[somethingwithproof]

Description

monitor_check_upgrade() and monitor_device_remove() built SQL as strings. The version lookup now binds the plugin directory as a parameter. The device cleanup casts the ids to integers and binds them with placeholders, and does nothing when the list is empty (the old code produced IN(), a SQL error).

Related Issue

Closes #207

Motivation and Context

These were the last interpolated statements in setup.php. Device ids come from core, so this is hardening and not a reported exploit.

How Has This Been Tested?

Pest on PHP 8.4 against a Cacti vendor tree: develop 148 passed, this branch 150 passed. The new and updated tests (prepared placeholders and bound params, integer binding of a hostile id, empty list) fail against the old setup.php. CI's PHP 8.2 and 8.3 legs were not run locally.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)

Checklist:

• My code follows the code style of this project.
• My change requires a change to the documentation.
• I have updated the documentation repository accordingly.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud