Zploit 0-Day Shell

:: Editing File: materials_edit.php

<?php
ob_start(); // ✅ ADD THIS LINE FIRST
error_reporting(E_ALL);
ini_set('display_errors', 1);

include_once("session.php");
include("db.php");
include("header.php");

$table_name = "packaging_materials";
$user_id = $_SESSION['user_id'];

/* -------------------------------
   GET PRODUCT ID
-------------------------------- */
if (!isset($_GET['id']) || empty($_GET['id'])) {
    header("Location: materials_list.php");
    exit;
}

$product_id = (int)$_GET['id'];

/* -------------------------------
   FETCH PRODUCT
-------------------------------- */
$product_q = mysqli_query($conn, "
    SELECT * FROM $table_name 
    WHERE id = $product_id
");

if (mysqli_num_rows($product_q) == 0) {
    $_SESSION['error'] = "Products not found!";
    header("Location: materials_list.php");
    exit;
}

$product = mysqli_fetch_assoc($product_q);

/* -------------------------------
   FETCH CATEGORIES
-------------------------------- */
$category_res = mysqli_query(
    $conn,
    "SELECT id, category_name FROM material_categories WHERE status = 1 ORDER BY category_name"
);

/* -------------------------------
   UPDATE LOGIC
-------------------------------- */
if ($_SERVER['REQUEST_METHOD'] === 'POST') {

$category_id  = (int)$_POST['category_id'];
    $product_name = mysqli_real_escape_string($conn, trim($_POST['product_name']));
    $unit_type    = mysqli_real_escape_string($conn, $_POST['unit_type']);
    $status       = (int)$_POST['status'];

// Duplicate check (exclude current product)
    $dup_q = mysqli_query($conn, "
        SELECT id FROM $table_name
        WHERE product_name = '$product_name'
        AND category_id = '$category_id'
        AND id != $product_id
    ");

if (mysqli_num_rows($dup_q) > 0) {

$_SESSION['error'] = "❌ Product already exists in this category!";

} else {

$update_sql = "
            UPDATE $table_name SET
                category_id  = '$category_id',
                product_name = '$product_name',
                unit_type    = '$unit_type',
                status       = '$status'
            WHERE id = $product_id
        ";

if (mysqli_query($conn, $update_sql)) {

$_SESSION['success'] = "✅ Products updated successfully!";
            mysqli_query($conn, "INSERT INTO notifications (user_id, message, type)
                                 VALUES ('$user_id','Products updated','success')");

header("Location: materials_list.php");
            exit;

} else {
            $_SESSION['error'] = "❌ Update failed: " . mysqli_error($conn);
        }
    }
}
?>

<div class="row m-1">
  <div class="col-12">
    <h4 class="main-title">Edit Products</h4>
    <ul class="app-line-breadcrumbs mb-3">
      <li>
        <a href="dashboard.php"><i class="ph-duotone ph-bank"></i> Home</a>
      </li>
      <li>
        <a href="materials_list.php">Productss</a>
      </li>
      <li class="active">Edit Product</li>
    </ul>
  </div>
</div>

<?php
if (isset($_SESSION['success'])) {
    echo '<div class="alert alert-success">'.$_SESSION['success'].'</div>';
    unset($_SESSION['success']);
}
if (isset($_SESSION['error'])) {
    echo '<div class="alert alert-danger">'.$_SESSION['error'].'</div>';
    unset($_SESSION['error']);
}
?>

<div class="col-md-6">
    <label class="form-label">Category *</label>
    <select name="category_id" class="form-select" required>
      <?php while ($cat = mysqli_fetch_assoc($category_res)) { ?>
        <option value="<?= $cat['id']; ?>"
          <?= ($cat['id'] == $product['category_id']) ? 'selected' : ''; ?>>
          <?= htmlspecialchars($cat['category_name']); ?>
        </option>
      <?php }  ?>
    </select>
  </div>

<div class="col-md-4">
    <label class="form-label">Product Name *</label>
    <input type="text" name="product_name" class="form-control" value="<?php echo $product['product_name'] ?>">
  </div>

<div class="col-md-4">
    <label class="form-label">Status *</label>
    <select name="status" class="form-select" required>
      <option value="1" <?= ($product['status'] == 1) ? 'selected' : ''; ?>>Active</option>
      <option value="0" <?= ($product['status'] == 0) ? 'selected' : ''; ?>>Inactive</option>
    </select>
  </div>

<div class="col-12">
    <button type="submit" class="btn btn-primary">
      Update Product
    </button>
    <a href="materials_list.php" class="btn btn-light-secondary">
      Cancel
    </a>
  </div>

</form>

</div>
</div>

</div>
</main>

<?php include("footer.php"); ?>
<?php ob_end_flush(); ?>