<ul><li>custom_js.php (CouponsManager): Removed restriction:sitelinkid from getAllCoupon admin call — was routing to member-area filter, returning empty results in admin context</li><li>custom_js.php: Replaced all bare JSON.parse(response) with safe try/catch parse blocks in getAllCoupon, getAllInstances, getAllMultisites, getAllNonMultisites, activateCoupon, getCouponById, deleteCoupon callbacks</li><li>custom_js.php: Fixed wrong notification text in activateCoupon — was showing "Successfully Deleted" on status change; corrected to "Successfully Updated"</li><li>coupon.controller.php: Fixed CSRF token logic — AND should be OR (line 20) — previous logic allowed bypass when token was missing</li><li>coupon.controller.php: Fixed undefined variable $usage in getCouponById() — was $usage, should be $codeDetails[usage]; caused PHP Notice + wrong usage_status value</li><li>coupon.controller.php: Fixed PHP Warnings in iterateActiveCouponsInMemberArea() — added ?? null coalescing on $_SESSION[INSTANCE], $_SESSION[multisite], $_SESSION[YPSiteLinkID], $_SESSION[DomainIdKey]</li><li>coupon.controller.php: Fixed all undefined array key warnings in saveCoupon() — added ?? guards on discount_type, code_value, instance_select, action_save, update_id</li><li>coupon.class.php: Fixed hardcoded account ID 3000 in searchCoupon() — replaced with ACTVACCTID constant</li><li>coupon.class.php: Fixed SQL injection in searchCoupon() and searchAvailableCoupon() — keyword now sanitized with addslashes(); also fixed operator precedence bug (AND/OR without parens around OR clauses)</li><li>CRUD verified: getAllCoupon, getCouponById, saveCoupon (insert), saveCoupon (update), statusCoupon, deleteCoupon — all return clean JSON with 0 PHP warnings</li></ul>