Zploit 0-Day Shell

:: Editing File: delete_party.php

<?php
include 'db.php';
include_once("session.php");

// check that an id was provided and is numeric
if (!isset($_GET['id']) || !is_numeric($_GET['id'])) {
    $_SESSION['error'] = "Invalid request.";
    header("Location: list_parties.php");
    exit;
}

$party_id = (int)$_GET['id'];

// start transaction
mysqli_begin_transaction($conn);

try {
    // Optional: explicitly delete related payments if you don't rely on FK ON DELETE CASCADE
    $delPaymentsSql = "DELETE FROM payment WHERE party_id = ?";
    if ($stmtPayments = mysqli_prepare($conn, $delPaymentsSql)) {
        mysqli_stmt_bind_param($stmtPayments, "i", $party_id);
        if (!mysqli_stmt_execute($stmtPayments)) {
            throw new Exception("Failed to delete related payments: " . mysqli_error($conn));
        }
        mysqli_stmt_close($stmtPayments);
    } else {
        // If prepare fails, throw with mysqli error
        throw new Exception("Prepare failed for payments delete: " . mysqli_error($conn));
    }

// Delete the party
    $delPartySql = "DELETE FROM party WHERE id = ?";
    if ($stmtParty = mysqli_prepare($conn, $delPartySql)) {
        mysqli_stmt_bind_param($stmtParty, "i", $party_id);
        if (!mysqli_stmt_execute($stmtParty)) {
            throw new Exception("Failed to delete party: " . mysqli_error($conn));
        }

// Check affected rows to ensure the row existed
        if (mysqli_stmt_affected_rows($stmtParty) === 0) {
            // No rows deleted -> party id not found
            throw new Exception("Party not found or already deleted.");
        }

mysqli_stmt_close($stmtParty);
    } else {
        throw new Exception("Prepare failed for party delete: " . mysqli_error($conn));
    }

// commit transaction
    mysqli_commit($conn);
    $_SESSION['success'] = "Party deleted successfully.";
    header("Location: list_parties.php");
    exit;

} catch (Exception $e) {
    // rollback and return error
    mysqli_rollback($conn);
    $_SESSION['error'] = "Error deleting party: " . $e->getMessage();
    header("Location: list_parties.php");
    exit;
}
?>