<?php
/**
 * member_session.php — PHP 8.4 compatible
 *
 * Changes from original:
 *  - Path changed from '../coach/configuration.php' to 'configuration.php'
 *    so the file is self-contained within the portal folder.
 *    (Adjust back to '../coach/configuration.php' if your deployment requires it.)
 *  - Replaced interpolated mysqli_query() with a prepared statement to prevent SQLi.
 *  - Added exit() after every header() call (required in PHP 8; without it execution
 *    continues past the redirect on some server configs).
 *  - $login_session now checked with isset() after fetch; null-safe pattern used.
 *  - Removed unnecessary mysqli_close() calls — connection stays open for the page.
 */

require_once('configuration.php');

if (session_id() === '') {
    session_start(['gc_maxlifetime' => 14400, 'cookie_httponly' => true]);
}

if (!isset($_SESSION['login_member'])) {
    header('Location: index.php');
    exit();
}

$user_check = $_SESSION['login_member'];

// ── Prepared statement — $user_check was interpolated directly before ─────────
$stmt = mysqli_prepare(
    $connection,
    "SELECT member_email FROM member WHERE member_email = ? LIMIT 1"
);

$login_session = null;

if ($stmt) {
    mysqli_stmt_bind_param($stmt, 's', $user_check);
    mysqli_stmt_execute($stmt);
    $result = mysqli_stmt_get_result($stmt);
    $row    = mysqli_fetch_assoc($result);
    mysqli_stmt_close($stmt);

    $login_session = $row['member_email'] ?? null;
}

if ($login_session === null) {
    header('Location: index.php');
    exit();
}
