Zploit 0-Day Shell

:: Editing File: edit_farmer_1.php

<?php
include_once("session.php");
include("db.php");           // database connection
include("header.php");       // page header

ob_start();
ob_end_flush();

// ✅ 1. Get Farmer ID
if (!isset($_GET['id']) || !is_numeric($_GET['id'])) {
    $_SESSION['error'] = "❌ Invalid farmer ID.";
    header("Location: list_farmers.php");
    exit();
}
$farmer_id = (int)$_GET['id'];

// ✅ 2. Fetch existing farmer details
$stmt = $conn->prepare("SELECT * FROM farmers WHERE id = ?");
$stmt->bind_param("i", $farmer_id);
$stmt->execute();
$result = $stmt->get_result();
if ($result->num_rows === 0) {
    $_SESSION['error'] = "❌ Farmer not found.";
    header("Location: list_farmers.php");
    exit();
}
$farmer = $result->fetch_assoc();
$stmt->close();

// ✅ 3. Update farmer when form submitted
if ($_SERVER['REQUEST_METHOD'] === 'POST') {

$sql = "UPDATE farmers SET
                farmer_name = ?, 
                contact     = ?, 
                village     = ?, 
                state       = ?, 
                bank_details= ?, 
                gstin       = ?, 
                notes       = ?
            WHERE id = ?";

if ($stmt = $conn->prepare($sql)) {
        $stmt->bind_param(
            "sssssssi",
            $_POST['farmer_name'],
            $_POST['contact'],
            $_POST['village'],
            $_POST['state'],
            $_POST['bank_details'],
            $_POST['gstin'],
            $_POST['notes'],
            $farmer_id
        );

if ($stmt->execute()) {
            $_SESSION['success'] = "✅ Farmer updated successfully!";
            // Optional notification
            $msg  = "✅ Farmer updated successfully!";
            $type = "success";
            $conn->query("INSERT INTO notifications (message, type)
                          VALUES ('$msg', '$type')");
            header("Location: list_farmers.php");
            exit();
        } else {
            $_SESSION['error'] = "❌ Error updating farmer: " . $stmt->error;
        }

$stmt->close();
    } else {
        $_SESSION['error'] = "❌ Database error: " . $conn->error;
    }
}
?>

<div class="row m-1">
        <div class="col-12">
            <h4 class="main-title">Edit Farmer</h4>
            <ul class="app-line-breadcrumbs mb-3">
                <li>
                    <a class="f-s-14 f-w-500" href="dashboard.php">
                        <i class="ph-duotone ph-bank f-s-16"></i> Home
                    </a>
                </li>
                <li>
                    <a class="f-s-14 f-w-500" href="list_farmers.php">
                        <i class="ph-duotone ph-table f-s-16"></i> Farmer List
                    </a>
                </li>
                <li class="active">
                    <a class="f-s-14 f-w-500" href="#">Edit Farmer</a>
                </li>
            </ul>
        </div>
    </div>

<?php
                    if (isset($_SESSION['success'])) {
                        echo '<div class="alert alert-success" id="autoAlert">'
                             . $_SESSION['success'] . '</div>';
                        unset($_SESSION['success']);
                    }
                    if (isset($_SESSION['error'])) {
                        echo '<div class="alert alert-danger" id="autoAlert">'
                             . $_SESSION['error'] . '</div>';
                        unset($_SESSION['error']);
                    }
                    ?>

<form class="row g-3 app-form" method="post" action="">
                        <div class="col-md-6">
                            <label class="form-label">Farmer Name</label>
                            <input class="form-control" name="farmer_name" type="text"
                                   value="<?= htmlspecialchars($farmer['farmer_name']) ?>" required>
                        </div>
                        <div class="col-md-6">
                            <label class="form-label">Contact</label>
                            <input class="form-control" name="contact" type="text"
                                   value="<?= htmlspecialchars($farmer['contact']) ?>" required>
                        </div>
                        <div class="col-md-6">
                            <label class="form-label">Village</label>
                            <input class="form-control" name="village" type="text"
                                   value="<?= htmlspecialchars($farmer['village']) ?>">
                        </div>
                        <div class="col-md-6">
                            <label class="form-label">State</label>
                            <input class="form-control" name="state" type="text"
                                   value="<?= htmlspecialchars($farmer['state']) ?>">
                        </div>
                        <div class="col-md-12">
                            <label class="form-label">Bank Details</label>
                            <textarea class="form-control" name="bank_details" rows="2"><?= htmlspecialchars($farmer['bank_details']) ?></textarea>
                        </div>
                        <div class="col-md-6">
                            <label class="form-label">GSTIN</label>
                            <input class="form-control" name="gstin" type="text"
                                   value="<?= htmlspecialchars($farmer['gstin']) ?>">
                        </div>
                        <div class="col-md-12">
                            <label class="form-label">Notes</label>
                            <textarea class="form-control" name="notes" rows="3"><?= htmlspecialchars($farmer['notes']) ?></textarea>
                        </div>
                        <div class="col-12">
                            <button type="submit" class="btn btn-primary">Update Farmer</button>
                        </div>
                    </form>

</div>
            </div>
        </div>
    </div>

<?php include("footer.php"); ?>