Zploit 0-Day Shell

:: Editing File: vcard_testimonial_list.php

<?php
// ✅ Page title
$page_title = "VCard Testimonials";

include 'header.php';
include 'breadcrumb.php';
include 'menu.php';
?>

<div class="col-sm-10">
              <div class="card-header pb-0 card-no-border">
                <h2>VCard Testimonial List</h2>
              </div>
            </div>

<div class="col-sm-2">
              <div class="card-header pb-0 card-no-border text-end">
                <a href="vcard_testimonial_add.php" class="btn btn-primary btn-sm">
                  <i class="fa fa-plus"></i> Add Testimonial
                </a>
              </div>
            </div>

<div class="card-body">
              <div class="dt-ext table-responsive">
                <table class="display" id="export-button">
                  <thead>
                    <tr>
                      <th>#</th>
                      <th>VCard ID</th>
                      <th>Client Name</th>
                      <th>Message</th>
                      <th>Client Image</th>
                      <th>Status</th>
                      <th>Created At</th>
                      <th>Action</th>
                    </tr>
                  </thead>
<tbody>
<?php
$sr = 1;

$sql = "SELECT * FROM vcard_testimonials ORDER BY created_at DESC";
$result = mysqli_query($conn, $sql);

if ($result && mysqli_num_rows($result) > 0) {

while ($row = mysqli_fetch_assoc($result)) {

// Get VCard name
        $vcard_q = mysqli_query(
            $conn,
            "SELECT full_name FROM vcards WHERE id='{$row['vcard_id']}'"
        );
        $vcard = mysqli_fetch_assoc($vcard_q);

// Create slug
        $slug = strtolower(trim(
            preg_replace('/[^A-Za-z0-9-]+/', '-', $vcard['full_name'])
        ));

// Base directory
        $base_dir = "uploads/vcard/" . $slug . "/testimonial/";

// Status badge
        $status = ($row['status'] == 1)
            ? "<span class='badge bg-success'>Active</span>"
            : "<span class='badge bg-danger'>Inactive</span>";

// Image preview
        if (!empty($row['client_image']) && file_exists($base_dir . $row['client_image'])) {
            $image = "<img src='" . htmlspecialchars($base_dir . $row['client_image']) . "' height='40'>";
        } else {
            $image = "<span class='text-muted'>N/A</span>";
        }

echo "<tr>";
        echo "<td>{$sr}</td>";
        echo "<td>{$vcard['full_name']}</td>";
        echo "<td>" . htmlspecialchars($row['client_name']) . "</td>";
        echo "<td>" . nl2br(htmlspecialchars(substr($row['message'], 0, 80))) . "...</td>";
        echo "<td>
                <img src='" . htmlspecialchars($base_dir . $row['client_image']) . "' height='50'>
             </td>";

echo "<td>{$status}</td>";
        echo "<td>{$row['created_at']}</td>";

echo "<td class='text-center'>
                <a href='vcard_testimonial_edit.php?id={$row['id']}'
                   class='btn btn-info btn-sm me-1'>
                   <i class='fa fa-pencil'></i>
                </a>

<a href='vcard_testimonial_delete.php?id={$row['id']}'
                   class='btn btn-danger btn-sm'
                   onclick=\"return confirm('Are you sure you want to delete this testimonial?');\">
                   <i class='fa fa-trash'></i>
                </a>
              </td>";

echo "</tr>";
        $sr++;
    }

} else {
    echo "<tr>
            <td colspan='8' class='text-center text-muted'>
                No testimonials found
            </td>
          </tr>";
}
?>
</tbody>

</table>
              </div>
            </div>

</div>
        </div>

</div>
    </div>
  </div>
</div>

<?php include 'footer.php'; ?>