One Hat Cyber Team

Your IP : 216.73.216.240

Server IP : 162.240.106.28

Server : Linux server.ganesand.com 3.10.0-1160.80.1.el7.x86_64 #1 SMP Tue Nov 8 15:48:59 UTC 2022 x86_64

Server Software : Apache

PHP Version : 7.1.33

Buat File | Buat Folder

Dir : ~/home/thoa/www/admin/

Edit File: mg_schedule.php

<?php include('config.php');
$avai = mysql_query("select * from schedule");
$row = mysql_fetch_array($avai);
 ?>

<?php

/*  $con = mysql_connect('localhost', 'root', '');

mysql_select_db("ecomm", $con);   */

error_reporting(0);

?>

<?php

$S_ID = $_GET['S_ID'];

$view = mysql_query("select * from schedule where S_ID = '".$S_ID."'"); // for editing

$data = mysql_fetch_array($view);

if($_GET['SAI']){

$STS = $_GET['S_STS'];

if($STS == 0){

$upd_sts =  mysql_query("UPDATE schedule SET S_STS ='0' WHERE S_ID ='".$_GET['SAI']."'");  //for changing status

}

else{

$upd_sts =  mysql_query("UPDATE schedule SET S_STS ='1' WHERE S_ID ='".$_GET['SAI']."'");

}

if($_GET['del_id']){ ?>

<?php $del = mysql_query("delete from schedule where S_ID='".$_GET['del_id']."'"); //for deleting status

if($del){?>

alert("Schedule detail deleted sucessfully");

window.location= "mg_schedule.php";

</script>

<?php }

if(!$del){?>

alert("Schedule detail  Not deleted sucessfully");

window.location= "mg_schedule.php";

</script>

<?php }

}

if($_POST['submit']){

$apsel = mysql_real_escape_string($_POST['apsel']);
			  $subcat = mysql_real_escape_string($_POST['subcat']);			  
			  
			  $sdate = mysql_real_escape_string($_POST['sdate']);
		      $day1 = mysql_real_escape_string($_POST['day1']);
		      $day2 = mysql_real_escape_string($_POST['day2']);
		      $day3 = mysql_real_escape_string($_POST['day3']);
		      $day4 = mysql_real_escape_string($_POST['day4']);
		      $day5 = mysql_real_escape_string($_POST['day5']);
		      $day6 = mysql_real_escape_string($_POST['day6']);
		      $day7 = mysql_real_escape_string($_POST['day7']);
		      $day8 = mysql_real_escape_string($_POST['day8']);
		      $day9 = mysql_real_escape_string($_POST['day9']);
		      $day10 = mysql_real_escape_string($_POST['day10']);			  
			  
		      $day11 = mysql_real_escape_string($_POST['day11']);
		      $day12 = mysql_real_escape_string($_POST['day12']);
		      $day13 = mysql_real_escape_string($_POST['day13']);
		      $day14 = mysql_real_escape_string($_POST['day14']);
		      $day15 = mysql_real_escape_string($_POST['day15']);
		      $day16 = mysql_real_escape_string($_POST['day16']);
		      $day17 = mysql_real_escape_string($_POST['day17']);
		      $day18 = mysql_real_escape_string($_POST['day18']);
		      $day19 = mysql_real_escape_string($_POST['day19']);
		      $day20 = mysql_real_escape_string($_POST['day20']);			  
		      $day21 = mysql_real_escape_string($_POST['day21']);			  
		      $day22 = mysql_real_escape_string($_POST['day22']);
		      $day23 = mysql_real_escape_string($_POST['day23']);
		      $day24 = mysql_real_escape_string($_POST['day24']);
		      $day25 = mysql_real_escape_string($_POST['day25']);
		      $day26 = mysql_real_escape_string($_POST['day26']);
		      $day27 = mysql_real_escape_string($_POST['day27']);
		      $day28 = mysql_real_escape_string($_POST['day28']);
		      $day29 = mysql_real_escape_string($_POST['day29']);			  
		      $day30 = mysql_real_escape_string($_POST['day30']);	
		      $day31 = mysql_real_escape_string($_POST['day31']);	
		      $day32 = mysql_real_escape_string($_POST['day32']);			  
		      $day33 = mysql_real_escape_string($_POST['day33']);	
		      $day34 = mysql_real_escape_string($_POST['day34']);	
		      $day35 = mysql_real_escape_string($_POST['day35']);	
		      $day36 = mysql_real_escape_string($_POST['day36']);	
		      $day37 = mysql_real_escape_string($_POST['day37']);	
		      $day38 = mysql_real_escape_string($_POST['day38']);	
		      $day39 = mysql_real_escape_string($_POST['day39']);	
		      $day40 = mysql_real_escape_string($_POST['day40']);

