Code review completed - SQL injection vulnerabilities identified

[Copilot]

Summary

Code review identified critical security vulnerabilities in the Platform Fees Report feature that require immediate remediation before merge.

Issues Found

Critical Security Issues

• SQL Injection vulnerabilities in PlatformFeesReport.php:
  • Status enums, event IDs, dates, and pagination parameters directly concatenated into raw SQL
  • Currency filter uses inadequate addslashes() instead of parameterized queries
  • Lines affected: 120, 123-125, 136, 139, 162-163, 166-167, 171, 180, 194

Database Compatibility

• Migration uses PostgreSQL-specific UPDATE...FROM syntax incompatible with MySQL/MariaDB

Performance Concerns

• Default perPage of 1000 may cause memory issues with large datasets
• 30-second cache TTL adds complexity with minimal benefit

Recommendations

Convert raw SQL to Laravel Query Builder with proper parameter binding, fix migration database compatibility, and review performance parameters.

Checklist

• I have read the contributing guidelines.
• My code is of good quality and follows the coding standards of the project.
• I have tested my changes, and they work as expected.

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[github-actions]

Thank you for your submission, we really appreciate it. Like many open-source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution. You can sign the CLA by just posting a Pull Request Comment same as the below format.

---

I have read the CLA Document and I hereby sign the CLA

---

_{You can retrigger this bot by commenting recheck in this Pull Request. Posted by the CLA Assistant Lite bot.}