Zploit 0-Day Shell

:: Editing File: qcompany_add.php

<?php
ob_start();
include 'config/db.php';
include 'header.php';

$page_title = "Add Quotation Company";
include 'breadcrumb.php';
include 'menu.php';

$message = "";

/* ===== HANDLE FORM SUBMIT ===== */
if ($_SERVER['REQUEST_METHOD'] === 'POST') {

$client_name             = mysqli_real_escape_string($conn, $_POST['client_name']);
    $site_address   = mysqli_real_escape_string($conn, $_POST['site_address']);
    $site_dimension = mysqli_real_escape_string($conn, $_POST['site_dimension']);
    $pincode        = mysqli_real_escape_string($conn, $_POST['pincode']);
    $phone          = mysqli_real_escape_string($conn, $_POST['phone']);
    $email          = mysqli_real_escape_string($conn, $_POST['email']);
    $status                  = isset($_POST['status']) ? 1 : 0;
    $created_at              = date('Y-m-d H:i:s');

if (!empty($client_name)) {

/* ===== INSERT QUERY ===== */
        $sql = "INSERT INTO quotations (
                    client_name,
                    site_address,
                    site_dimension,
                    pincode,
                    phone,
                    email,
                    status,
                    created_at
                ) VALUES (
                    '$client_name',
                    '$site_address',
                    '$site_dimension',
                    '$pincode',
                    '$phone',
                    '$email',
                    '$status',
                    '$created_at'
                )";

if (mysqli_query($conn, $sql)) {
            header("Location: qcompany_list.php?msg=Quotation Company Added Successfully");
            exit;
        } else {
            $message = "Database Error: " . mysqli_error($conn);
        }

} else {
        $message = "Client name is required.";
    }
}
?>

<div class="card-header pb-0">
    <h2>Add Quotation Company</h2>
</div>

<?php if ($message): ?>
<div class="alert alert-danger"><?= $message ?></div>
<?php endif; ?>

<div class="col-md-4">
        <label class="form-label">Client Name</label>
        <input type="text" name="client_name" class="form-control" required>
    </div>

<div class="col-md-4">
        <label class="form-label">Site Address</label>
        <input type="text" name="site_address" class="form-control">
    </div>

<div class="col-md-4">
        <label class="form-label">Site Dimension</label>
        <input type="text" name="site_dimension" class="form-control">
    </div>
    
    <div class="col-md-4">
        <label class="form-label">Pincode</label>
        <input type="text" name="pincode" class="form-control">
    </div>
    
    <div class="col-md-4">
        <label class="form-label">Phone</label>
        <input type="text" name="phone" class="form-control">
    </div>
    
    <div class="col-md-4">
        <label class="form-label">Email</label>
        <input type="email" name="email" class="form-control">
    </div>

<div class="col-md-12 mt-3">
        <div class="form-check form-switch">
            <input class="form-check-input" type="checkbox" name="status" checked>
            <label class="form-check-label">Active</label>
        </div>
    </div>

</div>

<div class="mt-4">
    <button type="submit" class="btn btn-success">
        <i class="fa fa-save"></i> Save
    </button>
    <a href="qcompany_list.php" class="btn btn-secondary">Cancel</a>
</div>

</form>

</div>
</div>
</div>
</div>

<?php include 'footer.php'; ob_end_flush(); ?>