diff --git a/README.md b/README.md
index f69c3af..645d647 100644
--- a/README.md
+++ b/README.md
@@ -1,6 +1,6 @@
 # CourseHub
 
-Self-hosted course video player: PHP 8 + MySQL/MariaDB + Bootstrap 5 + [Plyr](https://github.com/sampotts/plyr).
+Self-hosted course video player: PHP 8.0+ + MySQL/MariaDB + Bootstrap 5 + [Plyr](https://github.com/sampotts/plyr).
 
 Single-page app: `index.php` is a static shell; all navigation, login, browsing,
 playback, and scanning happen over AJAX against the JSON API in `api/`
diff --git a/includes/auth.php b/includes/auth.php
index 6c52e62..cef0c17 100644
--- a/includes/auth.php
+++ b/includes/auth.php
@@ -51,7 +51,8 @@ function attemptLogin(string $username, string $password): bool
     return false;
 }
 
-function registerUser(string $username, string $password): string|true
+/** Returns true on success, or an error-message string. */
+function registerUser(string $username, string $password): string|bool
 {
     if (!preg_match('/^[A-Za-z0-9_.-]{3,50}$/', $username)) {
         return 'Username must be 3-50 characters (letters, digits, _ . -).';
diff --git a/includes/db.php b/includes/db.php
index f72bfe1..e64c4a3 100644
--- a/includes/db.php
+++ b/includes/db.php
@@ -1,6 +1,19 @@
 <?php
 require_once __DIR__ . '/../config.php';
 
+// Uncaught exceptions in web requests become JSON errors (the SPA surfaces
+// them) instead of blank 500 pages; details still go to the PHP error log.
+if (PHP_SAPI !== 'cli') {
+    set_exception_handler(function (Throwable $e): void {
+        error_log($e);
+        http_response_code(500);
+        if (!headers_sent()) {
+            header('Content-Type: application/json');
+        }
+        echo json_encode(['error' => 'Server error: ' . $e->getMessage()]);
+    });
+}
+
 function db(): PDO
 {
     static $pdo = null;