diff --git a/callsign.php b/callsign.php
index 2943a8e..c4e8ff9 100644
--- a/callsign.php
+++ b/callsign.php
@@ -275,7 +275,7 @@ if (isset($_GET['submit'])) {
 					$link = mysqli_connect('localhost', 'pqs', 'pqs') or die('Could not connect: ' . mysqli_error($link));
 					mysqli_select_db($link, 'pqs') or die('Could not select database');
 					$query = "SELECT `numpods` FROM `pqs_gameconfig` WHERE 1";
-					$result = mysqli_query($link, $query) or die('Query failed: ' . mysql_error());
+					$result = mysqli_query($link, $query) or die('Query failed: ' . mysqli_error($link));
 					$line = mysqli_fetch_array($result);
 					$i = 2;
 					$max = intval($line[0]);
@@ -292,7 +292,7 @@ if (isset($_GET['submit'])) {
 					$link = mysqli_connect('localhost', 'pqs', 'pqs') or die('Could not connect: ' . mysqli_error($link));
 					mysqli_select_db($link, 'pqs') or die('Could not select database');
 					$query = "SELECT DISTINCT left(`CallSign`,LOCATE('-',`CallSign`)-1) FROM `pqs_queue` WHERE `CallSign` like '%-%'";
-					$result = mysqli_query($link, $query) or die('Query failed: ' . mysql_error());
+					$result = mysqli_query($link, $query) or die('Query failed: ' . mysqli_error($link));
 					while ($line = mysqli_fetch_array($result)) {
 						echo "<option value=$line[0]";if(strcmp($_GET['who'], $line[0])==0){echo " selected ";} echo ">$line[0]</option>
 					";}
@@ -319,7 +319,7 @@ if (isset($_GET['submit'])) {
 					$link = mysqli_connect('localhost', 'pqs', 'pqs') or die('Could not connect: ' . mysqli_error($link));
 					mysqli_select_db($link, 'pqs') or die('Could not select database');
 					$query = "SELECT * FROM pqs_mechinfo WHERE `Class` IN ($wclass) ORDER BY mechname";
-					$result = mysqli_query($link, $query) or die('Query failed: ' . mysql_error());
+					$result = mysqli_query($link, $query) or die('Query failed: ' . mysqli_error($link));
 					while ($line = mysqli_fetch_array($result)) {
 						echo "<option value=$line[0]>$line[1]</option>
 					";
diff --git a/console.php b/console.php
index a45a5dc..b91fd2b 100644
--- a/console.php
+++ b/console.php
@@ -169,10 +169,10 @@ echo "<div class='consolediv'><div id='configform'>";
 echo "<font size='6'>Configuration</font><br><br>";
 echo "<form name='submit-config' action='console.php'>";
 
-$link = mysqli_connect('localhost', 'pqs', 'pqs') or die('Could not connect: ' . mysql_error());
+$link = mysqli_connect('localhost', 'pqs', 'pqs') or die('Could not connect: ' . mysqli_connect_error());
 mysqli_select_db($link, 'pqs') or die('Could not select database');
 $query = 'SELECT * FROM pqs_gameconfig';
-$result = mysqli_query($link, $query) or die('Query failed: ' . mysql_error());
+$result = mysqli_query($link, $query) or die('Query failed: ' . mysqli_error($link));
 while ($line = mysqli_fetch_array($result)) {
 	$numpods = $line[1];
 	$timepergame = $line[2];
@@ -198,7 +198,7 @@ while ($line = mysqli_fetch_array($result)) {
 }
 
 $query = 'SELECT * FROM pqs_pods';
-$result = mysqli_query($link, $query) or die('Query failed: ' . mysql_error());
+$result = mysqli_query($link, $query) or die('Query failed: ' . mysqli_error($link));
 while ($line = mysqli_fetch_array($result)) {
 	$pod01  = $line[0];
 	$pod02  = $line[1];
diff --git a/getFSgame.php b/getFSgame.php
index 4e96652..bd9a000 100644
--- a/getFSgame.php
+++ b/getFSgame.php
@@ -9,7 +9,7 @@ mysqli_select_db($link, 'pqs') or die('Could not select database');
 
 // get current pods
 $query = 'SELECT * FROM pqs_gameconfig';
-$result = mysqli_query($link, $query) or die('Query failed 12: ' . mysql_error());
+$result = mysqli_query($link, $query) or die('Query failed 12: ' . mysqli_error($link));
 $line = mysqli_fetch_array($result);
 
