       include_once "./config.php";
       include_once "./include/db_connect.php";
-      $sql = "select language FROM humans WHERE id = '" . $_SESSION['id'] . "'"; 
-      $result = $conn->query($sql) or die(mysqli_error($conn));
-      while ($row = $result->fetch_assoc()) {  
-         if ( $row['language'] <> "" ) { 
+      $stmt = $conn->prepare("SELECT language FROM humans WHERE id = ?");
+      $stmt->bind_param("s", $_SESSION['id']);
+      $stmt->execute() or die(mysqli_error($conn));
+      $result = $stmt->get_result();
+      while ($row = $result->fetch_assoc()) {
+         if ( $row['language'] <> "" ) {
             $_SESSION['locale'] = $row['language'];
          }
       }
+      $stmt->close();
    }
 
 }
@@ -581,10 +584,17 @@ function default_distance($table) {
    if (isset($_SESSION['id'])) {
       include_once "./config.php";
       include_once "./include/db_connect.php";
-      $sql = "select max(distance) distance FROM $table WHERE id = '" . $_SESSION['id'] . "'";
-      $sql = "SELECT distance, count(*) FROM $table WHERE id = '" . $_SESSION['id'] . "' GROUP BY distance ORDER BY count(*) DESC LIMIT 1"; 
-      $result = $conn->query($sql) or die(mysqli_error($conn));
+      // Table names cannot be parameterized in prepared statements (they are identifiers, not values)
+      // so we use a whitelist to validate the table name before using string interpolation
+      $allowed_tables = array('monsters', 'raid', 'egg', 'quest', 'invasion', 'lures', 'gym');
+      if (!in_array($table, $allowed_tables)) { die("Invalid table"); }
+      $sql = "SELECT distance, count(*) FROM $table WHERE id = ? GROUP BY distance ORDER BY count(*) DESC LIMIT 1";
+      $stmt = $conn->prepare($sql);
+      $stmt->bind_param("s", $_SESSION['id']);
+      $stmt->execute() or die(mysqli_error($conn));
+      $result = $stmt->get_result();
       while ($row = $result->fetch_assoc()) { $default_distance = $row['distance']; }
+      $stmt->close();
    }
 
    if ( !isset($default_distance) ) { $default_distance = 0; }
diff --git a/include/toplinks.php b/include/toplinks.php
index 8e1fc9f..689adb2 100644
--- a/include/toplinks.php
+++ b/include/toplinks.php
@@ -4,24 +4,27 @@
 $user_id = $_SESSION['id'];
 $profile_id = $_SESSION['profile'];
 $sql = "
-   SELECT COUNT(*) AS 'Total', 'monsters' AS 'Type' FROM monsters WHERE id = '{$user_id}' AND profile_no = '{$profile_id}'
+   SELECT COUNT(*) AS 'Total', 'monsters' AS 'Type' FROM monsters WHERE id = ? AND profile_no = ?
    UNION
-   SELECT COUNT(*) AS 'Total', 'raid' AS 'Type' FROM raid WHERE id = '{$user_id}' AND profile_no = '{$profile_id}'
+   SELECT COUNT(*) AS 'Total', 'raid' AS 'Type' FROM raid WHERE id = ? AND profile_no = ?
    UNION
-   SELECT COUNT(*) AS 'Total', 'egg' AS 'Type' FROM egg WHERE id = '{$user_id}' AND profile_no = '{$profile_id}'
+   SELECT COUNT(*) AS 'Total', 'egg' AS 'Type' FROM egg WHERE id = ? AND profile_no = ?
    UNION
-   SELECT COUNT(*) AS 'Total', 'quest' AS 'Type' FROM quest WHERE id = '{$user_id}' AND profile_no = '{$profile_id}'
+   SELECT COUNT(*) AS 'Total', 'quest' AS 'Type' FROM quest WHERE id = ? AND profile_no = ?
    UNION
-   SELECT COUNT(*) AS 'Total', 'invasion' AS 'Type' FROM invasion WHERE id = '{$user_id}' AND profile_no = '{$profile_id}'
+   SELECT COUNT(*) AS 'Total', 'invasion' AS 'Type' FROM invasion WHERE id = ? AND profile_no = ?
    UNION
-   SELECT COUNT(*) AS 'Total', 'lures' AS 'Type' FROM lures WHERE id = '{$user_id}' AND profile_no = '{$profile_id}'
+   SELECT COUNT(*) AS 'Total', 'lures' AS 'Type' FROM lures WHERE id = ? AND profile_no = ?
    UNION
-   SELECT COUNT(*) AS 'Total', 'nests' AS 'Type' FROM nests WHERE id = '{$user_id}' AND profile_no = '{$profile_id}'
+   SELECT COUNT(*) AS 'Total', 'nests' AS 'Type' FROM nests WHERE id = ? AND profile_no = ?
    UNION
-   SELECT COUNT(*) AS 'Total', 'gym' AS 'Type' FROM gym WHERE id = '{$user_id}' AND profile_no = '{$profile_id}'
+   SELECT COUNT(*) AS 'Total', 'gym' AS 'Type' FROM gym WHERE id = ? AND profile_no = ?
 ";
 
-$result = $conn->query($sql);
+$stmt = $conn->prepare($sql);
+$stmt->bind_param("sisisisisisisisi", $user_id, $profile_id, $user_id, $profile_id, $user_id, $profile_id, $user_id, $profile_id, $user_id, $profile_id, $user_id, $profile_id, $user_id, $profile_id, $user_id, $profile_id);
+$stmt->execute();
+$result = $stmt->get_result();
 while ($row = $result->fetch_assoc()) {
    switch ($row['Type']) {
       case 'monsters':
@@ -50,6 +53,7 @@
          break;
    };
 }
+$stmt->close();
 
 ?>
 
diff --git a/modal/areas_modal.php b/modal/areas_modal.php
index 4a31abe..f3ad4e2 100644
--- a/modal/areas_modal.php
+++ b/modal/areas_modal.php
@@ -3,18 +3,22 @@
 // Check Current Selection
 
 if ($_SESSION['profile'] == $_SESSION['current_profile'] ) {
-	$sql = "select area FROM humans WHERE id = '" . $_SESSION['id'] . "'";
+	$stmt = $conn->prepare("SELECT area FROM humans WHERE id = ?");
+	$stmt->bind_param("s", $_SESSION['id']);
 }
 else {
-	$sql = "select area FROM profiles WHERE id = '" . $_SESSION['id'] . "' AND profile_no = '".$_SESSION['profile']."'";
+	$stmt = $conn->prepare("SELECT area FROM profiles WHERE id = ? AND profile_no = ?");
+	$stmt->bind_param("si", $_SESSION['id'], $_SESSION['profile']);
 }
 
