Zploit 0-Day Shell

:: Editing File: work_sections_add.php

<?php
ob_start();
include 'header.php';
$page_title = "Add Work Section";
include 'breadcrumb.php';
include 'menu.php';

$message = "";

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $section_name = mysqli_real_escape_string($conn, $_POST['section_name']);
    $description = mysqli_real_escape_string($conn, $_POST['description']);
    $created_at = date('Y-m-d H:i:s');

if (!empty($section_name)) {
        $sql = "INSERT INTO work_sections (section_name, description, created_at)
                VALUES ('$section_name', '$description', '$created_at')";
        if (mysqli_query($conn, $sql)) {
            header("Location: work_sections_list.php?msg=Work Section Added Successfully");
            exit;
        } else {
            $message = "Database Error: " . mysqli_error($conn);
        }
    } else {
        $message = "Section name is required.";
    }
}
?>

<div class="page-body">
  <div class="container-fluid">
    <div class="card">
      <div class="card-header pb-0">
        <h2>Add Work Section</h2>
      </div>
      <div class="card-body">
        <?php if ($message): ?>
          <div class="alert alert-danger"><?= $message; ?></div>
        <?php endif; ?>
        <form method="POST">
          <div class="row g-3">
            <div class="col-md-6">
              <label class="form-label">Section Name</label>
              <input type="text" name="section_name" class="form-control" required>
            </div>
            <div class="col-md-6">
              <label class="form-label">Description</label>
              <textarea name="description" class="form-control" rows="3"></textarea>
            </div>
          </div>
          <div class="mt-4">
            <button type="submit" class="btn btn-success">Save</button>
            <a href="work_sections_list.php" class="btn btn-secondary">Cancel</a>
          </div>
        </form>
      </div>
    </div>
  </div>
</div>

<?php include 'footer.php'; ob_end_flush(); ?>