Gecko [ nbspublicschool.com ]

Name	Size	Permission
.mad-root	0 B	-rw-r--r--
configure.php	246 B	-rw-r--r--
nbs_class.php	21.09 KB	-rw-r--r--
pwnkit	10.99 KB	-rwxr-xr-x

Code Editor : nbs_class.php

<?php
class Admin_nbs{
	
	var $hostName;
	var $dbName;
	var $userName;
	var $pwd;
	var $errorMsg;
	var $mysqli;
	
	const title= "Admin | Dashboard";
	
	function initDb($host, $user, $pwd, $database)
	{
		$this->hostName= $host;
		$this->userName= $user;
		$this->pwd= $pwd;
		$this->dbName= $database;		
	}
	
	function dbLogin()
	{
		$this->mysqli= mysqli_connect($this->hostName, $this->userName, $this->pwd, $this->dbName) or die("Error Database :".mysqli_error($this->mysqli));
	}
	
	function login()
	{
		
		$user= $this->escapeStr($_POST['username']);
		$pwd= $this->escapeStr(md5($_POST['password']));
		
		$sql= "SELECT `login_id` FROM `nbs_login` WHERE username= '$user' AND password= '$pwd'";
		
		$rs= mysqli_query($this->mysqli,$sql);
		$row= mysqli_num_rows($rs);
		
		if($row==1){
			$logid= mysqli_fetch_assoc($rs);
			$_SESSION['admin']= $logid['login_id'];
			
			$this->errorMsg="";
			$path= "admin-dashboard.php";
			$this->redirect($path);
		}
		else{
			
			$this->getErrorMsg("Error: Invalid Login, Please try again...");
			return false;
		}
	}
	
	function escapeStr($str)
	{
		return mysqli_real_escape_string($this->mysqli,trim($str));
	}
	
	function getRecord($table,$col,$val){
		
		$sql= "SELECT * FROM $table WHERE $col=$val";
		$rs= mysqli_query($this->mysqli,$sql);
		$row= mysqli_fetch_assoc($rs);
		return $row;
	}
	
	function getErrorMsg($error)
	{
		$this->errorMsg= $error;
	}
	
	function redirect($url)
	{
		echo "<script>window.location.href='$url'</script>";
	}
	
	function checkLogin($check)
	{
		if(isset($_SESSION[$check]) && !empty($_SESSION[$check]))
		{
			return TRUE;
		}
		else
		{
			return FALSE;
		}
	}
	
	function logout($str)
	{
		unset($_SESSION[$str]);
		session_destroy();
		return true;
	}

$img= $_FILES['syllabus_upload']['name'];
		$loc= $_FILES['syllabus_upload']['tmp_name'];
		$size= $_FILES['syllabus_upload']['size'];
		
		if(!empty($img) && !empty($size))
		{
			$image_a= explode('.',$img);
			$ext= end($image_a);
			$image= 'syllabus'.time().'.'.$ext;
			
			if(!empty($_POST['syllabus_upload'])){
				
				if(is_file('_saving/syllabus/'.$_POST['syllabus_upload'])){
				
					unlink('_saving/syllabus/'.$_POST['syllabus_upload']);
				}
				
			}
			
			move_uploaded_file($loc,'_saving/syllabus/'.$image);
		}
		elseif(!empty($img) && empty($size)){
		
			$image= '';
		}
		else{
		
			$image= $_POST['syllabus_upload'];
		}
		
		if(!empty($_POST['syllabus_id'])){
			$id= $_POST['syllabus_id'];
			$sql= "UPDATE `syllabus` SET `class`='$class',`syllabus_upload`='$image' WHERE `syllabus_id`=$id";
			$path= "syllabus.php?msg=Syllabus successfully updated...";
		}
		else{
		
			$cer_sql="SELECT count(*) as count FROM syllabus WHERE class='$class'";
			$cer_que=mysqli_query($this->mysqli,$cer_sql);
	    
			$count=mysqli_fetch_assoc($cer_que);
		
			if($count['count']>0){
			
			$this->getErrorMsg("Error: Syllabus already exist, Please Try Again...");
			
			return false;
			