-$result = $conn->query($sql);
+$stmt->execute();
+$result = $stmt->get_result();
 
 while ($row = $result->fetch_assoc()) {
     $existing_area = $row['area'];
     $existing_area = json_decode($row['area']);
 }
+$stmt->close();
 
 echo "
     <div id='areas' class='areasform text-uppercase text-center'>
diff --git a/modal/distance_gyms_modal.php b/modal/distance_gyms_modal.php
index 4269884..fde084a 100644
--- a/modal/distance_gyms_modal.php
+++ b/modal/distance_gyms_modal.php
@@ -8,8 +8,10 @@
 </div>
 <!-- CHECK CURRENT DISTANCE SET -->
 <?php
-    $sql = "SELECT distance from gym WHERE id = '" . $_SESSION['id'] . "' GROUP by distance";
-    $result = $conn->query($sql);
+    $stmt = $conn->prepare("SELECT distance from gym WHERE id = ? GROUP by distance");
+    $stmt->bind_param("s", $_SESSION['id']);
+    $stmt->execute();
+    $result = $stmt->get_result();
     if (!empty($result) && $result->num_rows == 1) {
             while ($row = $result->fetch_assoc()) {
                     $distance_set = $row['distance'];
@@ -17,6 +19,7 @@
     } else {
             $distance_set = 0;
     }
+    $stmt->close();
 ?>
 <form action='./actions/gyms.php?action=update_gyms_distance' method='POST'>
 <div class="modal-body">
diff --git a/modal/distance_invasions_modal.php b/modal/distance_invasions_modal.php
index 93acee0..2dac5f4 100644
--- a/modal/distance_invasions_modal.php
+++ b/modal/distance_invasions_modal.php
@@ -8,8 +8,10 @@
 </div>
 <!-- CHECK CURRENT DISTANCE SET -->
 <?php
-    $sql = "SELECT distance from invasion WHERE id = '" . $_SESSION['id'] . "' GROUP by distance";
-    $result = $conn->query($sql);
+    $stmt = $conn->prepare("SELECT distance from invasion WHERE id = ? GROUP by distance");
+    $stmt->bind_param("s", $_SESSION['id']);
+    $stmt->execute();
+    $result = $stmt->get_result();
     if (!empty($result) && $result->num_rows == 1) {
             while ($row = $result->fetch_assoc()) {
                     $distance_set = $row['distance'];
@@ -17,6 +19,7 @@
     } else {
             $distance_set = 0;
     }
+    $stmt->close();
 ?>
 <form action='./actions/invasions.php?action=update_invasions_distance' method='POST'>
 <div class="modal-body">
diff --git a/modal/distance_lures_modal.php b/modal/distance_lures_modal.php
index e532d26..ad0cd62 100644
--- a/modal/distance_lures_modal.php
+++ b/modal/distance_lures_modal.php
@@ -8,8 +8,10 @@
 </div>
 <!-- CHECK CURRENT DISTANCE SET -->
 <?php
-    $sql = "SELECT distance from lures WHERE id = '" . $_SESSION['id'] . "' GROUP by distance";
-    $result = $conn->query($sql);
+    $stmt = $conn->prepare("SELECT distance from lures WHERE id = ? GROUP by distance");
+    $stmt->bind_param("s", $_SESSION['id']);
+    $stmt->execute();
+    $result = $stmt->get_result();
     if (!empty($result) && $result->num_rows == 1) {
             while ($row = $result->fetch_assoc()) {
                     $distance_set = $row['distance'];
@@ -17,6 +19,7 @@
     } else {
             $distance_set = 0;
     }
+    $stmt->close();
 ?>
 <form action='./actions/lures.php?action=update_lures_distance' method='POST'>
 <div class="modal-body">
diff --git a/modal/distance_nests_modal.php b/modal/distance_nests_modal.php
index 3dc9e41..545a6bc 100644
--- a/modal/distance_nests_modal.php
+++ b/modal/distance_nests_modal.php
@@ -8,8 +8,10 @@
 </div>
 <!-- CHECK CURRENT DISTANCE SET -->
 <?php
-    $sql = "SELECT distance from nests WHERE id = '" . $_SESSION['id'] . "' GROUP by distance";
-    $result = $conn->query($sql);
+    $stmt = $conn->prepare("SELECT distance from nests WHERE id = ? GROUP by distance");
+    $stmt->bind_param("s", $_SESSION['id']);
+    $stmt->execute();
+    $result = $stmt->get_result();
     if (!empty($result) && $result->num_rows == 1) {
             while ($row = $result->fetch_assoc()) {
                     $distance_set = $row['distance'];
@@ -17,6 +19,7 @@
     } else {
             $distance_set = 0;
     }
+    $stmt->close();
 ?>
 <form action='./actions/nests.php?action=update_nests_distance' method='POST'>
 <div class="modal-body">
diff --git a/modal/distance_pokemons_modal.php b/modal/distance_pokemons_modal.php
index a13118c..00de830 100644
--- a/modal/distance_pokemons_modal.php
+++ b/modal/distance_pokemons_modal.php
@@ -8,8 +8,10 @@
 </div>
 <!-- CHECK CURRENT DISTANCE SET -->
 <?php
-    $sql = "SELECT distance from monsters WHERE id = '" . $_SESSION['id'] . "' GROUP by distance";
-    $result = $conn->query($sql);
+    $stmt = $conn->prepare("SELECT distance from monsters WHERE id = ? GROUP by distance");
+    $stmt->bind_param("s", $_SESSION['id']);
+    $stmt->execute();
+    $result = $stmt->get_result();
     if ($result->num_rows == 1) {
             while ($row = $result->fetch_assoc()) {
                     $distance_set = $row['distance'];
@@ -17,6 +19,7 @@
     } else {
             $distance_set = 0;
     }
+    $stmt->close();
 ?>
 <form action='./actions/monsters.php?action=update_mons_distance' method='POST'>
 <div class="modal-body">
diff --git a/modal/distance_quests_modal.php b/modal/distance_quests_modal.php
index fc490c5..3ca06b1 100644
--- a/modal/distance_quests_modal.php
+++ b/modal/distance_quests_modal.php
@@ -8,8 +8,10 @@
 </div>
 <!-- CHECK CURRENT DISTANCE SET -->
 <?php
-    $sql = "SELECT distance from quest WHERE id = '" . $_SESSION['id'] . "' GROUP by distance";
-    $result = $conn->query($sql);
+    $stmt = $conn->prepare("SELECT distance from quest WHERE id = ? GROUP by distance");
+    $stmt->bind_param("s", $_SESSION['id']);
+    $stmt->execute();
+    $result = $stmt->get_result();
     if ($result->num_rows == 1) {
             while ($row = $result->fetch_assoc()) {
                     $distance_set = $row['distance'];
@@ -17,6 +19,7 @@
     } else {
             $distance_set = 0;
     }
+    $stmt->close();
 ?>
 <form action='./actions/quests.php?action=update_quests_distance' method='POST'>
 <div class="modal-body">
diff --git a/modal/distance_raids_modal.php b/modal/distance_raids_modal.php
index 5100c49..a07b9dd 100644
--- a/modal/distance_raids_modal.php
+++ b/modal/distance_raids_modal.php
@@ -8,9 +8,10 @@
 </div>
 <!-- CHECK CURRENT DISTANCE SET -->
 <?php
-    $sql = "SELECT distance from (SELECT distance,id from raid UNION SELECT distance,id from egg) raidegg
-            WHERE id = '" . $_SESSION['id'] . "' GROUP by distance";
-    $result = $conn->query($sql);
+    $stmt = $conn->prepare("SELECT distance from (SELECT distance,id from raid UNION SELECT distance,id from egg) raidegg WHERE id = ? GROUP by distance");
+    $stmt->bind_param("s", $_SESSION['id']);
+    $stmt->execute();
+    $result = $stmt->get_result();
     if ($result->num_rows == 1) {
             while ($row = $result->fetch_assoc()) {
                     $distance_set = $row['distance'];
@@ -18,6 +19,7 @@
     } else {
             $distance_set = 0;
     }
+    $stmt->close();
 ?>
 <form action='./actions/raids.php?action=update_raids_distance' method='POST'>
 <div class="modal-body">
diff --git a/modal/edit_profile_modal.php b/modal/edit_profile_modal.php
index 586fa48..9b33f70 100644
--- a/modal/edit_profile_modal.php
+++ b/modal/edit_profile_modal.php
@@ -25,13 +25,18 @@
 
