Zploit 0-Day Shell

:: Editing File: client_add1.php

<?php
ob_start();
include 'header.php';

$page_title = "Add Client";
$page_parent = "Clients";
$page_parent_link = "clients_list.php";

include 'breadcrumb.php';
include 'menu.php';

$message = "";

// ✅ Handle form submission
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $name        = mysqli_real_escape_string($conn, $_POST['name']);
    $address     = mysqli_real_escape_string($conn, $_POST['address']);
    $email       = mysqli_real_escape_string($conn, $_POST['email']);
    $phone       = mysqli_real_escape_string($conn, $_POST['phone']);
    $service_taken = isset($_POST['service_taken']) ? implode(', ', $_POST['service_taken']) : '';
    $message_txt = mysqli_real_escape_string($conn, $_POST['message']);
    $notes       = mysqli_real_escape_string($conn, $_POST['notes']);
    $domain      = mysqli_real_escape_string($conn, $_POST['domain_details']);
    $hosting     = mysqli_real_escape_string($conn, $_POST['hosting_details']);
    $digital     = mysqli_real_escape_string($conn, $_POST['digital_marketing_details']);
    $invoice_amt = mysqli_real_escape_string($conn, $_POST['invoice_amount']);
    $advance_received = mysqli_real_escape_string($conn, $_POST['advance_received']);
    $balance_due = mysqli_real_escape_string($conn, $_POST['balance_due']);
    $amount_det  = mysqli_real_escape_string($conn, $_POST['amount_details']);
    $convert_date = mysqli_real_escape_string($conn, $_POST['client_convert_date']);
    $created_by  = 1; // You can replace this with session user ID
    $created_at  = date('Y-m-d H:i:s');

$sql = "INSERT INTO clients 
            (name, address, email, phone, service_taken, message, notes, domain_details, hosting_details, digital_marketing_details, invoice_amount, advance_received, balance_due, amount_details, client_convert_date, created_by, created_at)
            VALUES 
            ('$name', '$address', '$email', '$phone', '$service_taken', '$message_txt', '$notes', '$domain', '$hosting', '$digital', '$invoice_amt', '$advance_received', '$balance_due', '$amount_det', '$convert_date', '$created_by', '$created_at')";

if (mysqli_query($conn, $sql)) {
        header("Location: clients_list.php?msg=Client added successfully");
        exit;
    } else {
        $message = "Database Error: " . mysqli_error($conn);
    }
}
?>

<div class="page-body">
  <div class="container-fluid">
    <div class="row">
      <div class="col-sm-12">
        <div class="card">

<div class="card-header pb-0 card-no-border">
            <h2>Add New Client</h2>
          </div>

<div class="col-md-4">
                  <label class="form-label">Client Name</label>
                  <input type="text" name="name" class="form-control" required>
                </div>

<div class="col-md-4">
                  <label class="form-label">Email</label>
                  <input type="email" name="email" class="form-control">
                </div>

<div class="col-md-4">
                  <label class="form-label">Phone</label>
                  <input type="text" name="phone" class="form-control" required>
                </div>

<div class="col-md-6">
                  <label class="form-label">Address</label>
                  <textarea name="address" class="form-control" rows="3"></textarea>
                </div>

<div class="col-md-6">
                  <label class="form-label">Service Taken</label>
                  <select name="service_taken[]" class="form-select" multiple required>
                    <option value="Website Development">Website Development</option>
                    
                    <option value="Digital Marketing">Digital Marketing</option>
                    <option value="CRM Development">CRM Development</option>
                    <option value="Graphic Designing">Graphic Designing</option>
                    <option value="Video Production">Video Production</option>
					<option value="Others">Others</option>
                  </select>
                </div>

<div class="col-md-6">
                  <label class="form-label">Domain Details</label>
				  <textarea name="domain_details" class="form-control" rows="3"></textarea>
                </div>

<div class="col-md-6">
                  <label class="form-label">Hosting Details</label>
				  <textarea name="hosting_details" class="form-control" rows="3"></textarea>
                </div>

<div class="col-md-6">
                  <label class="form-label">Digital Marketing Details</label>
				  <textarea name="digital_marketing_details" class="form-control" rows="3"></textarea>
                </div>

<div class="col-md-6">
                  <label class="form-label">Amount Details</label>
				  <textarea name="amount_details" class="form-control" rows="3"></textarea>
                </div>
				
				
                <div class="col-md-6">
                  <label class="form-label">Invoice Amount (₹)</label>
                  <input type="number" step="0.01" name="invoice_amount" class="form-control">
                </div>

<div class="col-md-6">
                  <label class="form-label">Client Convert Date</label>
                  <input type="date" name="client_convert_date" class="form-control">
                </div>
                
                	
                <div class="col-md-6">
                  <label class="form-label">Advance Received Amount (₹)</label>
                  <input type="number" step="0.01" name="advance_received" class="form-control">
                </div>
                
                	
                <div class="col-md-6">
                  <label class="form-label">Balance Due Amount (₹)</label>
                  <input type="number" step="0.01" name="balance_due" class="form-control">
                </div>

<div class="col-md-6">
                  <label class="form-label">Message</label>
                  <textarea name="message" class="form-control" rows="3"></textarea>
                </div>

<div class="col-md-6">
                  <label class="form-label">Notes</label>
                  <textarea name="notes" class="form-control" rows="3"></textarea>
                </div>

</div>

<div class="text-start mt-4">
                <button type="submit" class="btn btn-success">Save Client</button>
                <a href="clients_list.php" class="btn btn-secondary">Cancel</a>
              </div>

</form>

</div>
        </div>
      </div>
    </div>
  </div>
</div>

<?php include 'footer.php'; ob_end_flush(); ?>