diff --git a/classes/Utils.php b/classes/Utils.php
index 9e9a3abe4c..48ccc73bbe 100644
--- a/classes/Utils.php
+++ b/classes/Utils.php
@@ -4023,12 +4023,13 @@ public function get_course_reviews( $object_id = 0, $start = 0, $limit = 10, $co
 			$where_clause = '_reviews.comment_post_ID = %d';
 		}
 
-		$limit_offset    = $count_only ? '' : ' LIMIT ' . (int) $limit . ' OFFSET ' . (int) $start;
-		$status_in       = array_map( 'esc_sql', (array) $status_in );
-		$status_in       = '"' . implode( '","', $status_in ) . '"';
-		$include_user_id = is_array( $include_user_id ) ? $include_user_id : array( $include_user_id );
-		$include_user_id = array_map( 'absint', $include_user_id );
-		$include_user_id = implode( ',', $include_user_id );
+		$start           = absint( $start );
+		$limit           = absint( $limit );
+		$limit_offset    = $count_only ? '' : " LIMIT {$limit} OFFSET {$start} ";
+		$status_in       = array_values( array_filter( array_map( 'sanitize_key', (array) $status_in ) ) );
+		$status_in_str   = count( $status_in ) ? QueryHelper::prepare_in_clause( $status_in ) : "''";
+		$include_user_id = array_values( array_filter( array_map( 'absint', (array) $include_user_id ) ) );
+		$user_id_in_str  = count( $include_user_id ) ? QueryHelper::prepare_in_clause( $include_user_id ) : '0';
 
 		$select_columns = $count_only ? ' COUNT(DISTINCT _reviews.comment_ID) ' :
 		'_reviews.comment_ID,
@@ -4052,7 +4053,7 @@ public function get_course_reviews( $object_id = 0, $start = 0, $limit = 10, $co
 						ON _reviews.user_id = _reviewer.ID
 			WHERE 	{$where_clause}
 					AND _reviews.comment_type = 'tutor_course_rating' 
-					AND (_reviews.comment_approved IN ({$status_in}) OR _reviews.user_id IN ({$include_user_id}))
+					AND (_reviews.comment_approved IN ({$status_in_str}) OR _reviews.user_id IN ({$user_id_in_str}))
 					AND _rev_meta.meta_key = 'tutor_rating'
 			ORDER BY _reviews.comment_ID DESC {$limit_offset}",
 			$object_id
@@ -4639,6 +4640,8 @@ public function get_qa_questions( $start = 0, $limit = 10, $search_term = '', $q
 		// Sanitize args before process.
 		$args = Input::sanitize_array( $args );
 
+		$params = array( $search_term );
+
 		if ( ! $user_id && ! $asker_id && null === $question_id && empty( $args['course_id'] ) ) {
 			return $count_only ? 0 : array();
 		}
@@ -4648,7 +4651,7 @@ public function get_qa_questions( $start = 0, $limit = 10, $search_term = '', $q
 		 * User query.
 		 */
 		if ( $asker_id ) {
-			$question_clause .= ' AND _question.user_id=' . (int) $asker_id;
+			$question_clause .= ' AND _question.user_id=' . absint( $asker_id );
 		}
 
 		if ( ! $user_id ) {
@@ -4657,31 +4660,32 @@ public function get_qa_questions( $start = 0, $limit = 10, $search_term = '', $q
 
 		if ( isset( $args['course_id'] ) ) {
 			// Get qa for specific course.
-			$args['course_id']   = intval( $args['course_id'] );
+			$args['course_id']   = absint( $args['course_id'] );
 			$in_course_id_query .= ' AND _question.comment_post_ID=' . $args['course_id'] . ' ';
 
 		} elseif ( ! $asker_id && null === $question_id && ! $this->has_user_role( 'administrator', $user_id ) && current_user_can( tutor()->instructor_role ) ) {
 			// If current user is simple instructor (non admin), then get qa from their courses only.
-			$my_course_ids       = $this->get_course_id_by( 'instructor', $user_id );
-			$in_ids              = count( $my_course_ids ) ? implode( ',', $my_course_ids ) : '0';
+			$my_course_ids       = array_filter( array_map( 'absint', (array) $this->get_course_id_by( 'instructor', $user_id ) ) );
+			$in_ids              = count( $my_course_ids ) ? QueryHelper::prepare_in_clause( $my_course_ids ) : '0';
 			$in_course_id_query .= " AND _question.comment_post_ID IN($in_ids) ";
 		}
 
 		// Add more filters to the query.
 		if ( isset( $args['course-id'] ) && is_numeric( $args['course-id'] ) ) {
-			$filter_clause .= ' AND _course.ID=' . $args['course-id'];
+			$filter_clause .= ' AND _course.ID=' . absint( $args['course-id'] );
 		}
 
-		if ( isset( $args['date'] ) ) {
-			$date           = esc_sql( $args['date'] );
-			$filter_clause .= ' AND DATE(_question.comment_date)=\'' . $date . '\'';
+		if ( ! empty( $args['date'] ) ) {
+			$formatted_date = tutor_get_formated_date( 'Y-m-d', $args['date'] );
+			if ( '' !== $formatted_date ) {
+				$filter_clause .= ' AND DATE(_question.comment_date) = CAST(%s AS DATE)';
+				$params[]       = $formatted_date;
+			}
 		}
 
 		if ( isset( $args['order'] ) ) {
-			$order = strtolower( $args['order'] );
-			if ( 'asc' === $order || 'desc' === $order ) {
-				$order_condition = ' ORDER BY _question.comment_ID ' . $order . ' ';
-			}
+			$order           = QueryHelper::get_valid_sort_order( $args['order'] );
+			$order_condition = " ORDER BY _question.comment_ID {$order} ";
 		}
 
