<?php
/**
 * query.php — PHP 8.4 compatible
 *
 * ORIGINAL FILE ISSUES (all critical):
 *  1. This was a debug/diagnostic file left in production — it echoed raw
 *     member emails and password hashes to anyone who loaded the URL.
 *  2. mysqli_query($query) was missing the $connection argument — PHP 8 fatal error.
 *  3. Contained a commented-out mysql_query() call (removed in PHP 7.0).
 *
 * FIX:
 *  - Replaced with a safe, access-controlled diagnostic stub.
 *  - Only accessible when explicitly enabled via a constant in configuration.php.
 *  - Sensitive data (passwords) is never echoed.
 *  - Uses a prepared statement.
 *
 * RECOMMENDATION: Delete this file entirely from production servers.
 *   It serves no purpose in a live environment.
 */

require('configuration.php');

// Guard: this file must never run in production.
// To use for local diagnostics, define DEBUG_QUERY_ENABLED = true in configuration.php.
if (!defined('DEBUG_QUERY_ENABLED') || DEBUG_QUERY_ENABLED !== true) {
    http_response_code(404);
    exit('Not found.');
}

// Example safe diagnostic query — never echoes password fields.
$stmt = mysqli_prepare(
    $connection,
    "SELECT memberid, member_email FROM member WHERE member_email = ? LIMIT 1"
);

$test_email = 'chris@pinnacle-fitness.com'; // hardcoded for diagnostic only
mysqli_stmt_bind_param($stmt, 's', $test_email);
mysqli_stmt_execute($stmt);
$result = mysqli_stmt_get_result($stmt);

while ($row = mysqli_fetch_assoc($result)) {
    echo 'ID: '    . htmlspecialchars((string)$row['memberid'],    ENT_QUOTES, 'UTF-8') . '<br>';
    echo 'Email: ' . htmlspecialchars((string)$row['member_email'], ENT_QUOTES, 'UTF-8') . '<br>';
}

mysqli_stmt_close($stmt);
