Zploit 0-Day Shell

:: Editing File: mcq_save.php

<?php ob_start(); ?>

<?php
include_once("session.php");
include("db.php");

if ($_SERVER["REQUEST_METHOD"] == "POST") {

$question   = trim($_POST['question'] ?? '');
    $option_a   = trim($_POST['option_a'] ?? '');
    $option_b   = trim($_POST['option_b'] ?? '');
    $option_c   = trim($_POST['option_c'] ?? '');
    $option_d   = trim($_POST['option_d'] ?? '');
    $correct    = trim($_POST['correct_answer'] ?? '');
    $status     = trim($_POST['status'] ?? 'active');

// ---- Validation ----
    if (empty($question)) {
        $_SESSION['error'] = "Question is required.";
        header("Location: mcq_add.php");
        exit;
    }
    if (empty($option_a) || empty($option_b) || empty($option_c) || empty($option_d)) {
        $_SESSION['error'] = "All four options are required.";
        header("Location: mcq_add.php");
        exit;
    }
    if (!in_array($correct, ['A','B','C','D'])) {
        $_SESSION['error'] = "Invalid correct answer selected.";
        header("Location: mcq_add.php");
        exit;
    }

// ---- Insert Query ----
    $sql = "INSERT INTO mcq_questions 
            (question, option_a, option_b, option_c, option_d, correct_answer, status) 
            VALUES (?, ?, ?, ?, ?, ?, ?)";

$stmt = mysqli_prepare($conn, $sql);

mysqli_stmt_bind_param(
        $stmt, 
        "sssssss",
        $question, 
        $option_a, 
        $option_b, 
        $option_c, 
        $option_d,
        $correct,
        $status
    );

if (mysqli_stmt_execute($stmt)) {
        $_SESSION['success'] = "MCQ Question added successfully!";
        header("Location: mcq_list.php");
        exit;
    } else {
        $_SESSION['error'] = "Database error: " . mysqli_error($conn);
        header("Location: mcq_add.php");
        exit;
    }

mysqli_stmt_close($stmt);
    mysqli_close($conn);

} else {
    $_SESSION['error'] = "Invalid request method.";
    header("Location: mcq_add.php");
    exit;
}
?>
<?php ob_end_flush(); ?>