diff --git a/api/auth/avatar.cfm b/api/auth/avatar.cfm
index c633943..932d954 100644
--- a/api/auth/avatar.cfm
+++ b/api/auth/avatar.cfm
@@ -88,7 +88,7 @@ function findAvatarFile(basePath, userId) {
 avatarInfo = findAvatarFile(uploadsPath, userId);
 avatarPath = avatarInfo.path;
 avatarFilename = avatarInfo.filename;
-avatarUrl = "https://biz.payfrit.com/uploads/users/" & avatarFilename;
+avatarUrl = application.baseUrl & "/uploads/users/" & avatarFilename;
 
 // Handle GET - return current avatar URL
 if (cgi.REQUEST_METHOD == "GET") {
diff --git a/api/auth/completeProfile.cfm b/api/auth/completeProfile.cfm
index 26a655e..b398a99 100644
--- a/api/auth/completeProfile.cfm
+++ b/api/auth/completeProfile.cfm
@@ -74,7 +74,7 @@ try {
         SELECT ID FROM Users
         WHERE EmailAddress = :email
           AND IsEmailVerified = 1
-          AND UserID != :userId
+          AND ID != :userId
         LIMIT 1
     ", {
         email: { value: email, cfsqltype: "cf_sql_varchar" },
@@ -109,7 +109,7 @@ try {
     }, { datasource: "payfrit" });
 
     // Send confirmation email (non-blocking - don't fail if mail fails)
-    confirmLink = "https://biz.payfrit.com/confirm_email.cfm?UUID=" & qUser.UUID;
+    confirmLink = application.baseUrl & "/confirm_email.cfm?UUID=" & qUser.UUID;
     emailBody = "
         <p>Welcome to Payfrit, #firstName#!</p>
         <p>Please click the link below to confirm your email address:</p>
diff --git a/api/config/environment.cfm b/api/config/environment.cfm
index 4de9b76..4793cdc 100644
--- a/api/config/environment.cfm
+++ b/api/config/environment.cfm
@@ -258,6 +258,7 @@ function logPerf(numeric responseBytes = 0) {
 
 // Store in application scope
 application.isDevEnvironment = isDevEnvironment;
+application.baseUrl = isDevEnvironment ? "https://dev.payfrit.com" : "https://biz.payfrit.com";
 application.isDev = isDev;
 application.logDebug = logDebug;
 application.apiError = apiError;
diff --git a/api/orders/getDetail.cfm b/api/orders/getDetail.cfm
index 13e9b78..c8183dd 100644
--- a/api/orders/getDetail.cfm
+++ b/api/orders/getDetail.cfm
@@ -174,7 +174,7 @@ try {
         staffMember = structNew("ordered");
         staffMember["UserID"] = row.ID;
         staffMember["FirstName"] = row.FirstName;
-        staffMember["AvatarUrl"] = "https://biz.payfrit.com/uploads/users/" & row.ID & ".jpg";
+        staffMember["AvatarUrl"] = application.baseUrl & "/uploads/users/" & row.ID & ".jpg";
         staffMember["RatingToken"] = row.RatingToken ?: "";
         arrayAppend(staff, staffMember);
     }
diff --git a/api/orders/submit.cfm b/api/orders/submit.cfm
index 1b010b1..97562ec 100644
--- a/api/orders/submit.cfm
+++ b/api/orders/submit.cfm
@@ -83,14 +83,14 @@
           RequiresChildSelection,
           MaxNumSelectionReq
         FROM Items
-        WHERE ID IN (#inList#)
+        WHERE ID IN (:itemIds)
       ",
-      [],
+      { itemIds: { value: inList, cfsqltype: "cf_sql_integer", list: true } },
       { datasource = "payfrit" }
     )>
 
     <cfloop query="qMeta">
-      <cfset out.itemMeta[qMeta.ItemID] = {
+      <cfset out.itemMeta[qMeta.ID] = {
         "requires": qMeta.RequiresChildSelection,
         "maxSel": qMeta.MaxNumSelectionReq
       }>
diff --git a/api/stripe/onboard.cfm b/api/stripe/onboard.cfm
index bdf58b1..6f14273 100644
--- a/api/stripe/onboard.cfm
+++ b/api/stripe/onboard.cfm
@@ -83,7 +83,7 @@ try {
     }
 
