Zploit 0-Day Shell

:: Editing File: edit_tax.php

<?php

include_once("session.php");
include("db.php"); // Database connection
include("header.php");

$table_name = "taxes";
$tax_id = null;
$tax = null;
$error_message = "";
$success_message = "";

// 1. Check for Tax ID and Fetch Data
if (isset($_GET['id']) && is_numeric($_GET['id'])) {
    $tax_id = mysqli_real_escape_string($conn, $_GET['id']);
    
    // Fetch existing tax data
    $fetch_sql = "SELECT id, tax_name, tax_percentage, remarks, status FROM {$table_name} WHERE id = '{$tax_id}'";
    $result = mysqli_query($conn, $fetch_sql);

if (mysqli_num_rows($result) == 1) {
        $tax = mysqli_fetch_assoc($result);
    } else {
        $error_message = "Tax not found.";
    }

} elseif ($_SERVER['REQUEST_METHOD'] !== 'POST') {
    // Only show this error if it's not a form submission trying to process data
    $error_message = "Invalid tax ID provided.";
}

// 2. Handle POST request for Update
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    // Assuming 'user_id' is available in the session or a hidden field
    // In this example, we'll use a hidden field from the form
    $user_id         = mysqli_real_escape_string($conn, $_POST['user_id'] ?? $_SESSION['user_id'] ?? 0); // Use session user_id as fallback
    $tax_id          = mysqli_real_escape_string($conn, $_POST['tax_id']);
    $tax_name        = mysqli_real_escape_string($conn, $_POST['tax_name']);
    $tax_percentage  = mysqli_real_escape_string($conn, $_POST['tax_percentage']);
    $remarks         = mysqli_real_escape_string($conn, $_POST['remarks']);
    $status          = mysqli_real_escape_string($conn, $_POST['status']);

// Check for duplicate name, excluding the current tax being edited
    $check_sql = "SELECT id FROM {$table_name} WHERE tax_name = '{$tax_name}' AND id != '{$tax_id}'";
    $check_result = mysqli_query($conn, $check_sql);

if (mysqli_num_rows($check_result) > 0) {
        $_SESSION['error'] = "❌ Tax name '{$tax_name}' already exists!";
        $msg = "❌ Tax Update Failed: Duplicate Name!";
        $type = "error";
        if ($user_id > 0) {
            mysqli_query($conn, "INSERT INTO notifications (user_id, message, type) VALUES ('$user_id', '$msg', '$type')");
        }
        // Re-populate $tax with the POST data to keep the form fields
        $tax['tax_name'] = $_POST['tax_name'];
        $tax['tax_percentage'] = $_POST['tax_percentage'];
        $tax['remarks'] = $_POST['remarks'];
        $tax['status'] = $_POST['status'];

} else {
        
        // SQL query to update the taxes table
        $update_sql = "UPDATE {$table_name} SET 
                            tax_name = '$tax_name', 
                            tax_percentage = '$tax_percentage',
                            remarks = '$remarks',
                            status = '$status' 
                            WHERE id = '$tax_id'";

if (mysqli_query($conn, $update_sql)) {
            $_SESSION['success'] = "✅ Tax updated successfully!";
            
            $msg = "✅ Tax Updated successfully!";
            $type = "success";
            if ($user_id > 0) {
                mysqli_query($conn, "INSERT INTO notifications (user_id, message, type) VALUES ('$user_id', '$msg', '$type')");
            }
            
            // Re-fetch the updated data to refresh the form fields
            $tax['tax_name'] = $tax_name;
            $tax['tax_percentage'] = $tax_percentage;
            $tax['remarks'] = $remarks;
            $tax['status'] = $status;
            
        } else {
            
            $msg = "❌ Tax Update Failed! " . mysqli_error($conn);
            $type = "error";
            if ($user_id > 0) {
                mysqli_query($conn, "INSERT INTO notifications (user_id, message, type) VALUES ('$user_id', '$msg', '$type')");
            }
            
            $_SESSION['error'] = "❌ Error updating Tax: " . mysqli_error($conn);
        }
    }
}
?>

<?php
                        // Display session success/error messages
                        if (isset($_SESSION['success'])) {
                            echo '<div class="alert alert-success" id="autoAlert">'.$_SESSION['success'].'</div>';
                            unset($_SESSION['success']);
                        }
                        if (isset($_SESSION['error'])) {
                            echo '<div class="alert alert-danger" id="autoAlert">'.$_SESSION['error'].'</div>';
                            unset($_SESSION['error']);
                        }
                                                
                        // Display the error if the ID was missing or invalid and not a POST attempt
                        if (!empty($error_message) && !isset($_POST['tax_id'])) {
                            echo '<div class="alert alert-danger">'.$error_message.'</div>';
                        }
                        
                        // 3. Display the Edit Form if tax data was successfully fetched
                        if ($tax) {
                        ?>

<div class="col-md-6">
                                <label class="form-label" for="tax_name">Tax Name*</label>
                                <input class="form-control" id="tax_name" name="tax_name" type="text" 
                                        value="<?php echo htmlspecialchars($tax['tax_name']); ?>" required>
                            </div>

<div class="col-md-6">
                                <label class="form-label" for="tax_percentage">Tax Percentage (%)*</label>
                                <input class="form-control" id="tax_percentage" name="tax_percentage" type="number" step="0.01" min="0.00" max="100.00"
                                        value="<?php echo htmlspecialchars($tax['tax_percentage']); ?>" required>
                            </div>
                            
                            <div class="col-md-12">
                                <label class="form-label" for="remarks">Remarks</label>
                                <textarea class="form-control" id="remarks" name="remarks" rows="3"><?php echo htmlspecialchars($tax['remarks']); ?></textarea>
                            </div>

<div class="col-md-6">
                                <label class="form-label" for="status">Status*</label>
                                <select class="form-select" id="status" name="status" required>
                                    <option value="active" <?php if ($tax['status'] == 'active') echo 'selected'; ?>>Active</option>
                                    <option value="inactive" <?php if ($tax['status'] == 'inactive') echo 'selected'; ?>>Inactive</option>
                                </select>
                            </div>
                            
                            <div class="col-12">
                                <button type="submit" class="btn btn-primary">Update Tax</button>
                            </div>
                        </form>
                        <?php } // End if ($tax) ?>

</div>
                </div>
            </div>
        </div>

</div>
</main>

<?php include("footer.php"); ?>