Zploit 0-Day Shell

:: Editing File: login.php

<?php
session_start();
include("db.php"); // database connection file

if ($_SERVER["REQUEST_METHOD"] == "POST") {
    $username = mysqli_real_escape_string($conn, $_POST['username']);
    $password = mysqli_real_escape_string($conn, $_POST['password']);

// Fetch user with plain password match
     $sql = "SELECT * FROM users WHERE username = '$username' AND password = '$password' LIMIT 1";
    
    
	$result = mysqli_query($conn, $sql);

if ($result && mysqli_num_rows($result) == 1) {
        $user = mysqli_fetch_assoc($result);

// Set session variables
        $_SESSION['user_id'] = $user['id'];
        $_SESSION['user_name'] = $user['username'];
        $_SESSION['user_role'] = $user['role'];
		$_SESSION['user_fullname'] = $user['full_name'];
		$_SESSION['role'] = $user['role'];
		$_SESSION['user_pic'] = $user['user_image'];
		$_SESSION['user_pos'] = $user['pos'];

// Redirect to dashboard
        header("Location: dashboard.php");
        exit();
    } else {
        echo "<script>alert('Invalid Email or Password'); window.history.back();</script>";
    }
}
?>