Zploit 0-Day Shell

:: Editing File: qitem_edit.php

<?php
ob_start();

include 'header.php';
$page_title = "Edit Quotation Item";
include 'breadcrumb.php';
include 'menu.php';

// ============================
// Validate ID
// ============================
if (!isset($_GET['id']) || !is_numeric($_GET['id'])) {
    header("Location: qitem_list.php?msg=Invalid Request");
    exit;
}

$id = intval($_GET['id']);

// ============================
// Fetch Item with Description & Category
// ============================
$qry = mysqli_query($conn, "
    SELECT 
        i.*,
        d.category_id
    FROM quotation_items i
    INNER JOIN quotation_descriptions d ON d.id = i.desc_id
    WHERE i.id = $id
");

$item = mysqli_fetch_assoc($qry);

if (!$item) {
    header("Location: qitem_list.php?msg=Item Not Found");
    exit;
}

$message = "";

// ============================
// Handle Update
// ============================
if ($_SERVER['REQUEST_METHOD'] === 'POST') {

$desc_id = intval($_POST['desc_id']);
    $name    = mysqli_real_escape_string($conn, $_POST['name']);
    $status  = intval($_POST['status']);

if (!empty($desc_id) && !empty($name)) {

$sql = "
            UPDATE quotation_items
            SET 
                desc_id    = '$desc_id',
                name       = '$name',
                status     = '$status',
                updated_at = NOW()
            WHERE id = $id
        ";

if (mysqli_query($conn, $sql)) {
            header("Location: qitem_list.php?msg=Quotation Item Updated Successfully");
            exit;
        } else {
            $message = "Database Error: " . mysqli_error($conn);
        }

} else {
        $message = "Description and Item Name are required.";
    }
}
?>

<div class="card-header pb-0">
        <h2>Edit Quotation Item</h2>
      </div>

<?php if (!empty($message)) { ?>
          <div class="alert alert-danger"><?= $message; ?></div>
        <?php } ?>

<div class="col-md-6">
              <label class="form-label">Category</label>
              <select name="category_id" class="form-control" disabled>
                <?php
                $cat_sql = "SELECT id, name FROM quotation_categories ORDER BY name ASC";
                $cat_res = mysqli_query($conn, $cat_sql);

while ($cat = mysqli_fetch_assoc($cat_res)) {
                    $selected = ($cat['id'] == $item['category_id']) ? "selected" : "";
                    echo "<option value='{$cat['id']}' {$selected}>{$cat['name']}</option>";
                }
                ?>
              </select>
              <small class="text-muted">Category cannot be changed</small>
            </div>

<div class="col-md-6">
              <label class="form-label">Description</label>
              <select name="desc_id" class="form-control" required>
                <?php
                $desc_sql = "
                    SELECT id, name 
                    FROM quotation_descriptions
                    WHERE category_id = {$item['category_id']}
                    ORDER BY name ASC
                ";
                $desc_res = mysqli_query($conn, $desc_sql);

while ($desc = mysqli_fetch_assoc($desc_res)) {
                    $selected = ($desc['id'] == $item['desc_id']) ? "selected" : "";
                    echo "<option value='{$desc['id']}' {$selected}>{$desc['name']}</option>";
                }
                ?>
              </select>
            </div>

<div class="col-md-6">
              <label class="form-label">Item Name</label>
              <input 
                type="text" 
                name="name" 
                value="<?= htmlspecialchars($item['name']); ?>" 
                class="form-control" 
                required
              >
            </div>

<div class="col-md-6">
              <label class="form-label">Status</label>
              <select name="status" class="form-control">
                <option value="1" <?= ($item['status'] == 1) ? 'selected' : ''; ?>>Active</option>
                <option value="0" <?= ($item['status'] == 0) ? 'selected' : ''; ?>>Inactive</option>
              </select>
            </div>

</div>

<div class="mt-4">
            <button type="submit" class="btn btn-success">
              <i class="fa fa-save"></i> Update
            </button>
            <a href="qitem_list.php" class="btn btn-secondary">
              Cancel
            </a>
          </div>

</form>

</div>
    </div>
  </div>
</div>

<?php include 'footer.php'; ob_end_flush(); ?>