             // Check Currently Active Profile
 
-            $sql = "SELECT current_profile_no FROM humans WHERE id = '" . $_SESSION['id'] . "'";
-            $result = $conn->query($sql);
+            $stmt = $conn->prepare("SELECT current_profile_no FROM humans WHERE id = ?");
+            $stmt->bind_param("s", $_SESSION['id']);
+            $stmt->execute();
+            $result = $stmt->get_result();
             while ($row = $result->fetch_assoc()) { $active_profile = $row['current_profile_no']; }
+            $stmt->close();
 
             // Check User's existing Profiles
-            $sql = "SELECT profile_no, name, area, latitude, longitude, active_hours FROM profiles WHERE id = '" . $_SESSION['id'] . "' ORDER BY profile_no";
-            $result = $conn->query($sql);
+            $stmt = $conn->prepare("SELECT profile_no, name, area, latitude, longitude, active_hours FROM profiles WHERE id = ? ORDER BY profile_no");
+            $stmt->bind_param("s", $_SESSION['id']);
+            $stmt->execute();
+            $result = $stmt->get_result();
             
             echo "<div id='profile' class='areasform text-uppercase text-center'>";
             echo "<form action='./actions/switch_profile.php' method='POST'>";
@@ -51,6 +56,7 @@
 
             echo "</ul>\n";
             echo "</div>";
+            $stmt->close();
 
             ?>
 
@@ -80,14 +86,17 @@
 	    <center>
             <form action='./actions/switch_profile.php' method='POST'>
             <?php
-	    $sql = "SELECT profile_no, name, area, latitude, longitude, active_hours FROM profiles WHERE id = '" . $_SESSION['id'] . "'";
-	    $result = $conn->query($sql);
+	    $stmt = $conn->prepare("SELECT profile_no, name, area, latitude, longitude, active_hours FROM profiles WHERE id = ?");
+	    $stmt->bind_param("s", $_SESSION['id']);
+	    $stmt->execute();
+	    $result = $stmt->get_result();
 	    if ( $result->num_rows == 0 ) {
 		    echo i8ln("You currently don't have any profile configured").".<br>";
 		    echo i8ln("Please Name default Profile");
 	    } else {
 		    echo i8ln("Choose the name of your new Profile");
 	    }
+	    $stmt->close();
             ?>
 
             </center>
diff --git a/pages/display/dashboard.php b/pages/display/dashboard.php
index da9d545..61c50eb 100644
--- a/pages/display/dashboard.php
+++ b/pages/display/dashboard.php
@@ -1,37 +1,61 @@
 
 <?php
 
-$sql = "select count(*) count FROM monsters WHERE id = '" . $_SESSION['id'] . "' AND profile_no = '" . $_SESSION['profile'] . "'";
-$result = $conn->query($sql);
+$stmt = $conn->prepare("SELECT count(*) count FROM monsters WHERE id = ? AND profile_no = ?");
+$stmt->bind_param("si", $_SESSION['id'], $_SESSION['profile']);
+$stmt->execute();
+$result = $stmt->get_result();
 while ($row = $result->fetch_assoc()) { $num_mon_tracked = $row['count']; }
+$stmt->close();
 
-$sql = "select count(*) count FROM raid WHERE id = '" . $_SESSION['id'] . "' AND profile_no = '" . $_SESSION['profile'] . "'";
-$result = $conn->query($sql);
+$stmt = $conn->prepare("SELECT count(*) count FROM raid WHERE id = ? AND profile_no = ?");
+$stmt->bind_param("si", $_SESSION['id'], $_SESSION['profile']);
+$stmt->execute();
+$result = $stmt->get_result();
 while ($row = $result->fetch_assoc()) { $num_raid_tracked = $row['count']; }
+$stmt->close();
 
-$sql = "select count(*) count FROM egg WHERE id = '" . $_SESSION['id'] . "' AND profile_no = '" . $_SESSION['profile'] . "'";
-$result = $conn->query($sql);
+$stmt = $conn->prepare("SELECT count(*) count FROM egg WHERE id = ? AND profile_no = ?");
+$stmt->bind_param("si", $_SESSION['id'], $_SESSION['profile']);
+$stmt->execute();
+$result = $stmt->get_result();
 while ($row = $result->fetch_assoc()) { $num_egg_tracked = $row['count']; }
+$stmt->close();
 
-$sql = "select count(*) count FROM quest WHERE id = '" . $_SESSION['id'] . "' AND profile_no = '" . $_SESSION['profile'] . "'";
-$result = $conn->query($sql);
+$stmt = $conn->prepare("SELECT count(*) count FROM quest WHERE id = ? AND profile_no = ?");
+$stmt->bind_param("si", $_SESSION['id'], $_SESSION['profile']);
+$stmt->execute();
+$result = $stmt->get_result();
 while ($row = $result->fetch_assoc()) { $num_quest_tracked = $row['count']; }
+$stmt->close();
 
-$sql = "select count(*) count FROM invasion WHERE id = '" . $_SESSION['id'] . "' AND profile_no = '" . $_SESSION['profile'] . "'";
-$result = $conn->query($sql);
+$stmt = $conn->prepare("SELECT count(*) count FROM invasion WHERE id = ? AND profile_no = ?");
+$stmt->bind_param("si", $_SESSION['id'], $_SESSION['profile']);
+$stmt->execute();
+$result = $stmt->get_result();
 while ($row = $result->fetch_assoc()) { $num_invasion_tracked = $row['count']; }
+$stmt->close();
 
-$sql = "select count(*) count FROM lures WHERE id = '" . $_SESSION['id'] . "' AND profile_no = '" . $_SESSION['profile'] . "'";
-$result = $conn->query($sql);
+$stmt = $conn->prepare("SELECT count(*) count FROM lures WHERE id = ? AND profile_no = ?");
+$stmt->bind_param("si", $_SESSION['id'], $_SESSION['profile']);
+$stmt->execute();
+$result = $stmt->get_result();
 while ($row = $result->fetch_assoc()) { $num_lure_tracked = $row['count']; }
+$stmt->close();
 
-$sql = "select count(*) count FROM nests WHERE id = '" . $_SESSION['id'] . "' AND profile_no = '" . $_SESSION['profile'] . "'";
-$result = $conn->query($sql);
+$stmt = $conn->prepare("SELECT count(*) count FROM nests WHERE id = ? AND profile_no = ?");
+$stmt->bind_param("si", $_SESSION['id'], $_SESSION['profile']);
+$stmt->execute();
+$result = $stmt->get_result();
 while ($row = $result->fetch_assoc()) { $num_nests_tracked = $row['count']; }
+$stmt->close();
 
