KHA SENG GROUP CUSTOM WEBSITE — VERSION 6 (STAGING BUILD)
========================================================

WHAT CHANGED IN V6
- Keeps the approved multi-page design and current branding work.
- Adds a custom PHP/MySQL news administration panel at /admin/.
- Admin sign-in uses PHP password_hash/password_verify, session ID regeneration, CSRF tokens and prepared SQL statements.
- Admin can create/edit articles, set draft/published/archived status, assign a category, add a short summary and upload a JPG/PNG/WebP featured image (maximum 4 MB).
- The public News & Updates page now reads published articles from MySQL. Draft and archived articles are not shown publicly.
- Logo treatment remains unchanged for now, as requested; we can solve the final logo asset separately.

IMPORTANT
This is a STAGING DEVELOPMENT BUILD, not yet a production launch package. Do not overwrite the live WordPress website. Test only in staging.khasenggroup.com.my. The staging site should remain protected from indexing and should not contain real confidential data.

INSTALLATION ON CPANEL STAGING
1. Back up the current staging folder before replacing files. Keep production untouched.
2. Upload/extract the contents of this package into:
   /public_html/staging.khasenggroup.com.my/
   Make sure index.php is directly in that document root, not buried in an extra folder.
3. In cPanel > MySQL Databases, create a NEW database and a NEW database user for staging. Assign that user to the database with only the privileges needed for the application. Do not reuse the live WordPress database or credentials.
4. Open phpMyAdmin, select the new staging database, and import database/schema.sql.
5. Edit includes/config.php and enter the staging database host, database name, username and password. cPanel database names/usernames often include the cPanel account prefix.
6. Create the first admin account in phpMyAdmin. Generate a password hash using PHP on a trusted local machine with PHP installed:
      php -r "echo password_hash('REPLACE_WITH_A_LONG_UNIQUE_PASSWORD', PASSWORD_DEFAULT), PHP_EOL;"
   Copy the resulting hash (not the plaintext password) into the SQL below, then run it in phpMyAdmin after replacing the email, display name and hash:
      INSERT INTO admins (email, password_hash, display_name, is_active)
      VALUES ('your-admin-email@example.com', 'PASTE_GENERATED_HASH_HERE', 'Website Administrator', 1);
   Use a unique password and do not send it in chat or email.
7. Confirm SSL/HTTPS works on the staging subdomain before signing in. Visit:
   https://staging.khasenggroup.com.my/admin/login.php
8. Sign in and create a test article as Draft. Confirm it does NOT appear on /news.php. Change it to Published and confirm it appears on /news.php. Change it to Archived and confirm it disappears from the public page.
9. Test image upload with a non-confidential test image. If upload fails, check PHP upload_max_filesize/post_max_size and folder permissions. The uploads/news folder should be writable by PHP but not world-writable.
10. Delete any temporary test content before review. Keep the staging noindex headers in place until launch.

ADMIN ROUTES
- /admin/login.php — sign in
- /admin/index.php — article list
- /admin/article.php — create/edit an article
- /admin/logout.php — sign out

DATABASE TABLES
- admins — administrator accounts and login metadata
- articles — article content, category, status, featured image and publication date

SECURITY / RELEASE NOTES
- The package deliberately has no default admin account or default password.
- Keep includes/config.php private; it contains database credentials. The application needs it, but never publish its contents.
- Do not upload PHP files into uploads/news. The folder has a deny rule for PHP execution, and the application validates image MIME type and size. Review server-specific Apache configuration before launch.
- The login page currently has basic authentication protections but does not yet include login rate limiting, password reset, audit logs or multi-factor authentication. These should be considered before production launch.
- Article body is rendered as escaped plain text with line breaks; raw HTML is not accepted. This is intentional for the initial safer release.
- The contact page form/email handling is not implemented yet. Do not advertise the staging contact page as a live enquiry form.
- Before production: test on the host's patched supported PHP runtime, verify backup and restore, review permissions, add rate limiting/audit logging, verify all factual content and contact details, and perform desktop/mobile/browser checks.

CURRENT DESIGN / CONTENT STATUS
- Visual pages: Home, About Us, Our Businesses, Our Legacy, Leadership, News & Updates, Contact Us.
- Current featured businesses: KWC Fashion Wholesale and Central Market Kuala Lumpur.
- Historical properties are presented as legacy milestones, not as current group-owned assets.
- Leadership biographies and contact details should receive final approval before launch.
