diff --git a/config/functions_db.php b/config/functions_db.php
index fb04c0f..8aa5fd4 100644
--- a/config/functions_db.php
+++ b/config/functions_db.php
@@ -38,6 +38,36 @@ function db_get_active_admins(PDO $pdo): array {
     )->fetchAll(PDO::FETCH_ASSOC);
 }
 
+// Every user, in role order — the listing at views/user/index.php.
+function db_users_list(PDO $pdo): array {
+    return $pdo->query(
+        "SELECT id, name, email, phone, role, is_active, password_hash, last_login_at, last_login_ua
+         FROM users ORDER BY FIELD(role,'sysadmin','admin','staff','client'), name"
+    )->fetchAll(PDO::FETCH_ASSOC);
+}
+
+// Dashboard widget counts (views/admin/dashboard.php).
+function db_users_count_clients(PDO $pdo): int {
+    return (int) $pdo->query("SELECT COUNT(*) FROM users WHERE role = 'client'")->fetchColumn();
+}
+
+function db_users_count_team(PDO $pdo): int {
+    return (int) $pdo->query("SELECT COUNT(*) FROM users WHERE role IN ('admin','staff')")->fetchColumn();
+}
+
+// Profile self-edit (views/user/profile.php) — the contact-details half of
+// the form; the password half already goes through auth_set_password().
+function db_user_update_profile(PDO $pdo, int $userId, array $data): void {
+    $pdo->prepare(
+        "UPDATE users SET phone=?, address=?, city=?, postal_code=?,
+                          email_opt_out=?, sms_opt_out=?, marketing_consent=?
+         WHERE id=?"
+    )->execute([
+        $data['phone'], $data['address'], $data['city'], $data['postal_code'],
+        $data['email_opt_out'], $data['sms_opt_out'], $data['marketing_consent'], $userId,
+    ]);
+}
+
 // PT-PT label for the role ladder.
 function role_label(string $role): string {
     return [
diff --git a/views/admin/dashboard.php b/views/admin/dashboard.php
index 3e54e4f..a1f7dd3 100644
--- a/views/admin/dashboard.php
+++ b/views/admin/dashboard.php
@@ -5,8 +5,8 @@ $user = require_admin();
 
 // Counts for the dashboard widgets.
 $counts = [
-    'clientes' => (int) $pdo->query("SELECT COUNT(*) FROM users WHERE role = 'client'")->fetchColumn(),
-    'equipa'   => (int) $pdo->query("SELECT COUNT(*) FROM users WHERE role IN ('admin','staff')")->fetchColumn(),
+    'clientes' => db_users_count_clients($pdo),
+    'equipa'   => db_users_count_team($pdo),
     'leads_novos' => db_membership_leads_count_new($pdo),
 ];
 
diff --git a/views/user/index.php b/views/user/index.php
index e1d4ea4..1931f76 100644
--- a/views/user/index.php
+++ b/views/user/index.php
@@ -3,10 +3,7 @@ require __DIR__ . '/../../config/db.php';
 require __DIR__ . '/../../config/functions.php';
 $user = require_admin();
 
-$users = $pdo->query(
-    "SELECT id, name, email, phone, role, is_active, password_hash, last_login_at, last_login_ua
-     FROM users ORDER BY FIELD(role,'sysadmin','admin','staff','client'), name"
-)->fetchAll(PDO::FETCH_ASSOC);
+$users = db_users_list($pdo);
 
 include __DIR__ . '/../../includes/header.php';
 ?>
diff --git a/views/user/profile.php b/views/user/profile.php
index 83f96b5..843066a 100644
--- a/views/user/profile.php
+++ b/views/user/profile.php
@@ -42,11 +42,10 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') {
         $sms_opt      = isset($_POST['sms_opt_out']) ? 1 : 0;
         $marketing    = isset($_POST['marketing_consent']) ? 1 : 0;
         $before = db_get_user($pdo, (int) $user['id']) ?? [];
-        $pdo->prepare(
-            "UPDATE users SET phone=?, address=?, city=?, postal_code=?,
-                              email_opt_out=?, sms_opt_out=?, marketing_consent=?
-             WHERE id=?"
-        )->execute([$phone, $address, $city, $postal_code, $email_opt, $sms_opt, $marketing, $user['id']]);
+        db_user_update_profile($pdo, (int) $user['id'], [
+            'phone' => $phone, 'address' => $address, 'city' => $city, 'postal_code' => $postal_code,
+            'email_opt_out' => $email_opt, 'sms_opt_out' => $sms_opt, 'marketing_consent' => $marketing,
+        ]);
         audit('user.profile_update', [
             'target_type' => 'user', 'target_id' => (int) $user['id'], 'target_label' => (string) $user['name'],
             'changes' => platform_audit_diff(