-$sql = "select count(*) count FROM gym WHERE id = '" . $_SESSION['id'] . "' AND profile_no = '" . $_SESSION['profile'] . "'";
-$result = $conn->query($sql);
+$stmt = $conn->prepare("SELECT count(*) count FROM gym WHERE id = ? AND profile_no = ?");
+$stmt->bind_param("si", $_SESSION['id'], $_SESSION['profile']);
+$stmt->execute();
+$result = $stmt->get_result();
 while ($row = $result->fetch_assoc()) { $num_gyms_tracked = $row['count']; }
+$stmt->close();
 
 
 $num_areas=0;
diff --git a/pages/display/gym.php b/pages/display/gym.php
index 4a1ddeb..17ba74f 100644
--- a/pages/display/gym.php
+++ b/pages/display/gym.php
@@ -99,9 +99,11 @@ class="btn btn-danger"><?php echo i8ln("DELETE"); ?></a>
 
                                 // Show Gyms
 
-                                $sql = "SELECT * FROM gym WHERE id = '" . $_SESSION['id'] . "' and profile_no = '" . $_SESSION['profile'] . "'
-                                        ORDER BY team"; 
-				$result = $conn->query($sql);
+                                $sql = "SELECT * FROM gym WHERE id = ? AND profile_no = ? ORDER BY team";
+				$stmt = $conn->prepare($sql);
+				$stmt->bind_param("si", $_SESSION['id'], $_SESSION['profile']);
+				$stmt->execute();
+				$result = $stmt->get_result();
 
                                 if ($result->num_rows == 0) {
                                    echo "<div class='alert alert-warning w-100 m-3' role='alert'>";
@@ -284,7 +286,9 @@ class="list-group-item justify-content-between align-items-center">
                                 </div>
                             </div>
 
-                            <?php } ?>
+                            <?php }
+				$stmt->close();
+				?>
 
                         </div>
 
diff --git a/pages/display/invasion.php b/pages/display/invasion.php
index 8b25f5d..0f3178b 100644
--- a/pages/display/invasion.php
+++ b/pages/display/invasion.php
@@ -99,9 +99,11 @@ class="btn btn-danger"><?php echo i8ln("DELETE"); ?></a>
 
                                 // Show Invasions
 
-		                $sql = "SELECT * FROM invasion WHERE id = '" . $_SESSION['id'] . "' and profile_no = '" . $_SESSION['profile'] . "'  
-			                ORDER BY grunt_type";
-				$result = $conn->query($sql); 
+		                $sql = "SELECT * FROM invasion WHERE id = ? AND profile_no = ? ORDER BY grunt_type";
+				$stmt = $conn->prepare($sql);
+				$stmt->bind_param("si", $_SESSION['id'], $_SESSION['profile']);
+				$stmt->execute();
+				$result = $stmt->get_result(); 
 
                                 if ($result->num_rows == 0) {
                                    echo "<div class='alert alert-warning w-100 m-3' role='alert'>";
@@ -278,7 +280,9 @@ class="list-group-item justify-content-between align-items-center">
                                 </div>
                             </div>
 
-                            <?php } ?>
+                            <?php }
+				$stmt->close();
+				?>
 
                         </div>
 
diff --git a/pages/display/lure.php b/pages/display/lure.php
index b7ba389..1f7fd7c 100644
--- a/pages/display/lure.php
+++ b/pages/display/lure.php
@@ -99,9 +99,11 @@ class="btn btn-danger"><?php echo i8ln("DELETE"); ?></a>
 
                                 // Show Lures
 
-                                $sql = "SELECT * FROM lures WHERE id = '" . $_SESSION['id'] . "' and profile_no = '" . $_SESSION['profile'] . "'
-                                        ORDER BY lure_id";
-				$result = $conn->query($sql);
+                                $sql = "SELECT * FROM lures WHERE id = ? AND profile_no = ? ORDER BY lure_id";
+				$stmt = $conn->prepare($sql);
+				$stmt->bind_param("si", $_SESSION['id'], $_SESSION['profile']);
+				$stmt->execute();
+				$result = $stmt->get_result();
 
                                 if ($result->num_rows == 0) {
                                    echo "<div class='alert alert-warning w-100 m-3' role='alert'>";
@@ -261,7 +263,9 @@ class="list-group-item justify-content-between align-items-center">
                                 </div>
                             </div>
 
-                            <?php } ?>
+                            <?php }
+				$stmt->close();
+				?>
 
                         </div>
 
diff --git a/pages/display/nest.php b/pages/display/nest.php
index 84ae800..7b4b7ef 100644
--- a/pages/display/nest.php
+++ b/pages/display/nest.php
@@ -99,9 +99,11 @@ class="btn btn-danger"><?php echo i8ln("DELETE"); ?></a>
 
                                 // Show Nests
 
-                                $sql = "SELECT * FROM nests WHERE id = '" . $_SESSION['id'] . "' and profile_no = '" . $_SESSION['profile'] . "'
-                                        ORDER BY pokemon_id";
-				$result = $conn->query($sql);
+                                $sql = "SELECT * FROM nests WHERE id = ? AND profile_no = ? ORDER BY pokemon_id";
+				$stmt = $conn->prepare($sql);
+				$stmt->bind_param("si", $_SESSION['id'], $_SESSION['profile']);
+				$stmt->execute();
+				$result = $stmt->get_result();
 
                                 if ($result->num_rows == 0) {
                                    echo "<div class='alert alert-warning w-100 m-3' role='alert'>";
@@ -291,7 +293,9 @@ class="list-group-item justify-content-between align-items-center">
                                 </div>
                             </div>
 
-                            <?php } ?>
+                            <?php }
+				$stmt->close();
+				?>
 
                         </div>
 
diff --git a/pages/display/pokemon.php b/pages/display/pokemon.php
index 5feb85f..3aa289e 100644
--- a/pages/display/pokemon.php
+++ b/pages/display/pokemon.php
@@ -1,61 +1,48 @@
 
 <?php
 
+// SECURITY NOTE: Search functionality uses dynamic IN clauses from get_matching_ids() which parses
+// JSON Pokemon data. We validate these as integers below for safety. The remaining SQL uses prepared
+// statements for session variables ($_SESSION['id'] and $_SESSION['profile']) for defense in depth.
 
 if ( isset($_POST['search']) ) { $_SESSION['search'] = $_POST['search']; unset($_POST['search']); }
 
+$search_sql = "";
 if ( !empty($_SESSION['search']) )
 {
 	$matching_ids = get_matching_ids($_SESSION['search']);
-	$matching_ids = implode(',', $matching_ids);
-	$search_sql = "AND pokemon_id in ( $matching_ids )";
+	// Validate and cast to integers (get_matching_ids returns Pokemon IDs from JSON)
+	$matching_ids = array_filter($matching_ids, 'is_numeric');
+	$matching_ids = array_map('intval', $matching_ids);
+	if (!empty($matching_ids)) {
+		$matching_ids_str = implode(',', $matching_ids);
+		$search_sql = "AND pokemon_id IN ($matching_ids_str)";
+	}
 }
 
