false, 'message' => 'Service ID required'], 400); } updateService($id); break; case 'DELETE': requireAuth(); if (!$id) { jsonResponse(['success' => false, 'message' => 'ID required'], 400); } deleteService($id); break; default: jsonResponse(['success' => false, 'message' => 'Method not allowed'], 405); } function getServices() { global $db; $services = $db->getAll('services'); // Sort by order usort($services, function($a, $b) { return ($a['order'] ?? 99) - ($b['order'] ?? 99); }); // Public view: only active if (!checkAuth()) { $services = array_filter($services, function($s) { return ($s['active'] ?? true) === true; }); } jsonResponse(['success' => true, 'data' => array_values($services)]); } function getService($id) { global $db; $service = $db->get('services', $id); if (!$service) jsonResponse(['success' => false, 'message' => 'Not found'], 404); jsonResponse(['success' => true, 'data' => $service]); } function createService() { global $db; $data = !empty($_POST) ? $_POST : getRequestBody(); if (empty($data['name'])) { jsonResponse(['success' => false, 'message' => 'Service name is required'], 400); } // Sanitize text fields $data['name'] = sanitize($data['name']); $data['icon'] = sanitize($data['icon'] ?? ''); $data['features'] = sanitize($data['features'] ?? ''); $data['price'] = sanitize($data['price'] ?? ''); // Sanitize description: allow only safe formatting tags (no