Zploit 0-Day Shell

:: Editing File: fetch_privacy.php

<?php 
header('Content-Type: application/json');
include('db.php');

if (!isset($_POST['user_id'])) {
    echo json_encode(array('error' => 'Missing user_id parameter'));
    exit;
}

$user_id = mysqli_real_escape_string($conn, $_POST['user_id']);

$sql_privacy_setting = "SELECT * FROM privacy_setting WHERE user_id = '$user_id'";
$result_privacy_setting = mysqli_query($conn, $sql_privacy_setting);

// Initialize an associative array to store privacy settings
$privacy_settings = array();

if (mysqli_num_rows($result_privacy_setting) > 0) {
    // Fetch the privacy settings from the database
    $row = mysqli_fetch_assoc($result_privacy_setting);

// Store privacy settings in the associative array
    $privacy_settings['display_name_as'] = $row['display_name_as'];
    $privacy_settings['display_name_as_title'] = $row['display_name_as_title'];
    $privacy_settings['phone'] = $row['phone'];
    $privacy_settings['phone_title'] = $row['phone_title'];
    $privacy_settings['email'] = $row['email'];
    $privacy_settings['email_title'] = $row['email_title'];
    $privacy_settings['photo'] = $row['photo'];
    $privacy_settings['photo_title'] = $row['photo_title'];
    $privacy_settings['date_of_birth'] = $row['date_of_birth'];
    $privacy_settings['date_of_birth_title'] = $row['date_of_birth_title'];
    $privacy_settings['annual_income'] = $row['annual_income'];
    $privacy_settings['annual_income_title'] = $row['annual_income_title'];
}

// Encode the associative array into JSON format
$json_data = json_encode($privacy_settings);

// Output the JSON data
echo $json_data;
?>