1. ';
       return strip_tags($html, $allowed);
   }
   
   $request_uri = $_SERVER['REQUEST_URI'];
   $script_name = $_SERVER['SCRIPT_NAME'];
   $base_path = dirname($script_name);
   $base_path = $base_path == '/' ? '' : $base_path;
   $route = str_replace($base_path, '', $request_uri);
   $route = strtok($route, '?');
   if (strpos($route, '/api/') === 0) {
       if (API_ENABLE_CORS) { header('Access-Control-Allow-Origin: *'); header('Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS'); if ($_SERVER['REQUEST_METHOD'] === 'OPTIONS') exit(0); }
       header('Content-Type: application/json'); $method = $_SERVER['REQUEST_METHOD']; $api_route = substr($route, 5);
       if ($api_route === 'save' && $method === 'POST') { $input = json_decode(file_get_contents('php://input'), true); $title = trim($input['title'] ?? ''); $content = sanitize_html($input['content'] ?? ''); $stmt = $db->prepare("INSERT INTO documents (title, content) VALUES (:title, :content)"); $stmt->bindValue(':title', $title, SQLITE3_TEXT); $stmt->bindValue(':content', $content, SQLITE3_TEXT); $stmt->execute(); echo json_encode(['success' => true, 'id' => $db->lastInsertRowID()]); exit; }
       if ($api_route === 'load' && $method === 'GET' && isset($_GET['id'])) { $id = intval($_GET['id']); $stmt = $db->prepare("SELECT title, content FROM documents WHERE id = :id"); $stmt->bindValue(':id', $id, SQLITE3_INTEGER); $result = $stmt->execute(); $doc = $result->fetchArray(SQLITE3_ASSOC); echo json_encode($doc ? ['success' => true, 'title' => $doc['title'], 'content' => $doc['content']] : ['success' => false]); exit; }
       if ($api_route === 'list' && $method === 'GET') { $result = $db->query("SELECT id, title, updated_at FROM documents ORDER BY updated_at DESC"); $docs = []; while ($row = $result->fetchArray(SQLITE3_ASSOC)) $docs[] = $row; echo json_encode(['success' => true, 'documents' => $docs]); exit; }
       if ($api_route === 'delete' && $method === 'DELETE') { $input = json_decode(file_get_contents('php://input'), true); $id = intval($input['id'] ?? 0); $stmt = $db->prepare("DELETE FROM documents WHERE id = :id"); $stmt->bindValue(':id', $id, SQLITE3_INTEGER); $stmt->execute(); echo json_encode(['success' => true]); exit; }
       if ($api_route === 'upload' && $method === 'POST' && isset($_FILES['image'])) { $file = $_FILES['image']; $ext = strtolower(pathinfo($file['name'], PATHINFO_EXTENSION)); if (!in_array($ext, ALLOWED_IMG_EXT) || $file['size'] > MAX_FILE_SIZE) { http_response_code(400); echo json_encode(['error' => 'Invalid file']); exit; } $filename = uniqid() . '.' . $ext; $dest = UPLOAD_DIR . '/' . $filename; move_uploaded_file($file['tmp_name'], $dest); echo json_encode(['location' => $dest]); exit; }
       http_response_code(404); echo json_encode(['error' => 'API endpoint not found']); exit;
   }
   
   // Render editor UI
   function render_editor_ui($clean = false, $demo = false) {
       $backlink = '
   Powered by 3PC Editor — Part of the ServeIt Network | Remove this link with $5 donation
   ';
       $toolbarConfig = array (
     'bold' => true,
     'italic' => true,
     'underline' => true,
     'ul' => true,
     'ol' => true,
     'alignLeft' => true,
     'alignCenter' => true,
     'alignRight' => true,
     'link' => true,
     'image' => true,
     'table' => true,
     'undo' => true,
     'redo' => true,
     'source' => true,
     'darkMode' => true,
     'fullscreen' => true,
   );
       ob_start(); ?>
   📄 Documents
   + New
   📊 Stats
   Auto-save
   Ready