diff --git a/lib/sync_nfu_personal_data/api/server.js b/lib/sync_nfu_personal_data/api/server.js
index 5a8125a..6506950 100644
--- a/lib/sync_nfu_personal_data/api/server.js
+++ b/lib/sync_nfu_personal_data/api/server.js
@@ -1,26 +1,28 @@
 const express = require('express');
 const oracledb = require('oracledb');
-const cors = require('cors');
 const bodyParser = require('body-parser');
 
 const app = express();
-app.use(cors());
 app.use(bodyParser.json());
 
 // Oracle 連線設定
 const dbConfig = {
-  user: process.env.ORACLE_USER || 'VENDOR_WEB',
-  password: process.env.ORACLE_PASSWORD || 'NfuWEB_5066',
-  connectString: process.env.ORACLE_CONNECT || '140.130.3.186:1521/dbnfua'
+  user: process.env.ORACLE_USER,
+  password: process.env.ORACLE_PASSWORD,
+  connectString: process.env.ORACLE_CONNECT
 };
+if (!dbConfig.user || !dbConfig.password || !dbConfig.connectString) {
+  console.error('缺少 ORACLE_USER / ORACLE_PASSWORD / ORACLE_CONNECT，停止啟動');
+  process.exit(1);
+}
 oracledb.fetchAsString = [ oracledb.DATE ];
 
