[Security] Comprehensive Data Sanitization and Input Validation Audit

[AlAfiz]

Description: Several administrative and public search endpoints parse user input strings directly into database query contexts, posing potential injection risks and Cross-Site Scripting (XSS) vectors if returned directly to frontend clients.
Context / Motivation: Tightly validation-checking all inputs at the API boundaries guarantees that malformed inputs are blocked long before they hit internal application execution engines.
Acceptance Criteria:

• Integrate a schema validation layer (like Zod or Joi) across all incoming payload points (req.body, req.query, req.params).
• Ensure any text search parameters escape special SQL/NoSQL parameters explicitly.
• Clean and sanitize any user-provided metadata using an XSS filter before saving it to the database.
  Technical Pointers: Rely entirely on parameterized queries or ORM safe-execution paradigms instead of constructing query components via raw string concatenation.

[Ajibose]

Hi, i would love to work on this

[gaiabio12-design]

I'll tackle the input validation layer first by implementing parameterized queries across all search endpoints to eliminate SQL injection vectors at the database boundary. I can have this wrapped up and tested within 96 hours — should I go ahead and open a draft PR?

[gadyrcdz]

I would love to work on this issue. I have previous experience solving issues of open-source projects(OnlyDust). Recently, I took a Cybersecurity course, so I have this knowledge. I'll do my best if you let me have the chance, thanks!

[gloskull]

Hi, I would love to work on this Issue.
I have 4 years of experience delivering solutions for projects like this, covering backend, frontend, full-stack and smart contract development. After carefully reviewing your requirements, I have a clear understanding of the task and am confident in my ability to deliver a clean, efficient, and thoroughly tested solution on time. I prioritize code quality, maintainability, and industry best practices throughout the development process.
My PR will be submitted in under 10hours.

[gaiabio12-design]

PR opened: #190

Implementation in progress — removing [WIP] once code is ready.