Replace ad-hoc xss_clean calls with explicit casting and stronger type checks for ID/parameter handling, and convert many raw SQL strings to CodeIgniter Query Builder usage. Added normalize_location_ids helpers (Activators_model, Oqrs_model) to safely parse location lists and used where_in/parameter binding/escaping to avoid injection and improve maintainability. Also adjusted session user_id handling, improved LIKE/DATE/TIMEDIFF usage, and tightened several model/controller methods (Labels, Activators, Bands, Contesting, Labels_model, Modes, Oqrs_model, Qsl_model, Setup_model, Sstv_model, User_model) for safer, clearer DB queries and inputs.
Replaced checks for QSO accessibility with stricter write permission checks across controllers and models. Added a new check_qso_is_writable method to Logbook_model to ensure only authorized users can modify or delete QSOs, including shared logbook scenarios. Updated QSO, Qsl_model, and Sstv_model to use the new permission logic for all write operations.