 // 通用查詢函式
-async function executeQuery(sql) {
+async function executeQuery(sql, binds = {}) {
   let connection;
   try {
     connection = await oracledb.getConnection(dbConfig);
-    const result = await connection.execute(sql, {}, { outFormat: oracledb.OUT_FORMAT_ARRAY });
+    const result = await connection.execute(sql, binds, { outFormat: oracledb.OUT_FORMAT_ARRAY });
     return result.rows || [];
   } catch (err) {
     console.error('查詢錯誤:', err);
@@ -40,8 +42,8 @@ async function executeQuery(sql) {
 app.get('/api/teachers/:id', async (req, res) => {
   try {
     const teacherId = req.params.id;
-    const sql = `SELECT * FROM VRW_TEACHER WHERE T_ID = '${teacherId}'`;
-    const result = await executeQuery(sql);
+    const sql = `SELECT * FROM VRW_TEACHER WHERE T_ID = :tid`;
+    const result = await executeQuery(sql, { tid: teacherId });
     res.json(result);
   } catch (err) {
     res.status(500).json({ error: err.message });
@@ -52,8 +54,8 @@ app.get('/api/teachers/:id', async (req, res) => {
 app.get('/api/courses/:id', async (req, res) => {
   try {
     const teacherId = req.params.id;
-    const sql = `SELECT * FROM VRW_COURSE WHERE T_ID = '${teacherId}'`;
-    const result = await executeQuery(sql);
+    const sql = `SELECT * FROM VRW_COURSE WHERE T_ID = :tid`;
+    const result = await executeQuery(sql, { tid: teacherId });
     res.json(result);
   } catch (err) {
     res.status(500).json({ error: err.message });
@@ -64,8 +66,8 @@ app.get('/api/courses/:id', async (req, res) => {
 app.get('/api/periodicals/:id', async (req, res) => {
   try {
     const teacherId = req.params.id;
-    const sql = `SELECT * FROM VRW_PERIODICAL WHERE T_ID = '${teacherId}'`;
-    const result = await executeQuery(sql);
+    const sql = `SELECT * FROM VRW_PERIODICAL WHERE T_ID = :tid`;
+    const result = await executeQuery(sql, { tid: teacherId });
     res.json(result);
   } catch (err) {
     res.status(500).json({ error: err.message });
@@ -76,8 +78,8 @@ app.get('/api/periodicals/:id', async (req, res) => {
 app.get('/api/books/:id', async (req, res) => {
   try {
     const teacherId = req.params.id;
-    const sql = `SELECT * FROM VRW_BOOK WHERE T_ID = '${teacherId}'`;
-    const result = await executeQuery(sql);
+    const sql = `SELECT * FROM VRW_BOOK WHERE T_ID = :tid`;
+    const result = await executeQuery(sql, { tid: teacherId });
     res.json(result);
   } catch (err) {
     res.status(500).json({ error: err.message });
@@ -88,8 +90,8 @@ app.get('/api/books/:id', async (req, res) => {
 app.get('/api/research_acts/:id', async (req, res) => {
   try {
     const teacherId = req.params.id;
-    const sql = `SELECT * FROM VRW_RESEARCH_ACT WHERE T_ID = '${teacherId}'`;
-    const result = await executeQuery(sql);
+    const sql = `SELECT * FROM VRW_RESEARCH_ACT WHERE T_ID = :tid`;
+    const result = await executeQuery(sql, { tid: teacherId });
     res.json(result);
   } catch (err) {
     res.status(500).json({ error: err.message });
@@ -100,8 +102,8 @@ app.get('/api/research_acts/:id', async (req, res) => {
 app.get('/api/plans/:id', async (req, res) => {
   try {
     const teacherId = req.params.id;
-    const sql = `SELECT * FROM VRW_PLAN_DOC WHERE T_ID = '${teacherId}'`;
-    const result = await executeQuery(sql);
+    const sql = `SELECT * FROM VRW_PLAN_DOC WHERE T_ID = :tid`;
+    const result = await executeQuery(sql, { tid: teacherId });
     res.json(result);
   } catch (err) {
     res.status(500).json({ error: err.message });
@@ -112,8 +114,8 @@ app.get('/api/plans/:id', async (req, res) => {
 app.get('/api/patents/:id', async (req, res) => {
   try {
     const teacherId = req.params.id;
-    const sql = `SELECT * FROM VRW_PATENT WHERE T_ID = '${teacherId}'`;
-    const result = await executeQuery(sql);
+    const sql = `SELECT * FROM VRW_PATENT WHERE T_ID = :tid`;
+    const result = await executeQuery(sql, { tid: teacherId });
     res.json(result);
   } catch (err) {
     res.status(500).json({ error: err.message });
@@ -124,8 +126,8 @@ app.get('/api/patents/:id', async (req, res) => {
 app.get('/api/awards/:id', async (req, res) => {
   try {
     const teacherId = req.params.id;
-    const sql = `SELECT * FROM VRW_AWARD WHERE T_ID = '${teacherId}'`;
-    const result = await executeQuery(sql);
+    const sql = `SELECT * FROM VRW_AWARD WHERE T_ID = :tid`;
+    const result = await executeQuery(sql, { tid: teacherId });
     res.json(result);
   } catch (err) {
     res.status(500).json({ error: err.message });
@@ -136,8 +138,8 @@ app.get('/api/awards/:id', async (req, res) => {
 app.get('/api/dissertations/:id', async (req, res) => {
   try {
     const teacherId = req.params.id;
-    const sql = `SELECT * FROM VRW_DISSERTATIONS WHERE T_ID = '${teacherId}'`;
-    const result = await executeQuery(sql);
+    const sql = `SELECT * FROM VRW_DISSERTATIONS WHERE T_ID = :tid`;
+    const result = await executeQuery(sql, { tid: teacherId });
     res.json(result);
   } catch (err) {
     res.status(500).json({ error: err.message });
@@ -148,8 +150,8 @@ app.get('/api/dissertations/:id', async (req, res) => {
 app.get('/api/educations/:id', async (req, res) => {
   try {
     const teacherId = req.params.id;
-    const sql = `SELECT * FROM VRW_EDUCATION WHERE T_ID = '${teacherId}'`;
-    const result = await executeQuery(sql);
+    const sql = `SELECT * FROM VRW_EDUCATION WHERE T_ID = :tid`;
+    const result = await executeQuery(sql, { tid: teacherId });
     res.json(result);
   } catch (err) {
     res.status(500).json({ error: err.message });
@@ -160,8 +162,8 @@ app.get('/api/educations/:id', async (req, res) => {
 app.get('/api/certifications/:id', async (req, res) => {
   try {
     const teacherId = req.params.id;
-    const sql = `SELECT * FROM VRW_CERTIFICATION WHERE T_ID = '${teacherId}'`;
-    const result = await executeQuery(sql);
+    const sql = `SELECT * FROM VRW_CERTIFICATION WHERE T_ID = :tid`;
+    const result = await executeQuery(sql, { tid: teacherId });
     res.json(result);
   } catch (err) {
     res.status(500).json({ error: err.message });
@@ -172,8 +174,8 @@ app.get('/api/certifications/:id', async (req, res) => {
 app.get('/api/award_contests/:id', async (req, res) => {
   try {
     const teacherId = req.params.id;
-    const sql = `SELECT * FROM VRW_AWARD_CONTEST WHERE T_ID = '${teacherId}'`;
-    const result = await executeQuery(sql);
+    const sql = `SELECT * FROM VRW_AWARD_CONTEST WHERE T_ID = :tid`;
+    const result = await executeQuery(sql, { tid: teacherId });
     res.json(result);
   } catch (err) {
     res.status(500).json({ error: err.message });
@@ -184,8 +186,8 @@ app.get('/api/award_contests/:id', async (req, res) => {
 app.get('/api/talks/:id', async (req, res) => {
   try {
     const teacherId = req.params.id;
-    const sql = `SELECT * FROM VRW_TALK WHERE T_ID = '${teacherId}'`;
-    const result = await executeQuery(sql);
+    const sql = `SELECT * FROM VRW_TALK WHERE T_ID = :tid`;
+    const result = await executeQuery(sql, { tid: teacherId });
     res.json(result);
   } catch (err) {
     res.status(500).json({ error: err.message });
@@ -196,8 +198,8 @@ app.get('/api/talks/:id', async (req, res) => {
 app.get('/api/pro_services/:id', async (req, res) => {
   try {
     const teacherId = req.params.id;
-    const sql = `SELECT * FROM VRW_PRO_SERVICE WHERE T_ID = '${teacherId}'`;
-    const result = await executeQuery(sql);
+    const sql = `SELECT * FROM VRW_PRO_SERVICE WHERE T_ID = :tid`;
+    const result = await executeQuery(sql, { tid: teacherId });
     res.json(result);
   } catch (err) {
     res.status(500).json({ error: err.message });
@@ -208,8 +210,8 @@ app.get('/api/pro_services/:id', async (req, res) => {
 app.get('/api/pretechtrans/:id', async (req, res) => {
   try {
     const teacherId = req.params.id;
-    const sql = `SELECT * FROM VRW_PRETECHTRAN WHERE T_ID = '${teacherId}'`;
-    const result = await executeQuery(sql);
+    const sql = `SELECT * FROM VRW_PRETECHTRAN WHERE T_ID = :tid`;
+    const result = await executeQuery(sql, { tid: teacherId });
     res.json(result);
   } catch (err) {
     res.status(500).json({ error: err.message });
@@ -220,8 +222,8 @@ app.get('/api/pretechtrans/:id', async (req, res) => {
 app.get('/api/techtrans/:id', async (req, res) => {
   try {
     const teacherId = req.params.id;
-    const sql = `SELECT * FROM VRW_TECHTRAN WHERE T_ID = '${teacherId}'`;
-    const result = await executeQuery(sql);
+    const sql = `SELECT * FROM VRW_TECHTRAN WHERE T_ID = :tid`;
+    const result = await executeQuery(sql, { tid: teacherId });
     res.json(result);
   } catch (err) {
     res.status(500).json({ error: err.message });
@@ -232,8 +234,8 @@ app.get('/api/techtrans/:id', async (req, res) => {
 app.get('/api/experiences/:id', async (req, res) => {
   try {
     const teacherId = req.params.id;
-    const sql = `SELECT * FROM VRW_EXPERIENCE WHERE T_ID = '${teacherId}'`;
-    const result = await executeQuery(sql);
+    const sql = `SELECT * FROM VRW_EXPERIENCE WHERE T_ID = :tid`;
+    const result = await executeQuery(sql, { tid: teacherId });
     res.json(result);
   } catch (err) {
     res.status(500).json({ error: err.message });
@@ -246,7 +248,8 @@ app.get('/health', (req, res) => {
 });
 