-$sql_base = "select count(*) count 
-             FROM monsters 
-	     WHERE id = '" . $_SESSION['id'] . "' 
-             ".@$search_sql."
-             AND profile_no = '" . $_SESSION['profile'] . "' "; 
-
-$sql = $sql_base."AND pokemon_id =0";
-$result = $conn->query($sql);
-while ($row = $result->fetch_assoc()) { $genall = $row['count']; }
-
-$sql = $sql_base."AND pokemon_id between 1 and 151";
-$result = $conn->query($sql);
-while ($row = $result->fetch_assoc()) { $gen1 = $row['count']; }
-
-$sql = $sql_base."AND pokemon_id between 152 and 251";
-$result = $conn->query($sql);
-while ($row = $result->fetch_assoc()) { $gen2 = $row['count']; }
-
-$sql = $sql_base."AND pokemon_id between 252 and 386";
-$result = $conn->query($sql);
-while ($row = $result->fetch_assoc()) { $gen3 = $row['count']; }
-
-$sql = $sql_base."AND pokemon_id between 387 and 493";
-$result = $conn->query($sql);
-while ($row = $result->fetch_assoc()) { $gen4 = $row['count']; }
-
-$sql = $sql_base."AND pokemon_id between 494 and 649";
-$result = $conn->query($sql);
-while ($row = $result->fetch_assoc()) { $gen5 = $row['count']; }
-
-$sql = $sql_base."AND pokemon_id between 650 and 721";
-$result = $conn->query($sql);
-while ($row = $result->fetch_assoc()) { $gen6 = $row['count']; }
-
-$sql = $sql_base."AND pokemon_id between 722 and 809";
-$result = $conn->query($sql);
-while ($row = $result->fetch_assoc()) { $gen7 = $row['count']; }
-
-$sql = $sql_base."AND pokemon_id between 810 and 905";
-$result = $conn->query($sql);
-while ($row = $result->fetch_assoc()) { $gen8 = $row['count']; }
+// Helper function to execute count queries with prepared statements
+function execute_count_query($conn, $session_id, $profile, $search_sql, $additional_condition) {
+	$sql = "SELECT count(*) count FROM monsters WHERE id = ? ".$search_sql." AND profile_no = ? ".$additional_condition;
+	$stmt = $conn->prepare($sql);
+	$stmt->bind_param("si", $session_id, $profile);
+	$stmt->execute();
+	$result = $stmt->get_result();
+	$count = 0;
+	while ($row = $result->fetch_assoc()) { $count = $row['count']; }
+	$stmt->close();
+	return $count;
+}
 
-$sql = $sql_base."AND pokemon_id >= 906";
-$result = $conn->query($sql);
-while ($row = $result->fetch_assoc()) { $gen9 = $row['count']; }
+$genall = execute_count_query($conn, $_SESSION['id'], $_SESSION['profile'], $search_sql, "AND pokemon_id = 0");
+$gen1 = execute_count_query($conn, $_SESSION['id'], $_SESSION['profile'], $search_sql, "AND pokemon_id BETWEEN 1 AND 151");
+$gen2 = execute_count_query($conn, $_SESSION['id'], $_SESSION['profile'], $search_sql, "AND pokemon_id BETWEEN 152 AND 251");
+$gen3 = execute_count_query($conn, $_SESSION['id'], $_SESSION['profile'], $search_sql, "AND pokemon_id BETWEEN 252 AND 386");
+$gen4 = execute_count_query($conn, $_SESSION['id'], $_SESSION['profile'], $search_sql, "AND pokemon_id BETWEEN 387 AND 493");
+$gen5 = execute_count_query($conn, $_SESSION['id'], $_SESSION['profile'], $search_sql, "AND pokemon_id BETWEEN 494 AND 649");
+$gen6 = execute_count_query($conn, $_SESSION['id'], $_SESSION['profile'], $search_sql, "AND pokemon_id BETWEEN 650 AND 721");
+$gen7 = execute_count_query($conn, $_SESSION['id'], $_SESSION['profile'], $search_sql, "AND pokemon_id BETWEEN 722 AND 809");
+$gen8 = execute_count_query($conn, $_SESSION['id'], $_SESSION['profile'], $search_sql, "AND pokemon_id BETWEEN 810 AND 905");
+$gen9 = execute_count_query($conn, $_SESSION['id'], $_SESSION['profile'], $search_sql, "AND pokemon_id >= 906");
 
 ?>
 
@@ -185,17 +172,18 @@ class="btn btn-danger"><?php echo i8ln("DELETE"); ?></a>
 
                         ?>
                         
-                        <?php 
+                        <?php
 
                         // Count Trackings
-                        $sql = "select * FROM monsters 
-					 WHERE id = '" . $_SESSION['id'] . "' 
-                                         ".@$search_sql."
-                                         AND profile_no = '" . $_SESSION['profile'] . "'";
-                        $result = $conn->query($sql);
+                        $sql = "SELECT * FROM monsters WHERE id = ? ".$search_sql." AND profile_no = ?";
+                        $stmt = $conn->prepare($sql);
+                        $stmt->bind_param("si", $_SESSION['id'], $_SESSION['profile']);
+                        $stmt->execute();
+                        $result = $stmt->get_result();
 
 			// Show ALL Mons if less than 50 trackings
 			if ( $result->num_rows <= 50 ) { $gen_selector = ""; }
+			$stmt->close();
 
                         // Only Show Gen Selector if More than 50 trackings
                         if ( $result->num_rows > 50 ) {
@@ -240,24 +228,15 @@ class="btn btn-danger"><?php echo i8ln("DELETE"); ?></a>
 
                                 // Check if User is already tracking something
 
-				$sql = "select count(*) count 
-					FROM monsters 
-					WHERE id = '" . $_SESSION['id'] . "' 
-                                        ".@$search_sql."
-                                        AND profile_no = '" . $_SESSION['profile'] . "'";
-                                $result = $conn->query($sql);
-				while ($row = $result->fetch_assoc()) {
-					$num_mon_tracked = $row['count'];
-				}
-
-                                // Show Monsters Alarms         
-
-				$sql = "select * FROM monsters 
-					WHERE id = '" . $_SESSION['id'] . "' 
-                                        ".@$search_sql."
-                                        AND profile_no = '" . $_SESSION['profile'] . "' " . @$gen_selector ." 
-					ORDER BY pokemon_id, form"; 
-                                $result = $conn->query($sql);
+				$num_mon_tracked = execute_count_query($conn, $_SESSION['id'], $_SESSION['profile'], $search_sql, "");
+
+                                // Show Monsters Alarms
+
+				$sql = "SELECT * FROM monsters WHERE id = ? ".$search_sql." AND profile_no = ? ".@$gen_selector." ORDER BY pokemon_id, form";
+				$stmt = $conn->prepare($sql);
+				$stmt->bind_param("si", $_SESSION['id'], $_SESSION['profile']);
+				$stmt->execute();
+                                $result = $stmt->get_result();
 				if ($num_mon_tracked == 0) {
                                    echo "<div class='alert alert-warning w-100 m-3' role='alert'>";
                                    echo i8ln("You have not set any Alarm yet!");
@@ -594,6 +573,7 @@ class="badge badge-pill badge-info w-100"><?php echo i8ln("Cleaning Activated");
 
