- Strip DEBUG echoes. The 'call is set' line was prefixing the updateinfo JSON
response, breaking JSON.parse on the display walls so the info-panel
auto-refresh silently never fired.
- Parameterize updatemerc (was SQL-injectable via $_GET[playerid]).
- Use includes/db.php helpers; set JSON content-type on updateinfo.
Verified: updateinfo returns clean "0"/"1"; updatemerc add/remove flips the
flag; empty response on merc toggle.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
CydandClaude Opus 4.8