aibishal

✏️ Editing: edit_group.php

<?php
session_start();
$user = $_SESSION['username'];
$log = $_SESSION['admin'];
if ($log != "log"){
	header ("Location: login.php");
}?>
<html>
<head>
<title>edit_dep
</title>
<link rel = "stylesheet" type = "text/css" href = "css/style.css"/>
</head>
<body >
<div  id = "container">
<div id = "bg_container">
     <div id="header" >
	 </div>

<div  id = "bg_wrapper" >
	     <h1 style="font-size:28px;">DECOHAS Online Library System<h1>
	 </div>
	 
	 <div id "wrapper" style="margin-left:50px;"> 
	<div class = "navbarr">
	   <ul>
	   <li><a href = "admin.php">Home</a></li>
	   <li></li>
	   <li><a href ="#">Options</a>
			      <ul>
				     <li><a href ="manage_user.php">Manage User</a></li>
					 <li><a href ="add_user.php">Add User</a></li>
					 <li><a href ="add_dep.php">Add Departments</a></li>
					 <li><a href ="view_dep.php">View Departments</a></li>
					 <li><a href ="uploaded_books.php">Uploaded Books</a></li>
					 
				  </ul>
			   </li>
	   
	   <li><a href = "changepass.php"><img src = "images/my_account.png"
	   style="margin-right:3px;">Update password</img></a></li>
	   <li><a href = "index.php"><img  src = "images/logout.png"
	   style="margin-right:3px;">Logout</img></a></li>
	   </ul>
	</div>

<?php

$msg = "";

if (isset($_POST['cancel'])) {
	print("<script>location.href = 'view_dep.php'</script>");
}

if (isset($_POST['change'])) {
	include 'sql.php';
	
	$grp = $_POST['groups'];
	$hv = $_POST['hide_val'];
	
	//unwanted HTML (scripting attacks)
	$grp = htmlspecialchars($grp);
	$hv = htmlspecialchars($hv);

//function
	$grp = quote_smart($grp, $db_handle);
	$hv = quote_smart($hv, $db_handle);	
	
	$SQL = "UPDATE group_title SET group_name = $grp WHERE group_name = $hv";
	$result = mysql_query($SQL);
	if($result){
		$SQL = "UPDATE info SET groups = $grp WHERE groups = $hv";
		mysql_query($SQL);
		$msg = "Changes has been saved.";
	}
	else{
		$msg = "department name already exist!";
	}
	?>
	<div id = "head">
<font face="Cooper Black" size = "5" color = "blue"><?php print $msg; ?></font>
<?php
mysql_close($db_handle);
	print("<div style=' margin-left:100px; margin-top:20px;'>");
	print("<form name='ok_form' method='post' action='view_dep.php'>");
	print("<input name = 'ok' type = 'submit' value = 'OK' style='width:60px; height:30px;'>");
	print("</div>");
?>
</div>
	<?php
}
else{
	$namekey = $_REQUEST['key'];
	include 'sql.php';

//	$SQL = "SELECT * FROM info WHERE username = '$namekey'";
//	$result = mysql_query($SQL);
//	while ($db_field = mysql_fetch_assoc($result)) {
//		$user = $db_field['username'];
//		$grp = $db_field['groups'];
//		$pos = $db_field['position'];
//	}
	
	print("<div id = 'head'
	'>");
	print("<h2>Edit Departments:<h2>");
	print("</div>");
	print("<div id = 'table'>");
	print("<form name='edit_form' method='post' action='edit_group.php'>");
	print("<table border = '0' >");
	print("<tr><td><b style='font-size:20px; margin-left:20px;'>Departments:</b></td>");
	print("<td><input name = 'groups' type = 'text' value = $namekey style='border-radius:4px; padding:6px;
	width:400px; margin-bottom:15px;margin-top:35px;'></td>");
	print("<td><input name = 'hide_val' type = 'hidden' value = $namekey></td>");
	print("<tr>");
	print("<td align = 'right'></td>");
	print("<td align = 'right'><input name = 'cancel' type = 'submit' value = 'CANCEL' style='width:90px; background:#F6F4F0;
	 padding:4px; border-radius:4px;'>");
	print("<input name = 'change' type = 'submit' value = 'SAVE' style='width:90px; background:#F6F4F0;
	 padding:4px; border-radius:4px;'></td>");
	print("</tr>");
	print("</table>");
	print("</form>");
	print("</div>");
}

</div>
</div>
<div id="footer" >
   <p>&copy2017 DECOHAS</p>
   </div>
  
</div>
</body>
</html>

Gifari Industries - BD Cyber Security Team