Both now use db.php helpers with bound params: history's mission index (was
injectable via $_GET[index]) and the callsign LIKE search. Loops switched to
associative fetches.
Verified: history shows the committed mission + players + merc count; search
finds a queued callsign.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>