From 905c46c4c47c287654f83a8331043cac4ea76797 Mon Sep 17 00:00:00 2001
From: Cyd <cyd@falloutshelterarcade.com>
Date: Wed, 1 Jul 2026 13:50:51 -0500
Subject: [PATCH] Rewrite api.php: parameterized, no DEBUG output

- Strip DEBUG echoes. The 'call is set' line was prefixing the updateinfo JSON
  response, breaking JSON.parse on the display walls so the info-panel
  auto-refresh silently never fired.
- Parameterize updatemerc (was SQL-injectable via $_GET[playerid]).
- Use includes/db.php helpers; set JSON content-type on updateinfo.

Verified: updateinfo returns clean "0"/"1"; updatemerc add/remove flips the
flag; empty response on merc toggle.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 includes/api.php | 59 ++++++++++++++++++++----------------------------
 1 file changed, 24 insertions(+), 35 deletions(-)

diff --git a/includes/api.php b/includes/api.php
index 8bcc58f..4256bb4 100644
--- a/includes/api.php
+++ b/includes/api.php
@@ -1,38 +1,27 @@
 <?php
-$dbconnect = mysqli_connect('localhost', 'pqs', 'pqs') or die('Could not connect: ' . mysqli_error($dbconnect));
-mysqli_select_db($dbconnect, 'pqs') or die('Could not select database');
+/**
+ * Small AJAX endpoint for the consoles and display walls.
+ *   ?call=updatemerc&wdo=add|remove&playerid=N  — toggle a player's merc flag
+ *   ?call=updateinfo                            — has the info panel changed?
+ */
+require_once __DIR__ . '/db.php';
+
 if (isset($_GET['call'])) {
-	$wcall = $_GET['call'];
-	echo "DEBUG: call is set<br>wcall = $wcall<br>";
-	switch ($wcall) {
-		case "updatemerc":
-			echo "DEBUG: updatemerc is called<br>";
-			$wdo = "";
-			if (isset($_GET['wdo'])) $wdo = $_GET['wdo'];
-			switch ($wdo) {
-				case "add":
-					echo "DEBUG: updatemerc add is called<br>";
-					$sql = "UPDATE pqs_queue SET merc = 1 WHERE id = $_GET[playerid]";
-					echo "sql:<br>$sql<br>";
-					mysqli_query($dbconnect, $sql) or die('Update Merc status failed: ' . mysqli_error($dbconnect));
-					break;
-				case "remove":
-					echo "DEBUG: updatemerc remove is called<br>";
-					$sql = "UPDATE pqs_queue SET merc = 0 WHERE id = $_GET[playerid]";
-					echo "sql:<br>$sql<br>";
-					mysqli_query($dbconnect, $sql) or die('Update Merc status failed: ' . mysqli_error($dbconnect));
-					break;
-			}
-			break;
-		case "updateinfo":
-			$sql = "SELECT Updated FROM pqs_infopanel";
-			$getid = mysqli_query($dbconnect, $sql) or die('Query failed: ' . mysqli_error($dbconnect));
-			$rs1 = mysqli_fetch_array($getid);
-			$updateinfo = $rs1[0];
-			mysqli_query($dbconnect, $sql) or die('Query failed: ' . mysqli_error($dbconnect));
-			echo json_encode($updateinfo);
-			break;
-	}
+    switch ($_GET['call']) {
+        case 'updatemerc':
+            $wdo      = $_GET['wdo'] ?? '';
+            $playerid = (int) ($_GET['playerid'] ?? 0);
+            if ($wdo === 'add') {
+                pqs_exec("UPDATE pqs_queue SET merc = 1 WHERE id = ?", 'i', [$playerid]);
+            } elseif ($wdo === 'remove') {
+                pqs_exec("UPDATE pqs_queue SET merc = 0 WHERE id = ?", 'i', [$playerid]);
+            }
+            break;
+
+        case 'updateinfo':
+            $updated = pqs_val("SELECT Updated FROM pqs_infopanel");
+            header('Content-Type: application/json');
+            echo json_encode((string) $updated);
+            break;
+    }
 }
-mysqli_close($dbconnect);
-?>
\ No newline at end of file