Zploit 0-Day Shell

:: Editing File: cold_stock_report.php

<?php
include_once("session.php");
include("db.php");
include("header.php");

// Filters
$from_date = $_GET['from_date'] ?? '';
$to_date   = $_GET['to_date'] ?? '';
$item_name = $_GET['item_name'] ?? '';

// Build query
$sql = "SELECT * FROM cold_stock WHERE 1=1";

if ($from_date) {
    $sql .= " AND stock_date >= '" . mysqli_real_escape_string($conn, $from_date) . "'";
}
if ($to_date) {
    $sql .= " AND stock_date <= '" . mysqli_real_escape_string($conn, $to_date) . "'";
}
if ($item_name) {
    $sql .= " AND item_name LIKE '%" . mysqli_real_escape_string($conn, $item_name) . "%'";
}

$sql .= " ORDER BY stock_date DESC";

$result = mysqli_query($conn, $sql);
if (!$result) {
    die("Query failed: " . mysqli_error($conn));
}
?>

<main class="container-fluid">
    <div class="row m-1">
        <div class="col-12">
            <h4 class="main-title">Cold Stock Report</h4>
            <ul class="app-line-breadcrumbs mb-3">
                <li><a href="dashboard.php">Home</a></li>
                <li class="active">Cold Stock Report</li>
            </ul>
        </div>
    </div>

<div class="card mb-3">
        <div class="card-body">
            <form class="row g-3" method="get" action="">
                <div class="col-md-3">
                    <label class="form-label">From Date</label>
                    <input type="date" class="form-control" name="from_date" value="<?= htmlspecialchars($from_date) ?>">
                </div>
                <div class="col-md-3">
                    <label class="form-label">To Date</label>
                    <input type="date" class="form-control" name="to_date" value="<?= htmlspecialchars($to_date) ?>">
                </div>
                <div class="col-md-4">
                    <label class="form-label">Item</label>
                    <input type="text" class="form-control" name="item_name" value="<?= htmlspecialchars($item_name) ?>" placeholder="Enter item name">
                </div>
                <div class="col-md-2 d-flex align-items-end">
                    <button type="submit" class="btn btn-primary w-100">Filter</button>
                </div>
            </form>
        </div>
    </div>

<div class="card">
        <div class="card-body table-responsive">
            <table class="table table-bordered table-striped">
                <thead>
                    <tr>
                        <th>Date</th>
                        <th>Item</th>
                        <th>Quantity</th>
                        <th>Unit</th>
                        <th>Remarks</th>
                    </tr>
                </thead>
                <tbody>
                    <?php
                    $total_qty = 0;
                    if (mysqli_num_rows($result) > 0):
                        while ($row = mysqli_fetch_assoc($result)):
                            $total_qty += $row['quantity'];
                    ?>
                        <tr>
                            <td><?= date("d-m-Y", strtotime($row['stock_date'])) ?></td>
                            <td><?= htmlspecialchars($row['item_name']) ?></td>
                            <td><?= number_format($row['quantity'], 2) ?></td>
                            <td><?= htmlspecialchars($row['unit']) ?></td>
                            <td><?= htmlspecialchars($row['remarks']) ?></td>
                        </tr>
                    <?php endwhile; ?>
                        <tr class="table-info fw-bold">
                            <td colspan="2" class="text-end">TOTAL</td>
                            <td><?= number_format($total_qty, 2) ?></td>
                            <td colspan="2"></td>
                        </tr>
                    <?php else: ?>
                        <tr><td colspan="5" class="text-center">No stock records found</td></tr>
                    <?php endif; ?>
                </tbody>
            </table>
        </div>
    </div>
</main>

<?php include("footer.php"); ?>