if($_GET['S_ID']=="")
			{

/* 					$querytot=mysql_query("select *  from schedule where S_PACK ='".$apsel."' and S_SUBPACK='".$subcat."' and S_YR like '$sdate'");
					if($rowtot=mysql_fetch_array($querytot))
					{
?>
<script type="text/javascript">
alert("Schedule already have for that package");
location.href = 'mg_schedule.php';</script>
<?

}
			
			else{ */

$ins = mysql_query("insert into schedule (S_PACK,S_SUBPACK,S_DATE,DAY1,DAY2,DAY3,DAY4,DAY5,DAY6,DAY7,DAY8,DAY9,DAY10,DAY11,DAY12,DAY13,DAY14,DAY15,DAY16,DAY17,DAY18,DAY19,DAY20,DAY21,DAY22,DAY23,DAY24,DAY25,DAY26,DAY27,DAY28,DAY29,DAY30,DAY31,DAY32,DAY33,DAY34,DAY35,DAY36,DAY37,DAY38,DAY39,DAY40) values ('$apsel','$subcat','$sdate','$day1','$day2','$day3','$day4','$day5','$day6','$day7','$day8','$day9','$day10','$day11','$day12','$day13','$day14','$day15','$day16','$day17','$day18','$day19','$day20','$day21','$day22','$day23','$day24','$day25','$day26','$day27','$day28','$day29','$day30','$day31','$day32','$day33','$day34','$day35','$day36','$day37','$day38','$day39','$day40')");	
	
		  			?><script>alert("Inserted sucessfully");

</script><?
			           
	/* 	}  */
             }

if($_GET['S_ID']!=""){
		
				{

$upd =  mysql_query("update schedule set S_PACK='$apsel',S_SUBPACK='$subcat',S_DATE='$sdate',DAY1='$day1',DAY2='$day2',DAY3='$day3',DAY4='$day4',DAY5='$day5',DAY6='$day6',DAY7='$day7',DAY8='$day8',DAY9='$day9',DAY10='$day10',DAY11='$day11',DAY12='$day12',DAY13='$day13',DAY14='$day14',DAY15='$day15',DAY16='$day16',DAY17='$day17',DAY18='$day18',DAY19='$day19',DAY20='$day20',DAY21='$day21',DAY22='$day22',DAY23='$day23',DAY24='$day24',DAY25='$day25',DAY26='$day26',DAY27='$day27',DAY28='$day28',DAY29='$day29',DAY30='$day30',DAY31='$day31',DAY32='$day32',DAY33='$day33',DAY34='$day34',DAY35='$day35',DAY36='$day36',DAY37='$day37',DAY38='$day38',DAY39='$day39',DAY40='$day40'   WHERE S_ID ='".$S_ID."'");
			 }			
					if($upd){ ?>

if(del){
	
  window.location.href = "mg_schedule.php?del_id="+id+"&del=1";
  
  }

else{
	
  window.location.href = "mg_schedule.php";

}

</script>

<!DOCTYPE html>

<html>

<title>Admin Panel</title>

<!--[if lt IE 9]>

<![endif]-->

function showUser(str)
{

$.ajax({
  type: "GET",
  url: "getsub.php?q="+str,
    success: function(result){
     $("#subcat").html(result);
  }