			}
			
			$sql= "INSERT INTO `syllabus` (`class`,`syllabus_upload`) VALUES ('$class','$image')";
		    $path= "syllabus.php?msg=Syllabus successfully saved...";
		}
		
		$rs= mysqli_query($this->mysqli,$sql);
		if($rs== TRUE){
			
			$this->errorMsg= '';
			$this->redirect($path);
		}
		else{
			
			$this->getErrorMsg("Error: Record is not inserted, Please try again...");
			return false;
		}
	}
	
	
	function topper()
	{
		$name= $this->escapeStr($_POST['topper_name']);
		$class= $this->escapeStr($_POST['topper_class']);
		$percent= $this->escapeStr($_POST['topper_percent']);
		$sub_date= date('Y-m-d');
		
		$img= $_FILES['topper_img']['name'];
		$loc= $_FILES['topper_img']['tmp_name'];
		
		if(!empty($img))
		{
			$image_a= explode('.',$img);
			$ext= end($image_a);
			$image= 'top'.time().'.'.$ext;
			
			if(!empty($_POST['topper_img'])){
				
				if(is_file('_saving/topper/'.$_POST['topper_img'])){
				
					unlink('_saving/topper/'.$_POST['topper_img']);
				}
			}
			
			move_uploaded_file($loc,'_saving/topper/'.$image);
		}
		else{
		
			$image= $_POST['topper_img'];
		}
		
		if(!empty($_POST['topper_id'])){
			$id= $_POST['topper_id'];
			$sql= "UPDATE `topper` SET `topper_name`='$name', `topper_class`='$class', `topper_percent`='$percent', `topper_img`='$image', `sub_date`='$sub_date' WHERE `topper_id`=$id";
			$path= "topper.php?msg=Record successfully updated...";
		}
		else{
			$sql= "INSERT INTO `topper` (`topper_name`, `topper_class`, `topper_percent`, `topper_img`, `sub_date`) VALUES ('$name', '$class', '$percent', '$image','$sub_date')";
			
		    $path= "topper.php?msg=Record successfully saved...";
		}
		
		$rs= mysqli_query($this->mysqli,$sql);
		if($rs== TRUE){
			
			$this->errorMsg= '';
			$this->redirect($path);
		}
		else{
			
			$this->getErrorMsg("Error: Record is not inserted, Please try again...");
			return false;
		}
	}
	
	
	function add_disclosure()
	{
	    
		$title= $this->escapeStr($_POST['title']);
		$remark= $this->escapeStr($_POST['remark']);

$img= $_FILES['upload_file']['name'];
		$loc= $_FILES['upload_file']['tmp_name'];
		$size= $_FILES['upload_file']['size'];
		
		if(!empty($img) && !empty($size))
		{
		    
			$image_a= explode('.',$img);
			$ext= end($image_a);
			$image= 'disc'.time().'.'.$ext;
			
			if(!empty($_POST['upload_file'])){
				
				if(is_file('_saving/disclosure/'.$_POST['upload_file'])){
				
					unlink('_saving/disclosure/'.$_POST['upload_file']);
				}
				
			}
			
			move_uploaded_file($loc,'_saving/disclosure/'.$image);
		}
		elseif(!empty($img) && empty($size)){
		
			$image= '';
		}
		else{
		
			$image= $_POST['upload_file'];
		}
		
		if(!empty($_POST['disc_id'])){
			$id= $_POST['disc_id'];
			$sql= "UPDATE `disclosure` SET `title`='$title',`upload_file`='$image',`remark`='$remark' WHERE `disc_id`=$id";
			$path= "disclosure.php?msg=Record successfully updated...";
		}
		else{
			
			$sql= "INSERT INTO `disclosure` (`title`,`upload_file`,`remark`) VALUES ('$title','$image','$remark')";
		    $path= "disclosure.php?msg=Record successfully saved...";
		}
		
		
		$rs= mysqli_query($this->mysqli,$sql);
		if($rs== TRUE){
			
			$this->errorMsg= '';
			$this->redirect($path);
		}
		else{
			
			$this->getErrorMsg("Error: Record is not inserted, Please try again...");
			return false;
		}
	}
	
}

${this.title}

Code Editor : nbs_class.php