Zploit 0-Day Shell

:: Editing File: delete_packing_material.php

<?php
// delete_packing_material.php

include_once("session.php");
include("db.php"); // $conn should be your mysqli connection

// Ensure session user id exists
$user_id = isset($_SESSION['user_id']) ? intval($_SESSION['user_id']) : 0;
$table_name = "packing_materials";

// Validate incoming id
if (isset($_GET['id']) && is_numeric($_GET['id'])) {
    $material_id = intval($_GET['id']);

// Optional: check that the record exists before deleting (helps with meaningful notifications)
    $exists_sql = "SELECT id FROM {$table_name} WHERE id = ?";
    if ($stmt_exists = mysqli_prepare($conn, $exists_sql)) {
        mysqli_stmt_bind_param($stmt_exists, "i", $material_id);
        mysqli_stmt_execute($stmt_exists);
        mysqli_stmt_store_result($stmt_exists);

if (mysqli_stmt_num_rows($stmt_exists) > 0) {
            mysqli_stmt_close($stmt_exists);

// Begin deletion using prepared statement
            $delete_sql = "DELETE FROM {$table_name} WHERE id = ?";
            if ($stmt_del = mysqli_prepare($conn, $delete_sql)) {
                mysqli_stmt_bind_param($stmt_del, "i", $material_id);
                if (mysqli_stmt_execute($stmt_del)) {
                    // Success
                    $_SESSION['success'] = "✅ Packing Material ID: {$material_id} deleted successfully!";

// Insert notification (prepared)
                    $msg = "✅ Packing Material Deleted successfully (ID: {$material_id})";
                    $type = "success";
                    $notif_sql = "INSERT INTO notifications (user_id, message, type) VALUES (?, ?, ?)";
                    if ($stmt_notif = mysqli_prepare($conn, $notif_sql)) {
                        mysqli_stmt_bind_param($stmt_notif, "iss", $user_id, $msg, $type);
                        mysqli_stmt_execute($stmt_notif);
                        mysqli_stmt_close($stmt_notif);
                    }
                } else {
                    // Delete failed
                    $_SESSION['error'] = "❌ Error deleting Packing Material ID: {$material_id}. " . mysqli_error($conn);

$msg = "❌ Packing Material Deletion Failed (ID: {$material_id})";
                    $type = "error";
                    $notif_sql = "INSERT INTO notifications (user_id, message, type) VALUES (?, ?, ?)";
                    if ($stmt_notif = mysqli_prepare($conn, $notif_sql)) {
                        mysqli_stmt_bind_param($stmt_notif, "iss", $user_id, $msg, $type);
                        mysqli_stmt_execute($stmt_notif);
                        mysqli_stmt_close($stmt_notif);
                    }
                }
                mysqli_stmt_close($stmt_del);
            } else {
                // Prepare delete statement failed
                $_SESSION['error'] = "❌ Server error: could not prepare delete statement.";
            }

} else {
            // Record not found
            mysqli_stmt_close($stmt_exists);
            $_SESSION['error'] = "❌ Packing Material ID: {$material_id} not found.";
            
            $msg = "❌ Packing Material Deletion Failed: Record not found (ID: {$material_id})";
            $type = "error";
            $notif_sql = "INSERT INTO notifications (user_id, message, type) VALUES (?, ?, ?)";
            if ($stmt_notif = mysqli_prepare($conn, $notif_sql)) {
                mysqli_stmt_bind_param($stmt_notif, "iss", $user_id, $msg, $type);
                mysqli_stmt_execute($stmt_notif);
                mysqli_stmt_close($stmt_notif);
            }
        }
    } else {
        $_SESSION['error'] = "❌ Server error: could not prepare existence check.";
    }

} else {
    // ID missing or invalid
    $_SESSION['error'] = "❌ Invalid request. Packing Material ID not provided or invalid.";

$msg = "❌ Packing Material Deletion Failed: Invalid ID.";
    $type = "error";
    $notif_sql = "INSERT INTO notifications (user_id, message, type) VALUES (?, ?, ?)";
    if ($stmt_notif = mysqli_prepare($conn, $notif_sql)) {
        mysqli_stmt_bind_param($stmt_notif, "iss", $user_id, $msg, $type);
        mysqli_stmt_execute($stmt_notif);
        mysqli_stmt_close($stmt_notif);
    }
}

// Redirect back to the listing page
header("Location: packing_material_list.php");
exit();