Alekiii1/ScoutSphere-project

ScoutSphere – A digital talent discovery platform connecting youth athletes in Kenya with verified scouts, academies, and coaches. # ScoutSphere Digital talent discovery platform connecting youth athletes in Kenya with verified scouts. ## Setup 1. Import the schema: `mysql -u root -p ` tag on another site). Converted to `POST` forms with CSRF tokens. - `shortlist.php`: accepted `POST` with no CSRF check at all. Added `requireValidCSRF()`. - `includes/db.php`: `.env` was referenced by `functions.php` but never actually loaded, so `ENCRYPTION_KEY` silently fell back to a hardcoded placeholder. Added a minimal `.env` loader, and `getEncryptionKey()` now throws instead of silently using a known key. - `upload.php`: no file-upload validation existed anywhere in the original docs (it just said "with file validation" without code). Added: MIME-type sniffing via `finfo` (not trusting client-supplied `Content-Type` or filename), a fixed allow-list of video/image types, a 50MB size cap, and randomly generated filenames on disk to prevent path traversal / overwrite attacks. - `login.php`: added session regeneration on login (prevents session fixation), `httponly`/`samesite` cookie flags, and basic brute-force throttling. - `logout.php`: now actually clears the "remember me" cookie (previously only destroyed the session). - Every user-supplied value rendered into HTML now goes through `h()` (an `htmlspecialchars` wrapper) — a few spots in the original echoed values directly. **Missing pieces filled in** - `index.php`, `signup.php`, `dashboard.php`, `profile.php`, `upload.php`, `messages.php`, `css/style.css`, `js/main.js` — these were referenced as complete but weren't actually in the transfer doc. Written from scratch to match the described schema and features. - `shortlist.php` previously had no way to *view* your shortlist, only add to it. Added a view. - `notifications.php` had no code path that ever created a notification. Added `createNotification()` and wired it into the messaging and admin-verification flows. - Added `requireLogin()` / `requireRole()` helpers so auth checks are consistent acro …