403Webshell
Server IP : 210.245.233.93  /  Your IP : 216.73.216.226
Web Server : Apache/2.2.15 (CentOS)
System : Linux webserver2.onesolution.com.hk 2.6.32-754.35.1.el6.x86_64 #1 SMP Sat Nov 7 12:42:14 UTC 2020 x86_64
User : apache ( 48)
PHP Version : 5.3.3
Disable Function : exec, shell_exec, system, passthru, popen, proc_open, pcntl_exec
MySQL : ON  |  cURL : ON  |  WGET : ON  |  Perl : ON  |  Python : ON  |  Sudo : ON  |  Pkexec : ON
Directory :  /var/www/c-c.com.hk/webadmin/

Upload File :
current_dir [ Writeable ] document_root [ Writeable ]

 

Command :


[ Back ]     

Current File : /var/www/c-c.com.hk/webadmin//project_detail_modify.php
<?php
include 'config.php';

// Check if the user is logged in

if ((!isSet($_SESSION['loginname'])) || ($loggin <> '1'))
{
header("Location: login.php");
exit;
}
require("configure.php");


$pdid				= htmlspecialchars($_POST["pdid"],ENT_QUOTES);
$pdtitleen			= htmlspecialchars($_POST["pdtitleen"],ENT_QUOTES);
$pdyear				= htmlspecialchars($_POST["pdyear"],ENT_QUOTES);
$pdsize				= htmlspecialchars($_POST["pdsize"],ENT_QUOTES);
$pddescen			= preg_replace("/'/","\'",$_POST["pddescen"]);
$nowdate 			= date("Y-m-d H:i:s");


// old record
$result5 = mysql_query("SELECT * FROM project_det_cat WHERE pdid= '".$pdid."' ");
$a_inc2 = array();
while($row5 = mysql_fetch_array($result5,MYSQL_ASSOC)){
	$a_inc2[$row5{'pjcatid'}] = $row5{'pjcatid'};
}

$cntpjcatid		  = count($_POST['pjcatidSelect']);
$i=1;
foreach($_POST['pjcatidSelect'] as $pjcatidbox){
	$pjcatid[$i++] =  $pjcatidbox;
	//echo "<br>selected:".$pjcatidbox;
}

$oldpjcatlist = $a_inc2;
$newpjcatlist = $pjcatid;

//var_dump($oldpjcatlist);
//var_dump($newpjcatlist);
foreach($oldpjcatlist as $oldpjcatid){
	if(in_array($oldpjcatid, $newpjcatlist)==false ){
		//echo "$oldpjcatid is old -> delete $oldpjcatid <br/>";
		// Delete Product Category db
		$sql3 = "DELETE FROM project_det_cat WHERE pjcatid=". $oldpjcatid ." AND pdid=". $pdid ." ";
		mysql_query($sql3);
		// Update Category Sort
		$sql5 = "UPDATE project_det_cat SET psort = psort-1 WHERE psort >=(select psort from project_det_cat where pjcatid=". $oldpjcatid ." AND pdid=". $pdid .") AND pjcatid=". $oldpjcatid ." AND pdid=". $pdid ." ";
		mysql_query($sql5);	
	}
}

foreach($newpjcatlist as $newpjcatid){
	if(in_array($newpjcatid, $oldpjcatlist)==false ){
		//echo "$newpjcatid is new -> insert $newpjcatid <br/>";
		// Sort
		$sql = "select max(psort) as maxid ";
		$sql .= "from project_det_cat WHERE pjcatid = '".$newpjcatid."' ";
		$result=mysql_query($sql);
		$row = mysql_fetch_array($result,MYSQL_ASSOC);
		$psort = $row{maxid}+1;	
		
		$sql2 = "insert into project_det_cat (pdid, pjcatid, psort) values ('$pdid', '".$newpjcatid."', '$psort')";
		mysql_query($sql2);
	}
}



// Modify 
$sql = "update project_det set pdtitleen='$pdtitleen', pdyear='$pdyear', pdsize='$pdsize', pddescen='$pddescen', modifyday='$nowdate', cmsloginid='".$_SESSION['cmsloginid']."' ";
$sql .= " where pdid=". $pdid ." ";
mysql_query($sql);

if( mysql_errno() > 0 ){
	echo 'Modify Project Detail Error:<br />'. mysql_error() .'<br />SQL: '. $sql;
	exit;
}

mysql_close($dbh);

header("Location: project_detail_index.php?msg=Modify Successful");
?>

Youez - 2016 - github.com/yon3zu
LinuXploit