     // Create account link for onboarding
-    baseURL = "https://biz.payfrit.com";
+    baseURL = application.baseUrl;
 
     httpService = new http();
     httpService.setMethod("POST");
diff --git a/api/tasks/getDetails.cfm b/api/tasks/getDetails.cfm
index da4c488..d45741e 100644
--- a/api/tasks/getDetails.cfm
+++ b/api/tasks/getDetails.cfm
@@ -86,11 +86,11 @@
     <cfset pngPath = uploadDir & qTask.CustomerUserID & ".png">
     <cfset pngPathUpper = uploadDir & qTask.CustomerUserID & ".PNG">
     <cfif fileExists(jpgPath)>
-      <cfset customerPhotoUrl = "https://biz.payfrit.com/uploads/users/" & qTask.CustomerUserID & ".jpg">
+      <cfset customerPhotoUrl = application.baseUrl & "/uploads/users/" & qTask.CustomerUserID & ".jpg">
     <cfelseif fileExists(pngPath)>
-      <cfset customerPhotoUrl = "https://biz.payfrit.com/uploads/users/" & qTask.CustomerUserID & ".png">
+      <cfset customerPhotoUrl = application.baseUrl & "/uploads/users/" & qTask.CustomerUserID & ".png">
     <cfelseif fileExists(pngPathUpper)>
-      <cfset customerPhotoUrl = "https://biz.payfrit.com/uploads/users/" & qTask.CustomerUserID & ".PNG">
+      <cfset customerPhotoUrl = application.baseUrl & "/uploads/users/" & qTask.CustomerUserID & ".PNG">
     </cfif>
   </cfif>
 
diff --git a/api/users/search.cfm b/api/users/search.cfm
index bd29400..ca30315 100644
--- a/api/users/search.cfm
+++ b/api/users/search.cfm
@@ -73,7 +73,7 @@ try {
             "Name": trim(user.FirstName & " " & user.LastName),
             "Email": user.EmailAddress,
             "Phone": maskedPhone,
-            "AvatarUrl": len(trim(user.ImageExtension)) ? "https://biz.payfrit.com/uploads/users/" & user.ID & "." & user.ImageExtension : ""
+            "AvatarUrl": len(trim(user.ImageExtension)) ? application.baseUrl & "/uploads/users/" & user.ID & "." & user.ImageExtension : ""
         });
     }
 
diff --git a/api/workers/earlyUnlock.cfm b/api/workers/earlyUnlock.cfm
index d22bb7f..2dee73c 100644
--- a/api/workers/earlyUnlock.cfm
+++ b/api/workers/earlyUnlock.cfm
@@ -59,7 +59,7 @@ try {
     httpService.addParam(type="formfield", name="line_items[0][price_data][currency]", value="usd");
     httpService.addParam(type="formfield", name="line_items[0][price_data][product_data][name]", value="Payfrit Activation");
     httpService.addParam(type="formfield", name="line_items[0][quantity]", value="1");
-    baseUrl = application.isDevEnvironment ? "https://dev.payfrit.com" : "https://biz.payfrit.com";
+    baseUrl = application.baseUrl;
     httpService.addParam(type="formfield", name="success_url", value=baseUrl & "/works/stripe-return.cfm?status=success");
     httpService.addParam(type="formfield", name="cancel_url", value=baseUrl & "/works/stripe-return.cfm?status=cancel");
     httpService.addParam(type="formfield", name="metadata[user_id]", value=userID);
diff --git a/api/workers/onboardingLink.cfm b/api/workers/onboardingLink.cfm
index 91a770a..77818bf 100644
--- a/api/workers/onboardingLink.cfm
+++ b/api/workers/onboardingLink.cfm
@@ -53,7 +53,7 @@ try {
     httpService.setPassword("");
 
     httpService.addParam(type="formfield", name="account", value=accountID);
-    baseUrl = application.isDevEnvironment ? "https://dev.payfrit.com" : "https://biz.payfrit.com";
+    baseUrl = application.baseUrl;
     httpService.addParam(type="formfield", name="refresh_url", value=baseUrl & "/works/stripe-return.cfm?status=refresh");
     httpService.addParam(type="formfield", name="return_url", value=baseUrl & "/works/stripe-return.cfm?status=complete");
     httpService.addParam(type="formfield", name="type", value="account_onboarding");