 	$visibility = $line[7];
diff --git a/getFSplayers.php b/getFSplayers.php
index c44e08a..23669bd 100644
--- a/getFSplayers.php
+++ b/getFSplayers.php
@@ -7,7 +7,7 @@ $link = mysqli_connect('localhost', 'pqs', 'pqs') or die('Could not connect: ' .
 mysqli_select_db($link, 'pqs') or die('Could not select database');
 // get current pods
 $query = 'SELECT * FROM pqs_pods';
-$result = mysqli_query($link, $query) or die('Query failed: ' . mysql_error());
+$result = mysqli_query($link, $query) or die('Query failed: ' . mysqli_error($link));
 $line = mysqli_fetch_array($result);
 	$pod01  = $line[0];
 	$pod02  = $line[1];
diff --git a/includes/config.php b/includes/config.php
index e07aa66..11df16f 100644
--- a/includes/config.php
+++ b/includes/config.php
@@ -1,9 +1,9 @@
 <?php
 
-$link = mysqli_connect('localhost', 'pqs', 'pqs') or die('Could not connect: ' . mysql_error());
+$link = mysqli_connect('localhost', 'pqs', 'pqs') or die('Could not connect: ' . mysqli_connect_error());
 mysqli_select_db($link, 'pqs') or die('Could not select database');
 $query = 'SELECT * FROM pqs_gameconfig';
-$result = mysqli_query($link, $query) or die('Query failed: ' . mysql_error());
+$result = mysqli_query($link, $query) or die('Query failed: ' . mysqli_error($link));
 while ($line = mysqli_fetch_array($result)) {
 	$numpods[$line[0]]  = $line[1];
 	$timepergame[$line[0]] = $line[2];
@@ -11,7 +11,7 @@ while ($line = mysqli_fetch_array($result)) {
 	$groupAvalible[$line[0]] = $line[23];
 }
 $query = 'SELECT * FROM pqs_pods';
-$result = mysqli_query($link, $query) or die('Query failed: ' . mysql_error());
+$result = mysqli_query($link, $query) or die('Query failed: ' . mysqli_error($link));
 	$pod01  = $line[0];
 	$pod02  = $line[1];
 	$pod03  = $line[2];
diff --git a/includes/db.php b/includes/db.php
new file mode 100644
index 0000000..7b2bb7a
--- /dev/null
+++ b/includes/db.php
@@ -0,0 +1,71 @@
+<?php
+/**
+ * Centralized database access for PQS.
+ *
+ * Credentials live here intentionally: PQS runs on an air-gapped LAN where the
+ * localhost pqs/pqs account is a formality (see docs/ARCHITECTURE.md §1, §7).
+ *
+ * Targets PHP 7.4+ with mysqlnd (local test stack: PHP 8.3 / MariaDB; see
+ * dev/README.md). All new code should go through these helpers so queries are
+ * parameterized and the connection is opened once per request.
+ */
+
+const PQS_DB_HOST = 'localhost';
+const PQS_DB_USER = 'pqs';
+const PQS_DB_PASS = 'pqs';
+const PQS_DB_NAME = 'pqs';
+
+/**
+ * Shared mysqli connection, opened once per request.
+ * mysqli is put into exception-reporting mode (the default since PHP 8.1) so
+ * failures raise mysqli_sql_exception instead of silently returning false.
+ */
+function pqs_db(): mysqli
+{
+    static $link = null;
+    if ($link === null) {
+        mysqli_report(MYSQLI_REPORT_ERROR | MYSQLI_REPORT_STRICT);
+        $link = new mysqli(PQS_DB_HOST, PQS_DB_USER, PQS_DB_PASS, PQS_DB_NAME);
+    }
+    return $link;
+}
+
+/**
+ * Prepare, bind and execute a parameterized statement; return the statement.
+ * $types is a mysqli bind_param type string, e.g. "si" for (string, int).
+ */
+function pqs_exec(string $sql, string $types = '', array $params = []): mysqli_stmt
+{
+    $stmt = pqs_db()->prepare($sql);
+    if ($types !== '') {
+        $stmt->bind_param($types, ...$params);
+    }
+    $stmt->execute();
+    return $stmt;
+}
+
+/** Run a query and return all rows as associative arrays. */
+function pqs_rows(string $sql, string $types = '', array $params = []): array
+{
+    $stmt = pqs_exec($sql, $types, $params);
+    $res  = $stmt->get_result();
+    $rows = $res ? $res->fetch_all(MYSQLI_ASSOC) : [];
+    $stmt->close();
+    return $rows;
+}
+
+/** Run a query and return the first row (assoc) or null. */
+function pqs_row(string $sql, string $types = '', array $params = []): ?array
+{
+    return pqs_rows($sql, $types, $params)[0] ?? null;
+}
+
+/** Run a query and return a single scalar (first column of first row) or null. */
+function pqs_val(string $sql, string $types = '', array $params = [])
+{
+    $stmt = pqs_exec($sql, $types, $params);
+    $res  = $stmt->get_result();
+    $val  = ($res && ($r = $res->fetch_row())) ? $r[0] : null;
+    $stmt->close();
+    return $val;
+}