Zploit 0-Day Shell

:: Editing File: vcard_inquiry_edit.php

<?php
ob_start();
include 'header.php';

$page_title = "Edit VCard Inquiry";
$page_parent = "VCards";
$page_parent_link = "vcard_inquiries_list.php";

include 'breadcrumb.php';
include 'menu.php';

$message = "";

// ✅ Validate ID
if (!isset($_GET['id']) || !is_numeric($_GET['id'])) {
    header("Location: vcard_inquiries_list.php?msg=Invalid Inquiry ID");
    exit;
}

$id = intval($_GET['id']);

// ✅ Fetch inquiry
$q = mysqli_query($conn, "SELECT * FROM vcard_inquiries WHERE id='$id'");
if (mysqli_num_rows($q) == 0) {
    header("Location: vcard_inquiries_list.php?msg=Inquiry Not Found");
    exit;
}
$row = mysqli_fetch_assoc($q);

// ✅ Handle update
if ($_SERVER['REQUEST_METHOD'] === 'POST') {

$vcard_id = intval($_POST['vcard_id']);
    $name     = mysqli_real_escape_string($conn, $_POST['name']);
    $phone    = mysqli_real_escape_string($conn, $_POST['phone']);
    $email    = mysqli_real_escape_string($conn, $_POST['email']);
    $msg      = mysqli_real_escape_string($conn, $_POST['message']);
    $status   = intval($_POST['status']);

if ($vcard_id == 0 || $name == '') {
        $message = "VCard and Name are required.";
    }

if ($message == '') {
        $sql = "UPDATE vcard_inquiries SET
                    vcard_id   = '$vcard_id',
                    name       = '$name',
                    phone      = '$phone',
                    email      = '$email',
                    message    = '$msg',
                    status     = '$status',
                    updated_at = NOW()
                WHERE id = '$id'";

if (mysqli_query($conn, $sql)) {
            header("Location: vcard_inquiries_list.php?msg=Inquiry updated successfully");
            exit;
        } else {
            $message = "Database Error: " . mysqli_error($conn);
        }
    }
}
?>

<div class="page-body">
<div class="container-fluid">
<div class="row">
<div class="col-sm-12">

<div class="card">
<div class="card-header pb-0 card-no-border">
    <h2>Edit VCard Inquiry</h2>
</div>

<?php if ($message): ?>
    <div class="alert alert-danger"><?= htmlspecialchars($message); ?></div>
<?php endif; ?>

<div class="col-md-6">
    <label class="form-label">Select VCard *</label>
    <select name="vcard_id" class="form-control" required>
        <option value="">-- Select VCard --</option>
        <?php
        $vcards = mysqli_query($conn, "SELECT id, full_name FROM vcards WHERE status=1 ORDER BY full_name");
        while ($v = mysqli_fetch_assoc($vcards)) {
            $sel = ($v['id'] == $row['vcard_id']) ? "selected" : "";
            echo "<option value='{$v['id']}' $sel>" . htmlspecialchars($v['full_name']) . "</option>";
        }
        ?>
    </select>
</div>

<div class="col-md-6">
    <label class="form-label">Name *</label>
    <input type="text" name="name" class="form-control"
           value="<?= htmlspecialchars($row['name']); ?>" required>
</div>

<div class="col-md-6 mt-3">
    <label class="form-label">Phone</label>
    <input type="text" name="phone" class="form-control"
           value="<?= htmlspecialchars($row['phone']); ?>">
</div>

<div class="col-md-6 mt-3">
    <label class="form-label">Email</label>
    <input type="email" name="email" class="form-control"
           value="<?= htmlspecialchars($row['email']); ?>">
</div>

<div class="col-md-12 mt-3">
    <label class="form-label">Message</label>
    <textarea name="message" class="form-control" rows="4"><?= htmlspecialchars($row['message']); ?></textarea>
</div>

<div class="col-md-4 mt-3">
    <label class="form-label">Status</label>
    <select name="status" class="form-control">
        <option value="1" <?= ($row['status']==1)?'selected':''; ?>>Active</option>
        <option value="0" <?= ($row['status']==0)?'selected':''; ?>>Inactive</option>
    </select>
</div>

</div>

<br>
<div class="text-start">
    <button type="submit" class="btn btn-success">Update Inquiry</button>
    <a href="vcard_inquiries_list.php" class="btn btn-secondary">Cancel</a>
</div>

</form>

</div>
</div>

</div>
</div>
</div>
</div>

<?php include 'footer.php'; ob_end_flush(); ?>