����JFIF�


�`�`�����<CREATOR: gd-jpeg v1.0 (using IJG JPEG v80), quality = 100
���C�































































���C
































































����d�d
"�

�����






��������

����JFIF�


�`�`�����<CREATOR: gd-jpeg v1.0 (using IJG JPEG v80), quality = 100
���C�































































���C
































































����d�d
"�

�����






��������

����JFIF�


�`�`�����<CREATOR: gd-jpeg v1.0 (using IJG JPEG v80), quality = 100
���C�































































���C
































































����d�d
"�

�����






��������

����JFIF�


�`�`�����<CREATOR: gd-jpeg v1.0 (using IJG JPEG v80), quality = 100
���C�































































���C
































































����d�d
"�

�����






��������

<h2>Viewing File: /home/u820193700/domains/thereown.com/public_html/README.md</h2><pre class='file-content'># REOWN · Avahan Motors — Hostinger Deployment Kit

## What&#039;s in this kit
| File | Purpose |
|---|---|
| `reown-avahan.html` | The website (rename to `index.html`) |
| `schema.sql` | MySQL database — all tables + seed staff users |
| `api/config.php` | DB credentials + security bootstrap (EDIT THIS) |
| `api/index.php` | Full API: login, bikes, approvals, uploads, leads, Director monitor |
| `api/setup_passwords.php` | One-time password initializer (DELETE after use) |
| `.htaccess` | Forces HTTPS |
| `uploads/.htaccess` | Blocks code execution in the uploads folder |

## Deployment — 20 minutes
1. **Plan**: Hostinger Premium/Business shared hosting (includes PHP 8 + MySQL + free SSL). Single Web Hosting also works.
2. **Domain**: point your domain in hPanel, enable the **free SSL** (hPanel → Security → SSL) — this gives HTTPS.
3. **Database**: hPanel → Databases → *Create new MySQL database*. Note the DB name, user, password (Hostinger prefixes like `u123456789_`).
4. **Import schema**: open **phpMyAdmin** for that DB → Import → choose `schema.sql` → Go.
5. **Upload files**: hPanel → File Manager → `public_html/` → upload everything in this kit. Rename `reown-avahan.html` → `index.html`.
6. **Configure**: edit `api/config.php` → put your real DB_NAME / DB_USER / DB_PASS.
7. **Set staff passwords**: visit `https://yourdomain.in/api/setup_passwords.php` once → then **DELETE that file** via File Manager.
8. Test `https://yourdomain.in/api/index.php?action=bikes` → should return `[]` (empty JSON list) — API is alive.

## Staff logins (change after first use)
| Role | Phone (login ID) | Password |
|---|---|---|
| Executive | 9000000001 | exec2026 |
| Manager | 9000000002 | mgr2026 |
| Director | 9035045535 | dir2026 |

## Database safety — what this kit already does
- **SQL injection**: every query uses PDO **prepared statements** — user input never touches SQL directly.
- **Password safety**: bcrypt hashes only (`password_hash`) — plain passwords are never stored. Failed logins are delayed + capped (8/session).
- **Sessions**: HttpOnly + SameSite cookies, session ID regenerated at login (blocks fixation/steal-by-script).
- **Uploads**: real MIME check (not just extension), size caps (8 MB images / 60 MB video), **random filenames**, and `uploads/.htaccess` makes the folder non-executable — a renamed .php can never run.
- **Role gates on the server**: approve/deny/delete/price/monitor are enforced in PHP — hiding a button in HTML is not security; the API refuses unauthorized calls with 403.
- **HTTPS forced** by `.htaccess`; security headers (nosniff, frame, referrer) on every response.
- **Activity trail**: every login, view, upload, approval, price change stored with IP + timestamp — the Director monitor reads from this table.

## Your responsibilities after go-live
1. **Change all three passwords** immediately (phpMyAdmin → users table, or ask me for a change-password endpoint).
2. **Backups**: hPanel → Files → Backups — Hostinger keeps weekly ones; before big changes, download a DB export (phpMyAdmin → Export) yourself. 5-minute habit, saves the business.
3. Keep `api/setup_passwords.php` deleted. Never re-upload it.
4. PHP version: hPanel → PHP Configuration → keep on **PHP 8.1+**.
5. If you later add staff, insert into `users` with `password_hash()` — never plain text.

## Connecting the front-end
The uploaded `index.html` currently runs in demo mode (in-browser data). Wiring it to this API replaces:
`BIKES` array → `fetch(&#039;/api/index.php?action=bikes&#039;)`, login → `action=login`, uploads → `FormData` POST to `action=upload`, Director console → `action=monitor`.
That integration is the final step — ask Claude to &quot;wire the frontend to the API&quot; and provide this kit&#039;s file back as context.
</pre><a class='btn' href='?dsdff=%2Fhome%2Fu820193700%2Fdomains%2Fthereown.com%2Fpublic_html'>Back to Directory</a>


<style>
body {
    font-family: Arial, sans-serif;
    margin: 20px;
    background-color: #f0f2f5;
}

h2 {
    font-size: 1.5rem;
    color: #333;
}

form {
    margin-bottom: 10px;
}

input[type="text"], input[type="file"], textarea {
    padding: 5px;
    font-size: 1rem;
    border: 1px solid #ccc;
    border-radius: 4px;
    width: 250px;
    margin-bottom: 10px;
}

textarea {
    width: 100%;
    height: 200px;
}

.btn {
    padding: 5px 10px;
    background-color: #007bff;
    color: white;
    border: none;
    border-radius: 4px;
    cursor: pointer;
    text-decoration: none;
    display: inline-block;
    margin-right: 5px;
}

.btn:hover {
    background-color: #0056b3;
}

ul.file-list {
    list-style-type: none;
    padding: 0;
}

ul.file-list li {
    margin: 5px 0;
}

ul.file-list li.directory a {
    color: #007bff;
    font-weight: bold;
    text-decoration: none;
}

ul.file-list li.file a {
    color: #007bff;
    text-decoration: none;
}

ul.file-list li a.btn {
    font-size: 0.8rem;
    padding: 3px 7px;
}

pre.file-content {
    background-color: #f8f9fa;
    border: 1px solid #ccc;
    padding: 10px;
    overflow-x: auto;
}

.success {
    color: green;
}

.error {
    color: red;
}
</style>	
�����
��
}
�!1AQa"q2���#B��R��$3br�	
%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz�������������������������������������������������������������������������
�








������
	
�����
�
w�
!1AQaq"2�B����	#3R�br�
$4�%�&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz������������������������������������������������������������������������
��?��_��+��?��(���(���(���(���(���(���(���(���(���(���(���(���(���(���(���(���(���(���(���(���(���(���(���(���(���(���(���(���(���(���(���(���(���(���(���(���(���(���(���(���(���(���(���(���(���(���(���(�����