Zploit 0-Day Shell

:: Editing File: add_box_category.php

<?php

include_once("session.php");
include("db.php"); // check login session
include("header.php");

// Define table and columns for clarity
$table_name = "box_category";

// Check if a status update query parameter is present (for active/inactive status logic, if needed)
// ... (omitting complex status change logic for a simple Add page)

<div class="row m-1">
      <div class="col-12">
        <h4 class="main-title">Add Box Category</h4>
        <ul class="app-line-breadcrumbs mb-3">
          <li>
            <a class="f-s-14 f-w-500" href="dashboard.php">
              <i class="ph-duotone ph-bank f-s-16"></i> Home
            </a>
          </li>
					 <li>
            <a class="f-s-14 f-w-500" href="box_category_list.php">
              <i class="ph-duotone ph-table f-s-16"></i> Box Category List
            </a>
          </li>
          <li class="active">
            <a class="f-s-14 f-w-500" href="#">Add Category</a>
          </li>
        </ul>
      </div>
    </div>
        <?php
        // Assuming 'user_id' is used for notifications
		$user_id = $_SESSION['user_id'];
		
    if ($_SERVER['REQUEST_METHOD'] === 'POST') {
            // Get and escape form data for box_category table
      $category_name = mysqli_real_escape_string($conn, $_POST['category_name']);
      $status        = mysqli_real_escape_string($conn, $_POST['status']);
			
			$id = mysqli_real_escape_string($conn, $_POST['id']); // User ID for notification

// Check for duplicate category name before inserting (optional but recommended)
            $check_sql = "SELECT id FROM {$table_name} WHERE category_name = '{$category_name}'";
            $check_result = mysqli_query($conn, $check_sql);

if (mysqli_num_rows($check_result) > 0) {
                $_SESSION['error'] = "❌ Category name '{$category_name}' already exists!";
                $msg = "❌ Category Added Failed: Duplicate Name!";
                $type = "error";
                mysqli_query($conn, "INSERT INTO notifications (user_id, message, type) VALUES ('$id', '$msg', '$type')");
            } else {

// SQL query to insert into box_category table
        $sql = "INSERT INTO {$table_name} (category_name, status)
            VALUES ('$category_name', '$status')";

if (mysqli_query($conn, $sql)) {
          $_SESSION['success'] = "✅ Box Category added successfully!";
					
					$msg = "✅ Box Category Added successfully!";
					$type = "success";
					
					// Use $user_id for notifications
					mysqli_query($conn, "INSERT INTO notifications (user_id, message, type) VALUES ('$id', '$msg', '$type')");
							
        } else {
					
					$msg = "❌ Box Category Added Failed ! " . mysqli_error($conn);
					$type = "error";
					mysqli_query($conn, "INSERT INTO notifications (user_id, message, type) VALUES ('$id', '$msg', '$type')");
								
          $_SESSION['error'] = "❌ Error adding Box Category: " . mysqli_error($conn);
        }
            }
    }
    ?>

<?php
            if (isset($_SESSION['success'])) {
              echo '<div class="alert alert-success" id="autoAlert">'.$_SESSION['success'].'</div>';
              unset($_SESSION['success']);
            }
            if (isset($_SESSION['error'])) {
              echo '<div class="alert alert-danger" id="autoAlert">'.$_SESSION['error'].'</div>';
              unset($_SESSION['error']);
            }
 ?>

<div class="col-md-6">
                              <label class="form-label" for="category_name">Category Name*</label>
                              <input class="form-control" id="category_name" name="category_name" type="text" required>
                            </div>

<div class="col-md-6">
                              <label class="form-label" for="status">Status*</label>
                                <select class="form-select" id="status" name="status" required>
                                    <option value="1">Active</option>
                                    <option value="0">Inactive</option>
                                </select>
                            </div>
                            
              <div class="col-12">
                <button type="submit" class="btn btn-primary">Add Category</button>
              </div>
            </form>

</div>
        </div>
      </div>
    </div>

</div>
</main>

<?php include("footer.php"); ?>