LittleDemon WebShell

<?php
if ((!isset($_SESSION['gen256']))  ) {
  echo "<script>
        window.open('login.php','_self');
    </script>";  
}

?>
 <?php
                $actid=$_GET['aid'];
                 $bid=$_GET['bid'];
                  $rid=$_GET['qid'];
                $queryxx="SELECT *,(items.unitprice*iquantity.quantity) AS stotal,iquantity.id AS rid FROM iquantity,site,activity,items WHERE(iquantity.itemid=items.id) AND (iquantity.siteid=site.id) AND(iquantity.activityid=activity.id) AND (site.id='$bid') AND (iquantity.id='$rid') ORDER BY iquantity.id ASC";
                $resultxx = mysqli_query($conn,$queryxx);
                $countxx = 1;
                while($row = mysqli_fetch_assoc($resultxx) ){
                    $description = $row['description'];
                    $unit = $row['units'];
                    $unitprice = $row['unitprice'];
                    $quantity = $row['quantity'];
                    $stotal = $row['stotal'];
                    $rid = $row['rid'];
                    $itemidx = $row['itemid'];
                
                    ?> 

 <div class="panel-body">
                <form method="post" enctype="multipart/form-data">
                <div class="row">
                    <div class="col-lg-6">

     <div class="form-group">
    <label>Select Item:</label>
    
    <select class="form-control" name="item" required>
    <option value="<?php echo $itemidx; ?>"><?php echo $description; ?></option>  
    <?php
    $actid=$_GET['aid'];
                $query="SELECT * FROM items WHERE activityid='$actid' ORDER BY id DESC";

                 
                $result = mysqli_query($conn,$query);
                $count = 1;
                while($row = mysqli_fetch_assoc($result) ){
                    $itemid = $row['id'];
                    $item = $row['description'];
                   
                
                    ?> 
    <option value="<?php echo $itemid; ?>"><?php echo $item; ?></option>

    <?php
                    $count ++;
                }
            ?>  
    
   <!--  <option>Female</option>  -->
  </select>

</div>














  
</div>


 <div class="col-lg-6">

 
  <div class="form-group">
  <label>Quantity:</label>
  <input type="number" class="form-control" name="quantity" value="<?php echo $quantity; ?>" required>
</div>









 

<div class="form-group">
    <input type="submit" name="register" class="btn btn-sm btn-success" value="Edit">
</div>

    </div></div></form></div>
 <?php
                    $countxx ++;
                }
            ?>

<?php
include "dbconfig/db.php";
 $bid=$_GET['bid'];
 $actid=$_GET['aid'];
 $rid=$_GET['qid'];
if(isset($_POST['register'])){
    
    $item = strip_tags($_POST['item']);


 
    $quantity = strip_tags($_POST['quantity']);

  // $sql = "INSERT INTO iquantity(itemid,quantity,siteid,activityid) VAlUES('$item','$quantity','$bid','$actid')";
     $sql = "UPDATE iquantity SET itemid='$item',quantity ='$quantity' WHERE id='$rid'";


    
    mysqli_query($conn,$sql);
     echo "<script>alert('Edited')</script>";
    // echo $count;

         echo"<script>
            window.open('index.php?p=qoute&bid=$bid&aid=$actid','_self');
            </script>"; 


}



?>