Zploit 0-Day Shell

:: Editing File: invoice_edit_old.php

<?php
ob_start();
include 'header.php';
$page_title = "Edit Invoice";
$page_parent = "Invoices";
$page_parent_link = "payment_details_list.php";

include 'breadcrumb.php';
include 'menu.php';

// Fetch client/party name
$client_id = isset($_GET['client_id']) ? intval($_GET['client_id']) : 0;
$payment_id = isset($_GET['payment_id']) ? intval($_GET['payment_id']) : 0;
$client_name = "";

if ($client_id > 0) {
    $res = mysqli_query($conn, "SELECT name FROM clients WHERE id = '$client_id'");
    if ($res && mysqli_num_rows($res) > 0) {
        $client = mysqli_fetch_assoc($res);
        $client_name = htmlspecialchars($client['name']);
    }
}
?>

<div class="card-header pb-0 card-no-border">
            <h2>Edit Invoice</h2>
          </div>

<div class="card-body">
            <form id="invoiceForm" method="POST" action="invoice_update.php">
                <input type="hidden" name="payment_id" class="form-control" value="<?php echo $payment_id?>">
              <div class="row g-3">
                
                
                <div class="col-md-6">
                  <label class="form-label fw-bold">Party Name (Client)</label>
                  <select name="client_id" id="client_id" class="form-select" required>
                    <option value="">-- Select Client --</option>
                    <?php
                    $clients = mysqli_query($conn, "SELECT id, name FROM clients ORDER BY name ASC");
                    while ($c = mysqli_fetch_assoc($clients)) {
                      $selected = ($client_id == $c['id']) ? 'selected' : '';
                      echo "<option value='{$c['id']}' $selected>{$c['name']}</option>";
                    }
                    ?>
                  </select>
                </div>

<div class="col-md-6">
                  <label class="form-label fw-bold">Invoice Number</label>
                  <input type="text" name="invoice_no" class="form-control" placeholder="Enter Invoice Number" required>
                </div>

<div class="col-md-4">
                  <label class="form-label fw-bold">Invoice Date</label>
                  <input type="datetime-local" name="invoice_date" class="form-control">
                </div>

<div class="col-md-4">
                  <label class="form-label fw-bold">Payment Mode</label>
                  <select name="payment_mode" class="form-select">
                    <option value="">Select</option>
                    <option value="CASH">Cash</option>
                    <option value="CREDIT">Credit</option>
                    <option value="ONLINE">Online</option>
                  </select>
                </div>

<div class="col-md-4">
                  <label class="form-label fw-bold">Receiver GSTIN</label>
                  <input type="text" name="receiver_gstin" class="form-control" placeholder="Enter GSTIN">
                </div>

<div class="col-md-6">
                  <label class="form-label fw-bold">Receiver Address</label>
                  <textarea name="receiver_address" class="form-control" rows="3" placeholder="Enter Address"></textarea>
                </div>

<div class="col-md-12 mt-4">
                  <h5>Items Purchased</h5>
                  <table class="table table-bordered" id="itemsTable">
                    <thead class="table-light">
                      <tr>
                        <th>Description</th>
                        <th>HSN</th>
                        <th>Price</th>
                        <th>Qty</th>
                        <th>Tax %</th>
                        <th>Taxable Amt</th>
                        <th>Action</th>
                      </tr>
                    </thead>
                    <tbody>
                      <tr>
                        <td><input name="description[]" class="form-control" placeholder="Enter item"></td>
                        <td><input name="hsn_code[]" class="form-control"></td>
                        <td><input type="number" step="0.01" name="price[]" class="form-control price" value="0"></td>
                        <td><input type="number" step="0.01" name="quantity[]" class="form-control qty" value="1"></td>
                        <td><input type="number" step="0.01" name="tax_percent[]" class="form-control tax" value="0"></td>
                        <td><input type="number" step="0.01" name="taxable_amount[]" class="form-control total" readonly></td>
                        <td><button type="button" class="btn btn-danger btn-sm removeRow">X</button></td>
                      </tr>
                    </tbody>
                  </table>
                  <button id="addItem" type="button" class="btn btn-outline-primary btn-sm">+ Add Item</button>
                </div>

<div class="col-md-4 offset-md-8">
                  <div class="card p-2">
                    <div class="mb-2">
                      <label class="form-label fw-bold">Sub Total (₹)</label>
                      <input type="text" name="sub_total" class="form-control" id="sub_total" value="0" readonly>
                    </div>
                    <div class="mb-2">
                      <label class="form-label fw-bold">Tax Total (₹)</label>
                      <input type="text" name="tax_total" class="form-control" id="tax_total" value="0" readonly>
                    </div>
                    <div class="mb-2">
                      <label class="form-label fw-bold">Grand Total (₹)</label>
                      <input type="text" name="grand_total" class="form-control" id="grand_total" value="0" readonly>
                    </div>
                  </div>
                </div>
              </div>

<div class="text-start mt-4">
                <button type="submit" class="btn btn-success">Submit</button>
                <a href="payment_details_list.php" class="btn btn-secondary">Cancel</a>
                
              </div>

</form>
            
          </div>

</div>
      </div>
    </div>
  </div>
</div>

function recalcTotals() {
    let sub = 0, taxTotal = 0;
    const rows = itemsTable.querySelectorAll('tr');
    rows.forEach(r => {
      const price = parseFloat(r.querySelector('.price').value) || 0;
      const qty = parseFloat(r.querySelector('.qty').value) || 0;
      const tax = parseFloat(r.querySelector('.tax').value) || 0;
      const line = price * qty;
      const taxAmt = line * (tax / 100);
      r.querySelector('.total').value = line.toFixed(2);
      sub += line;
      taxTotal += taxAmt;
    });
    document.getElementById('sub_total').value = sub.toFixed(2);
    document.getElementById('tax_total').value = taxTotal.toFixed(2);
    document.getElementById('grand_total').value = (sub + taxTotal).toFixed(2);
  }

itemsTable.addEventListener('input', function (e) {
    if (['price', 'qty', 'tax'].some(cls => e.target.classList.contains(cls))) {
      recalcTotals();
    }
  });

addItemBtn.addEventListener('click', function () {
    const newRow = document.createElement('tr');
    newRow.innerHTML = `
      <td><input name="description[]" class="form-control" placeholder="Enter item"></td>
      <td><input name="hsn_code[]" class="form-control"></td>
      <td><input type="number" step="0.01" name="price[]" class="form-control price" value="0"></td>
      <td><input type="number" step="0.01" name="quantity[]" class="form-control qty" value="1"></td>
      <td><input type="number" step="0.01" name="tax_percent[]" class="form-control tax" value="0"></td>
      <td><input type="number" step="0.01" name="taxable_amount[]" class="form-control total" readonly></td>
      <td><button type="button" class="btn btn-danger btn-sm removeRow">X</button></td>`;
    itemsTable.appendChild(newRow);
  });

itemsTable.addEventListener('click', function (e) {
    if (e.target.classList.contains('removeRow')) {
      e.target.closest('tr').remove();
      recalcTotals();
    }
  });

// Print Preview
  document.getElementById('printBtn').addEventListener('click', function () {
    window.print();
  });
});
</script>
<?php include 'footer.php'; ob_end_flush(); ?>