Zploit 0-Day Shell

:: Editing File: purchase_order_add.php

<?php

error_reporting(E_ALL);
ini_set('display_errors', '1');

include_once("session.php");

include("header.php"); 
include("db.php");
?>

<div class="row m-1">
            <div class="col-12">
                <h4 class="main-title">Create Purchase Order</h4>
                <ul class="app-line-breadcrumbs mb-3">
                    <li>
                        <a class="f-s-14 f-w-500" href="dashboard.php">
                            <i class="ph-duotone ph-bank f-s-16"></i> Home
                        </a>
                    </li>
					 <li>
                        <a class="f-s-14 f-w-500" href="purchase_invoice_list.php">
                            <i class="ph-duotone ph-table f-s-16"></i> Purchase Orders List
                        </a>
                    </li>
                    <li class="active">
                        <a class="f-s-14 f-w-500" href="#">Add PO</a>
                    </li>
                </ul>
            </div>
        </div>

<?php
		$user_id = $_SESSION['user_id'];
		
        if ($_SERVER['REQUEST_METHOD'] === 'POST') {
            $name    = mysqli_real_escape_string($conn, $_POST['name']);
            $phone   = mysqli_real_escape_string($conn, $_POST['phone']);
            $email   = mysqli_real_escape_string($conn, $_POST['email']);
            $gst     = mysqli_real_escape_string($conn, $_POST['gst']);
            $address = mysqli_real_escape_string($conn, $_POST['address']);
			
			$id = mysqli_real_escape_string($conn, $_POST['id']);

$sql = "INSERT INTO vendors (name, phone, email, gst, address) 
                    VALUES ('$name', '$phone', '$email', '$gst', '$address')";

if (mysqli_query($conn, $sql)) {
                $_SESSION['success'] = "✅ Vendor added successfully!";
				
				 $msg = "✅ Vendor Added successfully!";
				 $type = "success";
				 
				 mysqli_query($conn, "INSERT INTO notifications (user_id, message, type) VALUES ('$id', '$msg', '$type')");
						 
            } else {
				
				$msg = "❌ Vendor Added Failed ! ";
				$type = "error";
				mysqli_query($conn, "INSERT INTO notifications (user_id, message, type) VALUES ('$id', '$msg', '$type')");
							
                $_SESSION['error'] = "❌ Error adding vendor!";
            }
        }
        ?>

<?php 
                        if (isset($_SESSION['success'])) {
                            echo '<div class="alert alert-success" id="autoAlert">'.$_SESSION['success'].'</div>';
                            unset($_SESSION['success']);
                        }
                        if (isset($_SESSION['error'])) {
                            echo '<div class="alert alert-danger" id="autoAlert">'.$_SESSION['error'].'</div>';
                            unset($_SESSION['error']);
                        }
                        ?>

<h5 class="mt-3">Exporters  Information</h5>
                            <div class="col-md-6">
								<label class="form-label">Exporters Name</label>
								<select class="form-control form-select"  id="vendor_id" name="vendor_id" required>
									<option value="">Select Exporters</option>
									<?php
									$query = "SELECT id, name FROM vendors ORDER BY name ASC";
									$result = mysqli_query($conn, $query);
									while ($row = mysqli_fetch_assoc($result)) {
										echo "<option value='".$row['id']."'>".$row['name']."</option>";
									}
									?>
								</select>
							</div>
                            
							<div class="col-md-6">
								<label class="form-label">Exporters Email</label>
								<input type="text" class="form-control" id="vendor_email" name="vendor_email" readonly>
							</div>
							<div class="col-md-6">
								<label class="form-label">Exporters Phone</label>
								<input type="text" class="form-control" id="vendor_phone" name="vendor_phone" readonly>
							</div>
							<div class="col-md-6">
								<label class="form-label">Exporters Address</label>
								<textarea class="form-control" id="vendor_address" name="vendor_address" readonly></textarea>
							</div>
							
