Zploit 0-Day Shell

:: Editing File: delete_tax.php

<?php

include_once("session.php");
include("db.php"); // Database connection

// Ensure the user is logged in and has the session data required for notifications
$user_id = $_SESSION['user_id'] ?? 0;
// Change the table name to 'taxes'
$table_name = "taxes";

// Check if an ID was passed in the URL and is numeric
if (isset($_GET['id']) && is_numeric($_GET['id'])) {
    // Sanitize and escape the ID
    $tax_id = mysqli_real_escape_string($conn, $_GET['id']);

// 1. Prepare the SQL DELETE statement
    $sql = "DELETE FROM {$table_name} WHERE id = '$tax_id'";

// 2. Execute the query
    if (mysqli_query($conn, $sql)) {
        // Success
        $_SESSION['success'] = "✅ Tax ID: **{$tax_id}** deleted successfully!";
        
        // Add success notification
        $msg = "✅ Tax Deleted successfully (ID: {$tax_id})";
        $type = "success";
        // Check if user_id is valid before inserting notification
        if ($user_id > 0) {
            mysqli_query($conn, "INSERT INTO notifications (user_id, message, type) VALUES ('$user_id', '$msg', '$type')");
        }

} else {
        // Error
        // Check for common foreign key constraint errors
        $error_detail = mysqli_error($conn);
        if (strpos($error_detail, 'a foreign key constraint fails') !== false || strpos($error_detail, 'foreign key constraint') !== false) {
            $error_message = "❌ Cannot delete Tax ID: **{$tax_id}**. It is currently in use by other records (e.g., products or invoices).";
            $msg = "❌ Tax Deletion Failed: In Use (ID: {$tax_id})";
        } else {
            $error_message = "❌ Error deleting Tax ID: **{$tax_id}**. " . $error_detail;
            $msg = "❌ Tax Deletion Failed (ID: {$tax_id})";
        }
        
        $_SESSION['error'] = $error_message;
        
        // Add error notification
        $type = "error";
        if ($user_id > 0) {
            mysqli_query($conn, "INSERT INTO notifications (user_id, message, type) VALUES ('$user_id', '$msg', '$type')");
        }
    }

} else {
    // ID was missing or invalid
    $_SESSION['error'] = "❌ Invalid request. Tax ID not provided or invalid.";
    
    // Add error notification
    $msg = "❌ Tax Deletion Failed: Invalid ID.";
    $type = "error";
    if ($user_id > 0) {
        mysqli_query($conn, "INSERT INTO notifications (user_id, message, type) VALUES ('$user_id', '$msg', '$type')");
    }
}

// 3. Redirect back to the tax list page
header("Location: tax_list.php");
exit();