Files
PQS/includes/api.php
T
CydandClaude Opus 4.8 905c46c4c4 Rewrite api.php: parameterized, no DEBUG output
- Strip DEBUG echoes. The 'call is set' line was prefixing the updateinfo JSON
  response, breaking JSON.parse on the display walls so the info-panel
  auto-refresh silently never fired.
- Parameterize updatemerc (was SQL-injectable via $_GET[playerid]).
- Use includes/db.php helpers; set JSON content-type on updateinfo.

Verified: updateinfo returns clean "0"/"1"; updatemerc add/remove flips the
flag; empty response on merc toggle.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-01 13:50:51 -05:00

28 lines
971 B
PHP

<?php
/**
* Small AJAX endpoint for the consoles and display walls.
* ?call=updatemerc&wdo=add|remove&playerid=N — toggle a player's merc flag
* ?call=updateinfo — has the info panel changed?
*/
require_once __DIR__ . '/db.php';
if (isset($_GET['call'])) {
switch ($_GET['call']) {
case 'updatemerc':
$wdo = $_GET['wdo'] ?? '';
$playerid = (int) ($_GET['playerid'] ?? 0);
if ($wdo === 'add') {
pqs_exec("UPDATE pqs_queue SET merc = 1 WHERE id = ?", 'i', [$playerid]);
} elseif ($wdo === 'remove') {
pqs_exec("UPDATE pqs_queue SET merc = 0 WHERE id = ?", 'i', [$playerid]);
}
break;
case 'updateinfo':
$updated = pqs_val("SELECT Updated FROM pqs_infopanel");
header('Content-Type: application/json');
echo json_encode((string) $updated);
break;
}
}