/models files security audit and fixes

.agent/skills/core-development-skill/SKILL.md → .agents/skills/core-development-skill/SKILL.md

@@ -1,3 +1,8 @@
+---
+name: core-development-skill
+description: This skill governs all development, bug fixing, and feature work inside the **Tutor LMS** plugin codebase (`github.com/themeum/tutor`). It covers project structure, namespace conventions, coding patterns, PHPDoc standards, available helpers/utilities, security rules, and AI agent instructions.
+---
+
 # Tutor LMS — Core Development Skill
 
 ## Overview

.agent/skills/wpcs-security-skill/SKILL.md → .agents/skills/wpcs-security-skill/SKILL.md

@@ -1,3 +1,8 @@
+---
+name: wpcs-security-skill
+description: Enforces strict WordPress coding standards (WPCS) and security best practices for PHP, JS, CSS, and HTML.
+---
+
 # WordPress Coding Standards & Security Skill
 
 ## Overview

models/UserModel.php

@@ -60,6 +60,7 @@ public function get_users_list( array $args ) {
 	public function get_unenrolled_users( $object_id, $search_clause = array(), $limit = 10, $offset = 0 ) {
 		global $wpdb;
 
+		$object_id      = absint( $object_id );
 		$primary_table  = "{$wpdb->users} AS u";
 		$joining_tables = array(
 			array(