<?php
// db.php — database connection
// IMPORTANT: move credentials to an .env file or server environment variables.
// Never commit plain-text passwords to version control.

$DB_HOST = getenv('DB_HOST') ?: '127.0.0.1';
$DB_NAME = getenv('DB_NAME') ?: 'ssisbcom_mhp_purchasing';
$DB_USER = getenv('DB_USER') ?: 'ssisbcom_meihotelpenang';
$DB_PASS = getenv('DB_PASS') ?: 'Shijieyu@0312';   // fallback for legacy deploy

try {
    $pdo = new PDO(
        "mysql:host=$DB_HOST;dbname=$DB_NAME;charset=utf8mb4",
        $DB_USER,
        $DB_PASS,
        [
            PDO::ATTR_ERRMODE            => PDO::ERRMODE_EXCEPTION,
            PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC,
            PDO::ATTR_EMULATE_PREPARES   => false,
        ]
    );
} catch (PDOException $e) {
    // Log to file, never expose to browser
    error_log('DB connection failed: ' . $e->getMessage());
    http_response_code(500);
    exit('Service temporarily unavailable.');
}
