idk

config/db.php

@@ -49,8 +49,16 @@ $pass = env('DB_PASS');
 $dsn = "mysql:host=$host;port=$port;dbname=$db;charset=utf8mb4";
 
 try {
-    $pdo = new PDO($dsn, $user, $pass);
-    $pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
+    $pdo = new PDO($dsn, $user, $pass, [
+        PDO::ATTR_ERRMODE            => PDO::ERRMODE_EXCEPTION,
+        // Real server-side prepares (not driver emulation): a tighter defence
+        // against injection than emulated string-interpolation. Safe here — the
+        // codebase uses positional ? params (no reused :named, no bound LIMIT).
+        PDO::ATTR_EMULATE_PREPARES   => false,
+        // Keep values coming back as strings, as the emulated driver did, so the
+        // type change from native prepares doesn't ripple through existing code.
+        PDO::ATTR_STRINGIFY_FETCHES  => true,
+    ]);
 } catch (PDOException $e) {
     _bootstrap_fail('PDO connect failed: ' . $e->getMessage());
 }