 const PORT = process.env.PORT || 3000;
-app.listen(PORT, () => {
-  console.log(`NFU Oracle API 伺服器運行在 http://localhost:${PORT}`);
+const HOST = '127.0.0.1';
+app.listen(PORT, HOST, () => {
+  console.log(`NFU Oracle API 伺服器運行在 http://${HOST}:${PORT}`);
   console.log(`Oracle 連接: ${dbConfig.connectString}`);
 });
diff --git a/lib/tasks/sync_nfu_personal_data_tasks.rake b/lib/tasks/sync_nfu_personal_data_tasks.rake
index 0d07dc5..6be3a69 100644
--- a/lib/tasks/sync_nfu_personal_data_tasks.rake
+++ b/lib/tasks/sync_nfu_personal_data_tasks.rake
@@ -2,7 +2,7 @@ require 'net/http'
 require 'json'
 
 module NfuSyncPlugin
-  API_BASE_URL = ENV['NFU_API_URL'] || 'http://localhost:3000/api'
+  API_BASE_URL = ENV['NFU_API_URL'] || 'http://127.0.0.1:3000/api'
 
   class << self
     def query_api(endpoint, teacher_id)
@@ -851,10 +851,10 @@ module NfuSyncPlugin
 end
 
 namespace :sync_nfu_personal_plugins do
-  task :ensure_api_running do
+  task :ensure_api_running => :environment do
     require 'net/http'
     require 'timeout'
-    api_url = ENV['NFU_API_URL'] || 'http://localhost:3000/health'
+    api_url = ENV['NFU_API_URL'] || 'http://127.0.0.1:3000/health'
     api_running = false
     begin
       Timeout.timeout(3) { api_running = Net::HTTP.get_response(URI(api_url)).is_a?(Net::HTTPSuccess) }