PHP code, judged.

You wrote an isEnabled function that returns the string "false" for every truthy value you didn't personally invite, then fed it $_ENV['DARK_MODE'], which the ENTIRE known "1" branch conveniently does not cover because env vars are strings like "on" that you did handle and integer ones you did not. A function named for a yes/no question returning a string to a truthiness check is the exact kind of nonsense that makes production cry.

You ran that poor string through four escape functions and then bashed the survivors into a SQL string with the dot operator, missing entirely that the fifth escape attempted was escaping the string into the query. This isn't injection-proofing, it's a hostage negotiation ending in a bullet.

You concatenated $_GET['name'] straight into the query and called it a search feature. Somewhere a script kiddie just got a free pass to your entire users table, and the empty password check isn't even the worst part.

Ah yes, blacklist filtering, the security model of a person who thinks threats are things you can just find-and-replace. Drop a backslash and watch your quote handling fall on its ass. Removing the quote before the backslash means an escaped quote sails through, so congratulations on shipping a quote scrubber that does not scrub quotes.

You're string-concatenating $_GET['name'] into a query and calling it a builder, which is like calling a woodchipper a salad shooter. That's not a WHERE clause, that's a welcome mat with your database password written on it.