fix: escape 'key' as reserved word in all MySQL queries with backticks

handlers/auth.go

@@ -126,7 +126,7 @@ func (h *AuthHandler) HandleRegister(c *gin.Context) {
 
 	// Seed default settings for the user
 	for key, val := range defaultUserSettings {
-		h.db.Exec(`INSERT IGNORE INTO user_settings (user_id, key, value) VALUES (?, ?, ?)`, userID, key, val)
+		h.db.Exec("INSERT IGNORE INTO user_settings (user_id, `key`, value) VALUES (?, ?, ?)", userID, key, val)
 	}
 
 	// Auto-login: set session

handlers/pages.go

@@ -55,8 +55,8 @@ func (h *PageHandler) Review(c *gin.Context) {
 	topN := "20"
 	concurrency := "5"
 	if user != nil {
-		h.db.QueryRow(`SELECT value FROM user_settings WHERE user_id = ? AND key = 'review.top_n'`, user.ID).Scan(&topN)
-		h.db.QueryRow(`SELECT value FROM user_settings WHERE user_id = ? AND key = 'review.concurrency'`, user.ID).Scan(&concurrency)
+		h.db.QueryRow("SELECT value FROM user_settings WHERE user_id = ? AND `key` = 'review.top_n'", user.ID).Scan(&topN)
+		h.db.QueryRow("SELECT value FROM user_settings WHERE user_id = ? AND `key` = 'review.concurrency'", user.ID).Scan(&concurrency)
 	}
 	if topN == "" {
 		topN = "20"
@@ -78,7 +78,7 @@ func (h *PageHandler) Settings(c *gin.Context) {
 		settings[key] = ""
 	}
 	if user != nil {
-		rows, err := h.db.Query(`SELECT key, value FROM user_settings WHERE user_id = ?`, user.ID)
+		rows, err := h.db.Query("SELECT `key`, value FROM user_settings WHERE user_id = ?", user.ID)
 		if err == nil {
 			defer rows.Close()
 			for rows.Next() {

handlers/repos.go

@@ -100,7 +100,7 @@ func (h *ReposHandler) CleanupRepos(c *gin.Context) {
 	}
 
 	var maxAgeDays string
-	h.db.QueryRow(`SELECT value FROM user_settings WHERE user_id = ? AND key = 'cache.max_age_days'`, user.ID).Scan(&maxAgeDays)
+	h.db.QueryRow("SELECT value FROM user_settings WHERE user_id = ? AND `key` = 'cache.max_age_days'", user.ID).Scan(&maxAgeDays)
 	if maxAgeDays == "" {
 		maxAgeDays = "7"
 	}

handlers/review.go

@@ -60,7 +60,7 @@ func (h *ReviewHandler) Review(c *gin.Context) {
 		topN = *req.TopN
 	} else {
 		var topNStr string
-		h.db.QueryRow(`SELECT value FROM user_settings WHERE user_id = ? AND key = 'review.top_n'`, user.ID).Scan(&topNStr)
+		h.db.QueryRow("SELECT value FROM user_settings WHERE user_id = ? AND `key` = 'review.top_n'", user.ID).Scan(&topNStr)
 		if topNStr != "" {
 			if n, err := strconv.Atoi(topNStr); err == nil && n > 0 {
 				topN = n
@@ -74,7 +74,7 @@ func (h *ReviewHandler) Review(c *gin.Context) {
 		concurrency = *req.Concurrency
 	} else {
 		var concStr string
-		h.db.QueryRow(`SELECT value FROM user_settings WHERE user_id = ? AND key = 'review.concurrency'`, user.ID).Scan(&concStr)
+		h.db.QueryRow("SELECT value FROM user_settings WHERE user_id = ? AND `key` = 'review.concurrency'", user.ID).Scan(&concStr)
 		if concStr != "" {
 			if n, err := strconv.Atoi(concStr); err == nil && n > 0 {
 				concurrency = n

handlers/settings.go

@@ -23,7 +23,7 @@ func (h *SettingsHandler) GetSettings(c *gin.Context) {
 	}
 
 	settings := make(map[string]string)
-	rows, err := h.db.Query(`SELECT key, value FROM user_settings WHERE user_id = ?`, user.ID)
+	rows, err := h.db.Query("SELECT `key`, value FROM user_settings WHERE user_id = ?", user.ID)
 	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
 		return
@@ -56,7 +56,7 @@ func (h *SettingsHandler) UpdateSettings(c *gin.Context) {
 		return
 	}
 	for key, val := range body {
-		_, err := tx.Exec(`INSERT INTO user_settings (user_id, key, value) VALUES (?, ?, ?) ON DUPLICATE KEY UPDATE value = VALUES(value)`, user.ID, key, val)
+		_, err := tx.Exec("INSERT INTO user_settings (user_id, `key`, value) VALUES (?, ?, ?) ON DUPLICATE KEY UPDATE value = VALUES(value)", user.ID, key, val)
 		if err != nil {
 			tx.Rollback()
 			c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})