Zploit 0-Day Shell

:: Editing File: billing_add.php

<?php
error_reporting(E_ALL);
ini_set('display_errors', '1');

include_once("session.php");
include("db.php");   // database connection

$user_id = $_SESSION['user_id'];

if ($_SERVER['REQUEST_METHOD'] === 'POST') {

$sql = "INSERT INTO billing
            (company_name, address, gst_no, pan_no,
             contact_person1, contact_phone1, contact_person2, contact_phone2,
             delivery_date, doc_type, bank_details, notes, created_at)
        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, NOW())";

if ($stmt = $conn->prepare($sql)) {
        $stmt->bind_param(
            "ssssssssssss",
            $_POST['company_name'],
            $_POST['address'],
            $_POST['gst_no'],
            $_POST['pan_no'],
            $_POST['contact_person1'],
            $_POST['contact_phone1'],
            $_POST['contact_person2'],
            $_POST['contact_phone2'],
            $_POST['delivery_date'],
            $_POST['doc_type'],
            $_POST['bank_details'],
            $_POST['notes']
        );

if ($stmt->execute()) {
            $_SESSION['success'] = "✅ Billing entry added successfully!";
            $msg  = "✅ Billing entry added successfully!";
            $type = "success";
            $conn->query("INSERT INTO notifications (user_id, message, type)
                          VALUES ('$user_id', '$msg', '$type')");
            header("Location: billing_list.php");
            exit();
        } else {
            $_SESSION['error'] = "❌ Error adding billing: " . $stmt->error;
        }

$stmt->close();
    } else {
        $_SESSION['error'] = "❌ Database error: " . $conn->error;
    }
}

include("header.php");
?>

<div class="row m-1">
        <div class="col-12">
            <h4 class="main-title">Add Billing</h4>
            <ul class="app-line-breadcrumbs mb-3">
                <li>
                    <a class="f-s-14 f-w-500" href="dashboard.php">
                        <i class="ph-duotone ph-bank f-s-16"></i> Home
                    </a>
                </li>
                <li>
                    <a class="f-s-14 f-w-500" href="billing_list.php">
                        <i class="ph-duotone ph-table f-s-16"></i> Billing List
                    </a>
                </li>
                <li class="active">
                    <a class="f-s-14 f-w-500" href="#">Add Billing</a>
                </li>
            </ul>
        </div>
    </div>

<?php
                    if (isset($_SESSION['success'])) {
                        echo '<div class="alert alert-success" id="autoAlert">'
                             . $_SESSION['success'] . '</div>';
                        unset($_SESSION['success']);
                    }
                    if (isset($_SESSION['error'])) {
                        echo '<div class="alert alert-danger" id="autoAlert">'
                             . $_SESSION['error'] . '</div>';
                        unset($_SESSION['error']);
                    }
                    ?>

<form class="row g-3 app-form" method="post" action="">
                        <div class="col-md-6">
                            <label class="form-label">Company Name</label>
                            <input class="form-control" name="company_name" type="text" required>
                        </div>
                        <div class="col-md-12">
                            <label class="form-label">Address</label>
                            <textarea class="form-control" name="address" rows="2"></textarea>
                        </div>
                        <div class="col-md-6">
                            <label class="form-label">GST No</label>
                            <input class="form-control" name="gst_no" type="text">
                        </div>
                        <div class="col-md-6">
                            <label class="form-label">PAN No</label>
                            <input class="form-control" name="pan_no" type="text">
                        </div>
                        <div class="col-md-6">
                            <label class="form-label">Contact Person 1</label>
                            <input class="form-control" name="contact_person1" type="text">
                        </div>
                        <div class="col-md-6">
                            <label class="form-label">Contact Phone 1</label>
                            <input class="form-control" name="contact_phone1" type="text">
                        </div>
                        <div class="col-md-6">
                            <label class="form-label">Contact Person 2</label>
                            <input class="form-control" name="contact_person2" type="text">
                        </div>
                        <div class="col-md-6">
                            <label class="form-label">Contact Phone 2</label>
                            <input class="form-control" name="contact_phone2" type="text">
                        </div>
                        <div class="col-md-6">
                            <label class="form-label">Billing Date</label>
                            <input class="form-control" name="delivery_date" type="date">
                        </div>
                        <div class="col-md-6">
                            <label class="form-label">Document Type</label>
                            <input class="form-control" name="doc_type" type="text">
                        </div>
                        <div class="col-md-6">
                            <label class="form-label">Bank Details</label>
                            <input class="form-control" name="bank_details" type="text">
                        </div>
                        <div class="col-md-12">
                            <label class="form-label">Notes</label>
                            <textarea class="form-control" name="notes" rows="3"></textarea>
                        </div>
                        <div class="col-12">
                            <button type="submit" class="btn btn-primary">Add Billing</button>
                        </div>
                    </form>

</div>
            </div>
        </div>
    </div>

<?php include("footer.php"); ?>