							
                            <h5 class="mt-3">Consignee Information</h5>
                            <div class="col-md-6">
								<label class="form-label">Consignee Name</label>
								<select class="form-control form-select"  id="vendor_id" name="vendor_id" required>
									<option value="">Select Consignee</option>
									<?php
									$query = "SELECT id, name FROM vendors ORDER BY name ASC";
									$result = mysqli_query($conn, $query);
									while ($row = mysqli_fetch_assoc($result)) {
										echo "<option value='".$row['id']."'>".$row['name']."</option>";
									}
									?>
								</select>
							</div>
                            
							<div class="col-md-6">
								<label class="form-label">Consignee Email</label>
								<input type="text" class="form-control" id="vendor_email" name="vendor_email" readonly>
							</div>
							<div class="col-md-6">
								<label class="form-label">Consignee Phone</label>
								<input type="text" class="form-control" id="vendor_phone" name="vendor_phone" readonly>
							</div>
							<div class="col-md-6">
								<label class="form-label">Consignee Address</label>
								<textarea class="form-control" id="vendor_address" name="vendor_address" readonly></textarea>
							</div>

<h5 class="mt-3">Invoice Details</h5>
                            <div class="col-md-6">
                                <input class="form-control" name="invoice_no" placeholder="Invoice No" required>
                            </div>
                            <div class="col-md-6">
                                <input class="form-control" type="date" name="invoice_date" required>
                            </div>
							<div class="col-md-6">
                                <input class="form-control" name="challan" placeholder="Challan No">
                            </div>
							<div class="col-md-6">
                                <input class="form-control" name="billing_email" placeholder="Billing Email">
                            </div>
                            <div class="col-md-12">
                                <textarea class="form-control" name="billing_address" placeholder="Billing Address"></textarea>
                            </div>

<h5 class="mt-3">Delivery Information</h5>
                            
                           
                            <div class="col-md-12">
                                <textarea class="form-control" name="delivery_address" placeholder="Delivery Address"></textarea>
                            </div>
                            
                            
                            <h5 class="mt-3">Items</h5>
                            <div id="items" class="col-12">
                                <div class="row g-2 mb-2">
                                    <div class="col-md-3"><input class="form-control" name="item_desc[]" placeholder="Description" required></div>
                                    <div class="col-md-2"><input class="form-control" name="item_uom[]" placeholder="UOM" required></div>
                                    <div class="col-md-2"><input class="form-control" type="number" step="0.01" name="item_qty[]" placeholder="Qty" required></div>
                                    <div class="col-md-2"><input class="form-control" type="number" step="0.01" name="item_rate[]" placeholder="Rate" required></div>
                                </div>
                            </div>
                            <div class="col-12">
                                <button type="button" class="btn btn-sm btn-outline-primary" onclick="addItem()">+ Add Item</button>
                            </div>

<h5 class="mt-3">Driver & Vehicle Information</h5>
                            <div class="col-md-3"><input class="form-control" name="driver_name" placeholder="Driver Name"></div>
                            <div class="col-md-3"><input class="form-control" name="driver_number" placeholder="Driver Number"></div>
                            <div class="col-md-3"><input class="form-control" name="vehicle_number" placeholder="Vehicle Number"></div>
                            <div class="col-md-3"><input class="form-control" type="number" name="total_boxes" placeholder="Total Boxes"></div>

<h5 class="mt-3">Authorized Signatories</h5>
                            <div class="col-md-6"><input class="form-control" name="sign_left" placeholder="For - Left Company"></div>
                            <div class="col-md-6"><input class="form-control" name="sign_right" placeholder="For - Right Company"></div>

<div class="col-12 mt-3">
                                <button type="submit" class="btn btn-primary">Save & Generate Invoice</button>
                            </div>
                        </form>

</div>
                </div>
            </div>
        </div>

</div>
</main>

<?php include("footer.php"); ?>