# Authentication Pages Repair Notes

## Corrected

- Loaded `websiteinfo.php` safely on the main authentication page so `$company` is defined.
- Loaded `auth-helpers.php` before helper functions are used.
- Replaced meta-refresh redirect wrappers with real PHP redirects.
- Added CSRF validation to verification-email resend requests.
- Added request-method validation to form processors.
- Added checks for failed database `prepare()` and `execute()` calls.
- Removed dependence on `mysqli_stmt::get_result()` in critical authentication handlers.
- Corrected visitor logging so user agent and device type go into their proper columns.
- Changed the IP lookup to HTTPS and made it optional/non-blocking.
- Corrected relative include paths using `__DIR__`.
- Improved expired/used verification-token handling.
- Prevented repeated verification updates for already verified accounts.
- Preserved the existing `user`, `account`, and `visitor_logs` database tables.

## Deployment requirements

Place this folder at the same level as your existing `constants` folder, so these files exist:

- `../constants/connection.php`
- `../constants/websiteinfo.php`
- `../constants/mailscript.php` (optional; PHP `mail()` is used as fallback)

The supplied SQL schema already contains the verification columns used by these scripts.