                             <?php
                                 }
+				$stmt->close();
                                 ?>
                         </div>
                         <!-- Content Row -->
diff --git a/pages/display/poracle_api.php b/pages/display/poracle_api.php
index 6915168..5bcbcb0 100644
--- a/pages/display/poracle_api.php
+++ b/pages/display/poracle_api.php
@@ -233,15 +233,19 @@
 
                 <?php
 
-                foreach($_SESSION['poracle_admins'] as $key => $padmin) { 
+                foreach($_SESSION['poracle_admins'] as $key => $padmin) {
 
-                   $sql = "select type, name FROM humans where id = '$padmin'";
-                   $result = $conn->query($sql);
+                   $sql = "SELECT type, name FROM humans WHERE id = ?";
+                   $stmt = $conn->prepare($sql);
+                   $stmt->bind_param("s", $padmin);
+                   $stmt->execute();
+                   $result = $stmt->get_result();
 
 		   while ($row = $result->fetch_assoc()) {
                       if ($row['type'] == "discord:user") { $color="primary"; } else if ($row['type'] == "telegram:user") { $color="info"; }
                       echo "<span class='badge badge-$color' style='width:100%;'>".$row['type']." | ".$padmin." | ".$row['name']."</span><br>";
                    }
+		   $stmt->close();
 
 		}
 
diff --git a/pages/display/quest.php b/pages/display/quest.php
index 900b4bc..5486a98 100644
--- a/pages/display/quest.php
+++ b/pages/display/quest.php
@@ -100,18 +100,24 @@ class="btn btn-danger"><?php echo i8ln("DELETE"); ?></a>
 
                                 // Show Quests
 
-				$sql = "select * FROM quest WHERE id = '" . $_SESSION['id'] . "' and profile_no = '" . $_SESSION['profile'] . "'";
-				$result = $conn->query($sql); 
+				$sql = "SELECT * FROM quest WHERE id = ? AND profile_no = ?";
+				$stmt = $conn->prepare($sql);
+				$stmt->bind_param("si", $_SESSION['id'], $_SESSION['profile']);
+				$stmt->execute();
+				$result = $stmt->get_result();
 
 				if ($result->num_rows == 0) {
                                    echo "<div class='alert alert-warning w-100 m-3' role='alert'>";
                                    echo i8ln("You have not set any Alarm yet!");
                                    echo "</div>";
 				}
+				$stmt->close();
 
-                                $sql = "select * FROM quest WHERE id = '" . $_SESSION['id'] . "' and profile_no = '" . $_SESSION['profile'] . "'
-                                        AND reward_type = 7 ORDER BY reward";
-                                $result = $conn->query($sql);
+                                $sql = "SELECT * FROM quest WHERE id = ? AND profile_no = ? AND reward_type = 7 ORDER BY reward";
+				$stmt = $conn->prepare($sql);
+				$stmt->bind_param("si", $_SESSION['id'], $_SESSION['profile']);
+				$stmt->execute();
+                                $result = $stmt->get_result();
 
                                 while ($row = $result->fetch_assoc()) {
 
@@ -272,10 +278,13 @@ class="badge badge-pill badge-info w-100"><?php echo i8ln("Cleaning Activated");
 
                             <?php
                                 }
+				$stmt->close();
 
-				$sql = "select * FROM quest WHERE id = '" . $_SESSION['id'] . "' and profile_no = '" . $_SESSION['profile'] . "' 
-					AND reward_type = 2 ORDER BY reward";
-                                $result = $conn->query($sql);
+				$sql = "SELECT * FROM quest WHERE id = ? AND profile_no = ? AND reward_type = 2 ORDER BY reward";
+				$stmt = $conn->prepare($sql);
+				$stmt->bind_param("si", $_SESSION['id'], $_SESSION['profile']);
+				$stmt->execute();
+                                $result = $stmt->get_result();
 
                                 while ($row = $result->fetch_assoc()) {
 
@@ -418,10 +427,13 @@ class="badge badge-pill badge-info w-100"><?php echo i8ln("Cleaning Activated");
 
                             <?php
                                 }
+				$stmt->close();
 
-				$sql = "select * FROM quest WHERE id = '" . $_SESSION['id'] . "' and profile_no = '" . $_SESSION['profile'] . "'  
-					AND reward_type = 12 ORDER BY reward";
-                                $result = $conn->query($sql);
+				$sql = "SELECT * FROM quest WHERE id = ? AND profile_no = ? AND reward_type = 12 ORDER BY reward";
+				$stmt = $conn->prepare($sql);
+				$stmt->bind_param("si", $_SESSION['id'], $_SESSION['profile']);
+				$stmt->execute();
+                                $result = $stmt->get_result();
 
                                 while ($row = $result->fetch_assoc()) {
 
@@ -565,12 +577,15 @@ class="badge badge-pill badge-info w-100"><?php echo i8ln("Cleaning Activated");
                                     </div>
                                 </div>
                             </div>
-                            <?php } 
+                            <?php }
+				$stmt->close();
 
 
-				$sql = "select * FROM quest WHERE id = '" . $_SESSION['id'] . "' and profile_no = '" . $_SESSION['profile'] . "'  
-					AND reward_type = 4 ORDER BY reward";
-                                $result = $conn->query($sql);
+				$sql = "SELECT * FROM quest WHERE id = ? AND profile_no = ? AND reward_type = 4 ORDER BY reward";
+				$stmt = $conn->prepare($sql);
+				$stmt->bind_param("si", $_SESSION['id'], $_SESSION['profile']);
+				$stmt->execute();
+                                $result = $stmt->get_result();
 
                                 while ($row = $result->fetch_assoc()) {
 
@@ -716,7 +731,9 @@ class="badge badge-pill badge-info w-100"><?php echo i8ln("Cleaning Activated");
                                     </div>
                                 </div>
                             </div>
-                            <?php } ?>
+                            <?php }
+				$stmt->close();
+				?>
 
 
                         </div>
diff --git a/pages/display/quick_pick.php b/pages/display/quick_pick.php
index 3eb18c5..1c5b76f 100644
--- a/pages/display/quick_pick.php
+++ b/pages/display/quick_pick.php
@@ -1,17 +1,25 @@
 
 <?php
 
-   $sql = "select min(clean) clean FROM monsters WHERE id = '" . $_SESSION['id'] . "' AND profile_no = '" . $_SESSION['profile'] . "'";
-   $result = $conn->query($sql);
+   $sql = "SELECT min(clean) clean FROM monsters WHERE id = ? AND profile_no = ?";
+   $stmt = $conn->prepare($sql);
+   $stmt->bind_param("si", $_SESSION['id'], $_SESSION['profile']);
+   $stmt->execute();
+   $result = $stmt->get_result();
    while ($row = $result->fetch_assoc()) {
        $mon_cleaned = $row['clean'];
    }
+   $stmt->close();
 
-   $sql = "select min(distance) distance FROM monsters WHERE id = '" . $_SESSION['id'] . "' AND profile_no = '" . $_SESSION['profile'] . "'";
-   $result = $conn->query($sql);
+   $sql = "SELECT min(distance) distance FROM monsters WHERE id = ? AND profile_no = ?";
+   $stmt = $conn->prepare($sql);
+   $stmt->bind_param("si", $_SESSION['id'], $_SESSION['profile']);
+   $stmt->execute();
+   $result = $stmt->get_result();
    while ($row = $result->fetch_assoc()) {
        $mon_distance = $row['distance'];
    }
+   $stmt->close();
 
