<?php

// Validate and sanitize the score ID
if (!isset($_REQUEST['sid']) || !is_numeric($_REQUEST['sid'])) {
	die('Invalid score ID.');
}

$sid = absint($_REQUEST['sid']);

if ($sid <= 0) {
	die('Invalid score ID.');
}

// Check if user has permission to view this score
$current_user_id = get_current_user_id();
if (!$current_user_id) {
	die('You must be logged in to view score details.');
}

global $wpdb;

// Verify the score exists and belongs to the current user or user has admin privileges
$score = $wpdb->get_row($wpdb->prepare(
	"SELECT * FROM {$wpdb->prefix}golfScores WHERE id = %d",
	$sid
));

if (!$score) {
	die('Score not found.');
}

// Check authorization - user can only view their own scores unless they're an admin
if ($score->user_id != $current_user_id && !current_user_can('manage_options')) {
	die('You do not have permission to view this score.');
}

echo "Score details for ID: " . esc_html($sid);
// Remove information disclosure
// echo $wpdb->prefix;

?>