diff --git a/admin/orders.php b/admin/orders.php
index e03091c..d207205 100644
--- a/admin/orders.php
+++ b/admin/orders.php
@@ -45,8 +45,10 @@ if ($status) {
 }
 
 if ($search) {
-    $where[] = '(order_number LIKE :search OR customer_name LIKE :search OR customer_email LIKE :search)';
-    $params['search'] = '%' . $search . '%';
+    $where[] = '(order_number LIKE :search1 OR customer_name LIKE :search2 OR customer_email LIKE :search3)';
+    $params['search1'] = '%' . $search . '%';
+    $params['search2'] = '%' . $search . '%';
+    $params['search3'] = '%' . $search . '%';
 }
 
 if ($dateFrom) {
diff --git a/api/orders.php b/api/orders.php
index 4fef865..2785386 100644
--- a/api/orders.php
+++ b/api/orders.php
@@ -23,15 +23,22 @@ switch ($method) {
                 "SELECT * FROM orders WHERE order_id = :id",
                 ['id' => $orderId]
             );
-            
+
             if (!$order) {
                 jsonResponse(['error' => 'Order not found'], 404);
             }
-            
+
+            // Only the admin or the customer who placed this order may view it by raw id.
+            $customer = CustomerAuth::getUser();
+            $isOwner = $customer && (string)$customer['customer_id'] === (string)$order['customer_id'];
+            if (!AdminAuth::isLoggedIn() && !$isOwner) {
+                jsonResponse(['error' => 'Unauthorized'], 401);
+            }
+
             $order['items'] = json_decode($order['items'], true);
             $order['shipping_address'] = json_decode($order['shipping_address'], true);
             unset($order['id']);
-            
+
             jsonResponse($order);
         } elseif ($orderNumber) {
             $email = $_GET['email'] ?? '';
@@ -71,7 +78,9 @@ switch ($method) {
     case 'POST':
         // Update order status (admin)
         if ($action === 'update_status') {
-            // Admin check would go here
+            if (!AdminAuth::isLoggedIn()) {
+                jsonResponse(['error' => 'Unauthorized'], 401);
+            }
             $orderId = $input['order_id'] ?? '';
             $status = $input['status'] ?? '';
             $trackingNumber = $input['tracking_number'] ?? null;