 
 ?>
@@ -44,15 +52,19 @@
                                 <div class="row d-flex justify-content-between align-items-center pl-3 pr-3">
 
                                 <?php
-                                   
-                                   $sql = "select uid FROM monsters WHERE min_iv = 100 AND pokemon_id = 0 AND id = '" . $_SESSION['id'] . "' AND profile_no = '" . $_SESSION['profile'] . "'";
-                                   $result = $conn->query($sql);
+
+                                   $sql = "SELECT uid FROM monsters WHERE min_iv = 100 AND pokemon_id = 0 AND id = ? AND profile_no = ?";
+                                   $stmt = $conn->prepare($sql);
+                                   $stmt->bind_param("si", $_SESSION['id'], $_SESSION['profile']);
+                                   $stmt->execute();
+                                   $result = $stmt->get_result();
 				   if ( $result->num_rows > 0 ) { $found = 1; $style = "background:#1cc88a; color:white;"; } else { $found = ""; $style = ""; }
-                                   
+
                                    while ($row = $result->fetch_assoc()) {
 					   $uid = $row['uid'];
-                                   } 
-                                   
+                                   }
+				   $stmt->close();
+
                                 ?>
 
                                 <form action='./actions/quick_pick.php' method='POST' class="w-100">
@@ -82,13 +94,17 @@
 
                                 <?php
 
-                                   $sql = "select uid FROM monsters WHERE min_iv = 0 AND max_iv = 0 AND pokemon_id = 0 AND id = '" . $_SESSION['id'] . "' AND profile_no = '" . $_SESSION['profile'] . "'";
-                                   $result = $conn->query($sql);
+                                   $sql = "SELECT uid FROM monsters WHERE min_iv = 0 AND max_iv = 0 AND pokemon_id = 0 AND id = ? AND profile_no = ?";
+                                   $stmt = $conn->prepare($sql);
+                                   $stmt->bind_param("si", $_SESSION['id'], $_SESSION['profile']);
+                                   $stmt->execute();
+                                   $result = $stmt->get_result();
                                    if ( $result->num_rows > 0 ) { $found = 1; $style = "background:#1cc88a; color:white;"; } else { $found = ""; $style = ""; }
 
                                    while ($row = $result->fetch_assoc()) {
                                            $uid = $row['uid'];
                                    }
+				   $stmt->close();
 
                                 ?>
 
@@ -119,13 +135,17 @@
                                 </form>
 
                                 <?php
-                                   $sql = "select uid FROM monsters WHERE pokemon_id = 0 AND pvp_ranking_league = 500 AND pvp_ranking_worst = 1 AND id = '" . $_SESSION['id'] . "' AND profile_no = '" . $_SESSION['profile'] . "'";
-                                   $result = $conn->query($sql);
+                                   $sql = "SELECT uid FROM monsters WHERE pokemon_id = 0 AND pvp_ranking_league = 500 AND pvp_ranking_worst = 1 AND id = ? AND profile_no = ?";
+                                   $stmt = $conn->prepare($sql);
+                                   $stmt->bind_param("si", $_SESSION['id'], $_SESSION['profile']);
+                                   $stmt->execute();
+                                   $result = $stmt->get_result();
                                    if ( $result->num_rows > 0 ) { $found = 1; $style = "background:#1cc88a; color:white;"; } else { $found = ""; $style = ""; }
 
                                    while ($row = $result->fetch_assoc()) {
                                            $uid = $row['uid'];
                                    }
+				   $stmt->close();
                                 ?>
 
                                 <form action='./actions/quick_pick.php' method='POST' class="w-100">
@@ -155,13 +175,17 @@
                                 </form>
 
                                 <?php
-                                   $sql = "select uid FROM monsters WHERE pokemon_id = 0 AND pvp_ranking_league = 1500 AND pvp_ranking_worst = 1 AND id = '" . $_SESSION['id'] . "' AND profile_no = '" . $_SESSION['profile'] . "'";
-                                   $result = $conn->query($sql);
+                                   $sql = "SELECT uid FROM monsters WHERE pokemon_id = 0 AND pvp_ranking_league = 1500 AND pvp_ranking_worst = 1 AND id = ? AND profile_no = ?";
+                                   $stmt = $conn->prepare($sql);
+                                   $stmt->bind_param("si", $_SESSION['id'], $_SESSION['profile']);
+                                   $stmt->execute();
+                                   $result = $stmt->get_result();
                                    if ( $result->num_rows > 0 ) { $found = 1; $style = "background:#1cc88a; color:white;"; } else { $found = ""; $style = ""; }
 
                                    while ($row = $result->fetch_assoc()) {
                                            $uid = $row['uid'];
                                    }
+				   $stmt->close();
                                 ?>
 
                                 <form action='./actions/quick_pick.php' method='POST' class="w-100">
@@ -191,13 +215,17 @@
                                 </form>
 
                                 <?php
-                                   $sql = "select uid FROM monsters WHERE pokemon_id = 0 AND pvp_ranking_league = 2500 AND pvp_ranking_worst = 1 AND id = '" . $_SESSION['id'] . "' AND profile_no = '" . $_SESSION['profile'] . "'";
-                                   $result = $conn->query($sql);
+                                   $sql = "SELECT uid FROM monsters WHERE pokemon_id = 0 AND pvp_ranking_league = 2500 AND pvp_ranking_worst = 1 AND id = ? AND profile_no = ?";
+                                   $stmt = $conn->prepare($sql);
+                                   $stmt->bind_param("si", $_SESSION['id'], $_SESSION['profile']);
+                                   $stmt->execute();
+                                   $result = $stmt->get_result();
                                    if ( $result->num_rows > 0 ) { $found = 1; $style = "background:#1cc88a; color:white;"; } else { $found = ""; $style = ""; }
 
                                    while ($row = $result->fetch_assoc()) {
                                            $uid = $row['uid'];
                                    }
+				   $stmt->close();
                                 ?>
 
                                 <form action='./actions/quick_pick.php' method='POST' class="w-100">
@@ -250,13 +278,17 @@
 				<div class="row d-flex justify-content-between align-items-center pl-3 pr-3">
 
                                 <?php
-                                   $sql = "select uid FROM monsters WHERE pokemon_id = 129 AND min_weight = 13130 AND id = '" . $_SESSION['id'] . "' AND profile_no = '" . $_SESSION['profile'] . "'";
-                                   $result = $conn->query($sql);
+                                   $sql = "SELECT uid FROM monsters WHERE pokemon_id = 129 AND min_weight = 13130 AND id = ? AND profile_no = ?";
+                                   $stmt = $conn->prepare($sql);
+                                   $stmt->bind_param("si", $_SESSION['id'], $_SESSION['profile']);
+                                   $stmt->execute();
+                                   $result = $stmt->get_result();
                                    if ( $result->num_rows > 0 ) { $found = 1; $style = "background:#1cc88a; color:white;"; } else { $found = ""; $style = ""; }
 