});
	}

</script>
</head>

tinymce.init({
	
        selector: "textarea",

themes: "modern",

plugins: [

"advlist autolink lists link image charmap print preview anchor",

"searchreplace visualblocks code fullscreen",

"insertdatetime media table contextmenu paste"

],

});

</script>

<body>

<a href="#">
					<span class="sr-only">Toggle navigation</span>

</button>

<a class="navbar-brand" href="#">Admin</a>

<li><a href="#"><span class="glyphicon glyphicon-user"></span> Profile</a></li>

<li><a href="#"><span class="glyphicon glyphicon-cog"></span> Settings</a></li>

<li><a href="logou.php"><span class="glyphicon glyphicon-log-out"></span> Logout</a></li>

</ul>

</li>

</ul>

</div>

</div>

</nav>

</div>
		
	<div class="col-sm-9 col-sm-offset-3 col-lg-10 col-lg-offset-2 main">			
		<div class="row">
			<ol class="breadcrumb">
				<li><a href="dash.php"><span class="glyphicon glyphicon-home"></span></a></li>

<li class="active">Manage Schedule</li>

</ol>

</div>

<h2 class="page-header">Add/Edit Schedule Details</h2>

</div>

</div>
          <div class="row">

<label for="exampleInputEmail1">Schedule Date:</label>
	<?php if($S_ID){?>
	                <input type="date" class="form-control" id="demo" name="sdate" value="<?php echo $data['S_DATE']; ?>">
	<?php } else {?>
                    <input type="date" class="form-control" id="demo" name="sdate" value="<?php echo date('Y-m-d') ?>">
	<?php }?>
                    </div>
                    
					
					<div class="form-group col-sm-11">
					<label for="sel1">Select Package:</label>
					<select id="apsel" name="apsel" class="form-control" onclick="showUser(this.value)"> 					
					<?  if($S_ID) {?>

<?php 
					$query1=mysql_query("select *  from schedule where S_ID = '".$S_ID."'");
					while($row1=mysql_fetch_array($query1)) {?>
					<option value="<?php echo $row1['S_PACK'];?>"><?php echo $row1['S_PACK'];?></option>
					<?php }?>
					<?php 
					$query2=mysql_query("select *  from package");
					while($row2=mysql_fetch_array($query2)) {?>
					<option value="<?php echo $row2['P_NAME'];?>"><?php echo $row2['P_NAME'];?></option>
					<?php }?>
					<?}else{?>
					<option value="">Select</option>
					<?php 
					$query1=mysql_query("select *  from package");
					while($row1=mysql_fetch_array($query1)) {?>
					<option value="<?php echo $row1['P_NAME'];?>"><?php echo $row1['P_NAME'];?></option>
					<?php }?>
					<? }?>
					</select>					
					</div>
					
					<div class="form-group col-sm-11">	
					<label for="sel1">Select Subpackage:</label>
					<?  if($S_ID) {?> 
					<select id="subcat" name="subcat" class="form-control"> 
					<?php 
					$query1=mysql_query("select *  from schedule where S_ID = '".$S_ID."'");
					while($row1=mysql_fetch_array($query1)) {?>
					<option value="<?php echo $row1['S_SUBPACK'];?>"><?php echo $row1['S_SUBPACK'];?></option>
					<?php 
					$query2=mysql_query("select *  from subpackage");
					while($row2=mysql_fetch_array($query2)) {?>
					<option value="<?php echo $row2['SP_NAME'];?>"><?php echo $row2['SP_NAME'];?></option> 
					<?php }?>					
					<?php }?>
					</select>
					<?}else{?>					
					
					<select id="subcat" name="subcat" class="form-control"> 
					<option value="">Select</option>					
					<?php 
					$query2=mysql_query("select *  from subpackage");
					while($row2=mysql_fetch_array($query2)) {?>
					<option value="<?php echo $row2['SP_NAME'];?>"><?php echo $row2['SP_NAME'];?></option> 
					<?php }?>
					</select>
					<? }?>
					</div>					
					
											
					<div class="form-group col-sm-11">