diff --git a/app/assets/utils/db_auth.php b/app/assets/utils/db_auth.php
index f57d78a..b4c89b9 100644
--- a/app/assets/utils/db_auth.php
+++ b/app/assets/utils/db_auth.php
@@ -1,14 +1,16 @@
 <?php
 
+// Must be first — ensures any fatal/exception outputs a JSON body, not HTML.
+// Errors still go to the server log; display is suppressed so they cannot
+// corrupt the JSON response body.
+ini_set('display_errors', 0);
+ini_set('log_errors', 1);
+header('Content-Type: application/json; charset=utf-8');
+
 require_once __DIR__."/../../config.php";
 require_once __DIR__."/../../dbconn.php";
 require_once __DIR__."/db_helpers.php";
 
-// Tell the browser (and jQuery) the response body is JSON.
-// Without this, responses default to text/html, which prevents
-// xhr.responseJSON from being populated automatically in ajax_request().
-header('Content-Type: application/json; charset=utf-8'); 
-
 if (!function_exists('require_role')) {
     function require_role(string $user_role, array $allowed): void {
         if (!in_array($user_role, $allowed, true)) {