                                    while ($row = $result->fetch_assoc()) {
                                            $uid = $row['uid'];
                                    }
+				   $stmt->close();
                                 ?>
 
                                 <form action='./actions/quick_pick.php' method='POST' class="w-100">
@@ -289,13 +321,17 @@
                                 </form>
 
                                 <?php
-                                   $sql = "select uid FROM monsters WHERE pokemon_id = 19 AND max_weight = 2410 AND id = '" . $_SESSION['id'] . "' AND profile_no = '" . $_SESSION['profile'] . "'";
-                                   $result = $conn->query($sql);
+                                   $sql = "SELECT uid FROM monsters WHERE pokemon_id = 19 AND max_weight = 2410 AND id = ? AND profile_no = ?";
+                                   $stmt = $conn->prepare($sql);
+                                   $stmt->bind_param("si", $_SESSION['id'], $_SESSION['profile']);
+                                   $stmt->execute();
+                                   $result = $stmt->get_result();
                                    if ( $result->num_rows > 0 ) { $found = 1; $style = "background:#1cc88a; color:white;"; } else { $found = ""; $style = ""; }
 
                                    while ($row = $result->fetch_assoc()) {
                                            $uid = $row['uid'];
                                    }
+				   $stmt->close();
                                 ?>
 
                                 <form action='./actions/quick_pick.php' method='POST' class="w-100">
@@ -349,13 +385,17 @@
                                 <div class="row d-flex justify-content-between align-items-center pl-3 pr-3">
 
                                 <?php
-                                   $sql = "select uid FROM monsters WHERE size = 1 AND max_size = 1 AND pokemon_id = 0 AND id = '" . $_SESSION['id'] . "' AND profile_no = '" . $_SESSION['profile'] . "'";
-                                   $result = $conn->query($sql);
+                                   $sql = "SELECT uid FROM monsters WHERE size = 1 AND max_size = 1 AND pokemon_id = 0 AND id = ? AND profile_no = ?";
+                                   $stmt = $conn->prepare($sql);
+                                   $stmt->bind_param("si", $_SESSION['id'], $_SESSION['profile']);
+                                   $stmt->execute();
+                                   $result = $stmt->get_result();
                                    if ( $result->num_rows > 0 ) { $found = 1; $style = "background:#1cc88a; color:white;"; } else { $found = ""; $style = ""; }
 
                                    while ($row = $result->fetch_assoc()) {
                                            $uid = $row['uid'];
                                    }
+				   $stmt->close();
                                 ?>
 
                                 <form action='./actions/quick_pick.php' method='POST' class="w-100">
@@ -389,13 +429,17 @@
                                 </form>
 
                                 <?php
-                                   $sql = "select uid FROM monsters WHERE size = 5 AND pokemon_id = 0 AND id = '" . $_SESSION['id'] . "' AND profile_no = '" . $_SESSION['profile'] . "'";
-                                   $result = $conn->query($sql);
+                                   $sql = "SELECT uid FROM monsters WHERE size = 5 AND pokemon_id = 0 AND id = ? AND profile_no = ?";
+                                   $stmt = $conn->prepare($sql);
+                                   $stmt->bind_param("si", $_SESSION['id'], $_SESSION['profile']);
+                                   $stmt->execute();
+                                   $result = $stmt->get_result();
                                    if ( $result->num_rows > 0 ) { $found = 1; $style = "background:#1cc88a; color:white;"; } else { $found = ""; $style = ""; }
 
                                    while ($row = $result->fetch_assoc()) {
                                            $uid = $row['uid'];
                                    }
+				   $stmt->close();
                                 ?>
 
                                 <form action='./actions/quick_pick.php' method='POST' class="w-100">
diff --git a/pages/display/raid.php b/pages/display/raid.php
index 6f9a17e..7eefb52 100644
--- a/pages/display/raid.php
+++ b/pages/display/raid.php
@@ -102,8 +102,11 @@ class="btn btn-danger"><?php echo i8ln("DELETE"); ?></a>
 
                                 // Show Eggs & Raids
 
-                                $sql = "select * FROM egg WHERE id = '" . $_SESSION['id'] . "' AND profile_no = '" . $_SESSION['profile'] . "' ORDER BY level";
-                                $result = $conn->query($sql);
+                                $sql = "SELECT * FROM egg WHERE id = ? AND profile_no = ? ORDER BY level";
+                                $stmt = $conn->prepare($sql);
+                                $stmt->bind_param("si", $_SESSION['id'], $_SESSION['profile']);
+                                $stmt->execute();
+                                $result = $stmt->get_result();
 
                                 while ($row = $result->fetch_assoc()) {
 
@@ -286,10 +289,13 @@ class="badge badge-pill badge-info w-100"><?php echo i8ln("Cleaning Activated");
 
                             <?php
                                 }
+				$stmt->close();
 
-				$sql = "select * FROM raid WHERE id = '" . $_SESSION['id'] . "' AND profile_no = '" . $_SESSION['profile'] . "' 
-					AND pokemon_id = 9000 ORDER BY level";
-                                $result = $conn->query($sql);
+				$sql = "SELECT * FROM raid WHERE id = ? AND profile_no = ? AND pokemon_id = 9000 ORDER BY level";
+				$stmt = $conn->prepare($sql);
+				$stmt->bind_param("si", $_SESSION['id'], $_SESSION['profile']);
+				$stmt->execute();
+                                $result = $stmt->get_result();
 
                                 while ($row = $result->fetch_assoc()) {
 
@@ -462,10 +468,13 @@ class="badge badge-pill badge-info w-100"><?php echo i8ln("Cleaning Activated");
                             </div>
                             <?php
                                 }
+				$stmt->close();
 
-				$sql = "select * FROM raid WHERE id = '" . $_SESSION['id'] . "' and profile_no = '" . $_SESSION['profile'] . "'  
-					AND pokemon_id <> 9000 ORDER BY pokemon_id";
-                                $result = $conn->query($sql);
+				$sql = "SELECT * FROM raid WHERE id = ? AND profile_no = ? AND pokemon_id <> 9000 ORDER BY pokemon_id";
+				$stmt = $conn->prepare($sql);
+				$stmt->bind_param("si", $_SESSION['id'], $_SESSION['profile']);
+				$stmt->execute();
+                                $result = $stmt->get_result();
 
                                 while ($row = $result->fetch_assoc()) {
 
@@ -649,6 +658,7 @@ class="badge badge-pill badge-info w-100"><?php echo i8ln("Cleaning Activated");
                             </div>
                             <?php
                                 }
+				$stmt->close();
                                 ?>
 
                         </div>
diff --git a/session.php b/session.php
index b4a2152..22da6e0 100644
--- a/session.php
+++ b/session.php
@@ -19,12 +19,15 @@
       exit();
    }
 
-   $sql = "SELECT * from humans WHERE id = '".$_SESSION['id']."'";
-   $result = $conn->query($sql) or die(mysqli_error($conn));
+   $stmt = $conn->prepare("SELECT * from humans WHERE id = ?");
+   $stmt->bind_param("s", $_SESSION['id']);
+   $stmt->execute() or die(mysqli_error($conn));
+   $result = $stmt->get_result();
 
    if ( $result->num_rows > 0 ) {
 	  $_SESSION['dbname'] = $db;
    }
+   $stmt->close();
 
 }