From b6597a4a6e4bb3c9475f212e16c6eee16ff71a35 Mon Sep 17 00:00:00 2001
From: jwinterm <johnwmurphy@gmail.com>
Date: Wed, 18 Feb 2026 20:59:28 -0500
Subject: [PATCH] fix db query

---
 src/db/databaseManager.js | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/src/db/databaseManager.js b/src/db/databaseManager.js
index b349773..480aa54 100644
--- a/src/db/databaseManager.js
+++ b/src/db/databaseManager.js
@@ -20,7 +20,10 @@ class QueryValidator {
 
     isSafe(text, params) {
         // Check if using parameterized query properly
-        const placeholderCount = (text.match(/\$\d+/g) || []).length;
+        // Count unique placeholders ($1, $2, etc.) — PostgreSQL allows reusing $1 multiple times
+        const placeholders = text.match(/\$\d+/g) || [];
+        const uniquePlaceholders = new Set(placeholders);
+        const placeholderCount = uniquePlaceholders.size;
         if (placeholderCount !== params.length) {
             console.warn('⚠️ Parameter count mismatch in query');
             return false;