<ul><li><strong>organization.controller.php</strong>: Fixed CSRF bypass in verifyToken() — AND changed to OR. With AND operator, a request with _token present but invalid passed through unvalidated.</li><li><strong>accounts.php</strong>: Added $activeacctid = $_SESSION[activeacctid] ?? null before switch — used in cases 3/4/5 but never defined, causing undefined variable and null DB queries.</li><li><strong>accounts.php</strong>: Fixed broken HTML on line 416 — closing li tag had missing forward slash.</li><li><strong>accounts.php</strong>: Replaced 3 active $.parseJSON() calls with JSON.parse() wrapped in try/catch.</li><li><strong>inc/ajax.php</strong>: Replaced manual require_once(BASEPATH_...) calls with spl_autoload_register.php load — BASEPATH_ was undefined on direct AJAX requests, causing PHP 8 fatal error on delete account.</li></ul>