Complete the admin module migration: list()->[], setRedirect(), getVar() for all remaining admin panel modules. Includes security.php IP/ban management and statistic/uploads modules.

Core changes:

1. privat.php:
2. setRedirect() replaces header()+exit; pairs
3. ratings.php:
4. list() → [] for sql_fetchrow() destructuring
5. setRedirect() replaces header()+exit; pairs
6. referers.php:
7. list() → [] throughout
8. setRedirect() replaces header()+exit; pairs
9. replace.php:
10. setRedirect() replaces header()+exit; pairs
11. security.php (admin module):
12. list() → [] throughout
13. setRedirect() replaces header()+exit; pairs
14. statistic.php:
15. list() → [] throughout
16. setRedirect() replaces header()+exit; pairs
17. template.php:
18. list() → [] throughout
19. setRedirect() replaces header()+exit; pairs
20. uploads.php:
21. list() → [] throughout
22. setRedirect() replaces header()+exit; pairs

Benefits:

• All 22 admin modules now use uniform redirect and array destructuring
• No direct superglobal header() calls remain in admin module layer

Technical notes:

• Purely syntactic/convention migration; zero logic changes
• Backward compatible with existing sessions and DB state

Replace deprecated list() with short array syntax [], use setRedirect() instead of header()+exit; pairs, switch $_COOKIE reads to getVar(), and fix null-default values on getVar() calls across seven admin modules.

Core changes:

1. admins.php:
2. list() → [] for sql_fetchrow() destructuring
3. getVar('post', 'amodules[]', 'var', []) — explicit empty default
4. $_COOKIE['sl_close_9'] → getVar('cookie', 'sl_close_9', 'num', 0)
5. setRedirect() replaces header()+exit; pairs
6. del(): guard $id > 0 before DELETE query
7. blocks.php:
8. list() → [] throughout
9. setRedirect() replaces header()+exit; pairs
10. getVar defaults corrected
11. categories.php:
12. list() → [] throughout
13. setRedirect() replaces header()+exit; pairs
14. comments.php:
15. list() → [] throughout
16. setRedirect() replaces header()+exit; pairs
17. config.php:
18. setRedirect() replaces header()+exit; pairs
19. database.php:
20. setRedirect() replaces header()+exit; pairs
21. editor.php:
22. list() → [] throughout
23. setRedirect() replaces header()+exit; pairs

Benefits:

• Eliminates silent header()/exit anti-pattern; redirects now centralized
• Short array syntax aligns with PHP 7.1+ codebase conventions
• getVar() for cookies prevents direct superglobal access

Technical notes:

• Behavior preserved; no logic changes
• Backward compatible with existing DB schema

Extend the SEO pipeline with two new template tokens ([headline], [author]) and align core utility functions with the codebase conventions: getVar() for input, resolved absolute paths in checkPerms(), improved getImgText() with [img] BBCode support, and the renamed head()->setHead(array \$seo).

Core changes:

1. Schema.org default config (config/global.php):
2. Replace "headline": "0" with "headline": "[headline]"
3. Replace "name": "[site]" (author) with "name": "[author]"
4. System utilities (core/system.php):

5. Rename head() to setHead(array \$seo = []) — accepts optional SEO fields

   • New keys: title, desc, img, time, ctitle, author
   • Derive \$headline from \$seo['title'] (plain text, no compound suffix)
6. Add [headline] and [author] to SEO from/to replacement arrays

7. Refactor checkPerms(string \$fp, int \$id) to checkPerms(string \$fp)

   • Callers now pass absolute path directly; no id-based base resolution

8. Extend getImgText() with \$check=true param and [img=…][/img] BBCode

   • Supports and forms
   • \$check=false skips file_exists() for remote/virtual images
9. Fix fields_in(): explode('|', \$fieldb ?? '') — null-safe coalesce
10. Admin core (core/admin.php):
11. Replace func_get_args() in getStatistic() with getVar('get', …)
12. Fix checkPerms() calls: prepend BASE_DIR.'/' to construct absolute paths
13. Declare getStatistic(): void return type

Benefits:

• Schema.org headline and author now populated with real article data
• setHead() API eliminates scattered global variable mutations in modules
• getImgText() handles [img] BBCode variants without regex fragility

Technical notes:

• setHead() is backward-compatible when called with empty array
• All old call sites of head()/foot() must migrate to setHead()/setFoot()

The regex used to extract table names from INSERT statements could match partial identifiers where a word character preceded the underscore prefix, producing false-positive table matches.

Core changes:

1. tests/InsertValidationTest.php:
2. Add negative lookbehind (?<!\w) before _(\w+) in INSERT pattern
3. Ensures the prefix underscore is only matched at a word boundary

Benefits:

• Eliminates false-positive table name matches in test assertions
• Test results more accurately reflect actual INSERT targets

Technical notes:

• Pattern change is regex-only; test logic and assertions unchanged
• Lookbehind is zero-width and does not affect captured groups

Two issues in the auto_links admin add() function corrected.

Core changes:

1. auto_links/admin/index.php:
2. Add \$stop = \$stop ?? []; guard before first use to prevent undefined var

3. Remove save_text() wrapper around getVar() calls for a_sitename and a_description: input encoding should happen at save time, not on read

Benefits:

• Prevents PHP notice/warning on fresh add form where \$stop is undefined
• Separates input retrieval from output encoding responsibility

Technical notes:

• save_text() is called correctly in the save handler; reading back raw values from getVar() is the expected pattern for form pre-population