Zploit 0-Day Shell

:: Editing File: page22-scope.php

<?php
include 'conn/db.php';
?>
<div class="text-center">
    <img src="assets/images/logo.png" class="logo">
    <hr>
</div>

<h2 class="section-title">Scope of Work</h2>

<table border="1" width="100%" cellpadding="8" cellspacing="0" style="border-collapse: collapse; font-family: Arial, sans-serif;">
    <thead style="background-color: #343a40; color: white;">
        <tr>
            <th width="8%">Sr No</th>
            <th width="42%">Description of Work</th>
            <th width="50%">Specification</th>
        </tr>
    </thead>
    <tbody>

<?php
// Ensure $id is captured correctly from your URL (e.g. q_edit.php?id=1)
$id = (int)$_GET['id'];

$sql = "SELECT category, work_description, specification 
        FROM quotation_scope 
        WHERE quotation_id = $id 
        AND category IN ('Electrical Work', 'Plumbing Work', 'Flooring Work')
        ORDER BY FIELD(category, 'Electrical Work', 'Plumbing Work', 'Flooring Work'), sort_order ASC";

$result = mysqli_query($conn, $sql);

$currentCategory = ""; // Variable to track the category name
$sr_no = 1;

while ($row = mysqli_fetch_assoc($result)) {
    
    // Check if the category has changed
    if ($currentCategory != $row['category']) {
        
        // Reset serial number for the new category section
        $sr_no = 1; 
        
        // Print the Category Header Row
        echo '<tr style="background-color: #f2f2f2;">';
        echo '    <th colspan="3" style="text-align: left; padding-left: 15px; text-transform: uppercase;">';
        echo          htmlspecialchars($row['category']);
        echo '    </th>';
        echo '</tr>';
        
        // Update the tracker to the new category name
        $currentCategory = $row['category'];
    }

// Print the Individual Work Item Row
    ?>
    <tr>
        <td align="center"><?= $sr_no; ?></td>
        <td><?= htmlspecialchars($row['work_description']); ?></td>
        <td><?= htmlspecialchars($row['specification']); ?></td>
    </tr>
    <?php
    $sr_no++;
}
?>
    </tbody>
</table>

<p>All materials used shall be ISI certified. Professional fees for the above-mentioned scope of services shall be applicable as detailed below.</p>

<!--

<?php  /* $sql1 = "SELECT * 
        FROM quotation_costing 
        WHERE quotation_id = '$id'";

$result1 = mysqli_query($conn, $sql1); ?>

<table border="1" cellpadding="8" cellspacing="0" width="100%">
    <thead>
        <tr>
            <th>Sr No</th>
            <th>Description</th>
            <th>Amount (₹)</th>
        </tr>
    </thead>
    <tbody>
       <?php  $sr_no1 = 1;  while ($row1 = mysqli_fetch_assoc($result1)) { ?>
        <tr>
            <td align="center"><?= $sr_no1; ?></td>
            <td><?= htmlspecialchars($row1['description']); ?></td>
            <td><?= htmlspecialchars($row1['amount']); ?></td>
        </tr>
        <?php
    $sr_no1++;
} */
?>
    </tbody>
</table>

-->

<table border="1" cellpadding="8" cellspacing="0" width="100%">
    <thead>
        <tr>
            <th>Sr No</th>
            <th>Description</th>
            <th>Amount (₹)</th>
        </tr>
    </thead>
    <tbody>
        <tr>
            <td align="center">1</td>
            <td>Design And Development</td>
            <td>20,000 Only </td>
        </tr>
        <tr>
            <td align="center">2</td>
            <td>Construction Cost (Per SQFT)</td>
            <td>1,899 PER SQFT</td>
        </tr>
    </tbody>
</table>