1// ✅ Secure client data access
2function getClientDataSecure($clientId, $attorneyId) {
3    // Verify attorney has access to client
4    if (!verifyAttorneyClientRelationship($attorneyId, $clientId)) {
5        throw new UnauthorizedAccessException();
6    }
7    
8    $query = "SELECT * FROM clients WHERE id = ? AND attorney_id = ?";
9    $stmt = $conn->prepare($query);
10    $stmt->bind_param("ii", $clientId, $attorneyId);
11    return $stmt->execute();
12}

1// ❌ Vulnerable client lookup
2function getClientData($clientId) {
3    // No access control check
4    $query = "SELECT * FROM clients WHERE id = " . $clientId;
5    return mysqli_query($conn, $query);
6}

1def log_communication_secure(attorney_id, client_id, message_type):
2    // Only log metadata, not privileged content
3    log_entry = {
4        "timestamp": datetime.now().isoformat(),
5        "attorney_id": attorney_id,
6        "client_id": client_id,
7        "message_type": message_type,
8        "privileged": is_privileged_communication(message_type)
9    }
10    
11    // Encrypt sensitive logs
12    encrypted_entry = encrypt_log_entry(log_entry)
13    store_secure_log(encrypted_entry)

1# ❌ Vulnerable communication logging
2def log_communication(attorney_id, client_id, message):
3    // Privileged communications logged in plaintext
4    with open('communications.log', 'a') as f:
5        f.write(f"{datetime.now()}: {attorney_id} -> {client_id}: {message}
6")