 		// Meta query.
@@ -4739,7 +4743,9 @@ public function get_qa_questions( $start = 0, $limit = 10, $search_term = '', $q
 						WHERE 	answers_t.comment_parent = _question.comment_ID
 					) AS answer_count";
 
-		$limit_offset = $count_only ? '' : ' LIMIT ' . (int) $limit . ' OFFSET ' . (int) $start;
+		$start        = absint( $start );
+		$limit        = absint( $limit );
+		$limit_offset = $count_only ? '' : " LIMIT {$limit} OFFSET {$start} ";
 
 		$query = $wpdb->prepare(
 			"SELECT  {$columns_select}
@@ -4762,7 +4768,7 @@ public function get_qa_questions( $start = 0, $limit = 10, $search_term = '', $q
 					{$filter_clause}
 			{$order_condition}
 			{$limit_offset}",
-			$search_term
+			$params
 		);
 		if ( $count_only ) {
 			return $wpdb->get_var( $query );
@@ -4779,7 +4785,7 @@ public function get_qa_questions( $start = 0, $limit = 10, $search_term = '', $q
 
 		// Assign meta data.
 		if ( count( $question_ids ) ) {
-			$q_ids      = implode( ',', $question_ids );
+			$q_ids      = QueryHelper::prepare_in_clause( array_map( 'absint', $question_ids ) );
 			$meta_array = $wpdb->get_results(
 				"SELECT comment_id, meta_key, meta_value
 				FROM {$wpdb->commentmeta}
diff --git a/models/OrderModel.php b/models/OrderModel.php
index c7c95a4c8e..34bb10bc9a 100644
--- a/models/OrderModel.php
+++ b/models/OrderModel.php
@@ -1028,7 +1028,6 @@ public function get_order_count( $where = array(), string $search_term = '' ) {
 	public function get_user_orders( $time_period = null, $start_date = null, $end_date = null, $order_status = '', int $user_id = 0, $limit = 10, int $offset = 0, $order = 'DESC', $args = array() ) {
 		$user_id           = tutor_utils()->get_user_id( $user_id );
 		$order             = QueryHelper::get_valid_sort_order( $order );
-		$order_status      = esc_sql( $order_status );
 		$order_type_clause = '';
 
 		$response = array(
@@ -1038,12 +1037,19 @@ public function get_user_orders( $time_period = null, $start_date = null, $end_d
 
 		global $wpdb;
 
+		$params              = array( $user_id );
 		$time_period_clause  = '';
 		$date_range_clause   = '';
-		$order_status_clause = ( empty( $order_status ) || 'all' === $order_status ) ? '' : "AND o.order_status = '{$order_status}'";
+		$order_status_clause = '';
 
 		if ( $start_date && $end_date ) {
-			$date_range_clause = $wpdb->prepare( 'AND DATE(created_at_gmt) BETWEEN %s AND %s', $start_date, $end_date );
+			$formatted_start = tutor_get_formated_date( 'Y-m-d', $start_date );
+			$formatted_end   = tutor_get_formated_date( 'Y-m-d', $end_date );
+			if ( '' !== $formatted_start && '' !== $formatted_end ) {
+				$date_range_clause = 'AND DATE(created_at_gmt) BETWEEN CAST(%s AS DATE) AND CAST(%s AS DATE)';
+				$params[]          = $formatted_start;
+				$params[]          = $formatted_end;
+			}
 		} elseif ( $time_period ) {
 			if ( 'today' === $time_period ) {
 				$time_period_clause = 'AND  DATE(o.created_at_gmt) = CURDATE()';
@@ -1054,16 +1060,26 @@ public function get_user_orders( $time_period = null, $start_date = null, $end_d
 			}
 		}
 
+		if ( ! empty( $order_status ) && 'all' !== $order_status ) {
+			$order_status_clause = 'AND o.order_status = %s';
+			$params[]            = sanitize_key( $order_status );
+		}
+
 		if ( ! empty( $args['order_type'] ) ) {
-			$order_type_clause = ' AND ' . QueryHelper::prepare_where_clause( array( 'o.order_type' => esc_sql( $args['order_type'] ) ) );
+			$order_type_clause = ' AND ' . QueryHelper::prepare_where_clause( array( 'o.order_type' => sanitize_key( $args['order_type'] ) ) );
 		}
 
+		$limit    = absint( $limit );
+		$offset   = absint( $offset );
+		$params[] = $limit;
+		$params[] = $offset;
+
 		//phpcs:disable
 		$query = $wpdb->prepare(
 			"SELECT
 				SQL_CALC_FOUND_ROWS
 				o.* 
-				FROM $this->table_name AS o
+				FROM {$this->table_name} AS o
 				WHERE o.user_id = %d
 				{$order_type_clause}
 				{$time_period_clause}
@@ -1072,9 +1088,7 @@ public function get_user_orders( $time_period = null, $start_date = null, $end_d
 				ORDER BY o.id {$order}
 				LIMIT %d OFFSET %d
 			",
-			$user_id,
-			$limit,
-			$offset
+			$params
 		);
 
 		$results = $wpdb->get_results( $query );