Zploit 0-Day Shell

:: Editing File: login.php

<?php

// login.php (Using Plain Text Passwords - UNSAFE)
session_start();
require_once 'db.php';

// Check if user is already logged in
if (isset($_SESSION['loggedin']) && $_SESSION['loggedin'] === true) {
    header("location: dashboard.php");
    exit;
}

// Check for form submission
if ($_SERVER["REQUEST_METHOD"] == "POST") {

// Initialize default error message
    $error_message = "Invalid username or password.";

// 1. Sanitize and retrieve data from the POST request
    // IMPORTANT: Escape all user input, as it's used directly in the query.
    $username = mysqli_real_escape_string($conn, $_POST['username']);
    $password = mysqli_real_escape_string($conn, $_POST['password']);

// 2. Build and execute the query
    // Query selects users where both username AND password match the input (plain text check)
    $sql = "SELECT id, username FROM users WHERE username = '$username' AND password = '$password'";
    
    $result = mysqli_query($conn, $sql);

// 3. Check for results
    if ($result) {
        if (mysqli_num_rows($result) == 1) {
            
            // Credentials match! Login successful.
            $row = mysqli_fetch_assoc($result);

$_SESSION["loggedin"] = true;
            $_SESSION["id"] = $row['id'];
            $_SESSION["username"] = $row['username'];
            
            // Redirect user to dashboard
            header("location: dashboard.php");
            exit;

} else {
            // Login failed (username/password mismatch)
            // Redirect back to index.php with the error message
            $encoded_error = urlencode($error_message);
            header("location: index.php?error=" . $encoded_error);
            exit;
        }
        mysqli_free_result($result);
    } else {
        // Database error
        $encoded_error = urlencode("System Error: Database query failed.");
        header("location: index.php?error=" . $encoded_error);
        exit;
    }

mysqli_close($conn);
}
?>