403Webshell
Server IP : 172.67.187.206  /  Your IP : 172.71.28.155
Web Server : Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/5.6.30
System : Windows NT WIN-ECQAAA40806 6.2 build 9200 (Windows Server 2012 Standard Edition) i586
User : SYSTEM ( 0)
PHP Version : 5.6.30
Disable Function : NONE
MySQL : ON  |  cURL : ON  |  WGET : OFF  |  Perl : OFF  |  Python : OFF  |  Sudo : OFF  |  Pkexec : OFF
Directory :  /Inetpub/www/training/admin - Copy/

Upload File :
current_dir [ Writeable ] document_root [ Writeable ]

 

Command :

[ Back ]     

Current File : /Inetpub/www/training/admin - Copy/user_form.php
<?php
include("../session.php");

if ($role != 'admin') {
    header("Location: ../index.php");
    exit;
}

include("../db.php");

$is_edit = false;
$username = "";
$email = "";
$password = "";
$role = "user";

// ตรวจสอบการแก้ไข
if (isset($_GET['id'])) {
    $is_edit = true;
    $id = intval($_GET['id']);
    $res = mysqli_query($conn, "SELECT * FROM users WHERE id = $id");
    if ($row = mysqli_fetch_assoc($res)) {
        $username = $row['username'];
        $email = $row['email'];
        $role = $row['role'];
    } else {
        echo "ไม่พบผู้ใช้"; exit;
    }
}

// บันทึกข้อมูล
if ($_SERVER["REQUEST_METHOD"] == "POST") {
    $username = trim($_POST['username']);
    $email = trim($_POST['email']);
    $password = $_POST['password'];
    $role = $_POST['role'];

    if ($is_edit) {
        if ($password != "") {
            $password = password_hash($password, PASSWORD_DEFAULT);  // เก็บรหัสผ่านใหม่หากมีการแก้ไข
            $sql = "UPDATE users SET username='$username', email='$email', password='$password', role='$role' WHERE id=$id";
        } else {
            // ถ้าไม่มีการแก้ไขรหัสผ่าน
            $sql = "UPDATE users SET username='$username', email='$email', role='$role' WHERE id=$id";
        }
    } else {
        // ถ้าเป็นการเพิ่มผู้ใช้ใหม่
        $password = password_hash($password, PASSWORD_DEFAULT);
        $sql = "INSERT INTO users (username, email, password, role) VALUES ('$username', '$email', '$password', '$role')";
    }

    if (mysqli_query($conn, $sql)) {
        header("Location: users.php");
        exit;
    } else {
        echo "เกิดข้อผิดพลาด: " . mysqli_error($conn);
    }
}
?>

<!DOCTYPE html>
<html>
<head>
    <meta charset="UTF-8">
    <title><?php echo $is_edit ? "แก้ไข" : "เพิ่ม"; ?> ผู้ใช้</title>
    <link rel="stylesheet" href="https://stackpath.bootstrapcdn.com/bootstrap/3.4.1/css/bootstrap.min.css">
</head>
<body>
<div class="container">
    <h3 class="text-center"><?php echo $is_edit ? "แก้ไข" : "เพิ่ม"; ?> ผู้ใช้</h3>
    <p class="text-right">
        <a href="users.php" class="btn btn-default btn-sm">← กลับ</a>
    </p>

    <form method="post">
        <div class="form-group">
            <label>ชื่อผู้ใช้</label>
            <input type="text" name="username" class="form-control" required value="<?php echo htmlspecialchars($username); ?>">
        </div>

        <div class="form-group">
            <label>อีเมล</label>
            <input type="email" name="email" class="form-control" required value="<?php echo htmlspecialchars($email); ?>">
        </div>

        <div class="form-group">
            <label>รหัสผ่าน</label>
            <input type="password" name="password" class="form-control" <?php echo !$is_edit ? "required" : ""; ?> placeholder="<?php echo $is_edit ? "กรุณากรอกรหัสผ่านหากต้องการเปลี่ยน" : "กรุณากรอกรหัสผ่าน"; ?>">
        </div>

        <div class="form-group">
            <label>ประเภทผู้ใช้</label>
            <select name="role" class="form-control" required>
                <option value="admin" <?php if ($role == 'admin') echo "selected"; ?>>Admin</option>
                <option value="user" <?php if ($role == 'user') echo "selected"; ?>>User</option>
            </select>
        </div>

        <button type="submit" class="btn btn-success"><?php echo $is_edit ? "อัปเดต" : "บันทึก"; ?></button>
    </form>
</div>
</body>
</html>

Youez - 2016 - github.com/yon3zu
LinuXploit