LittleDemon WebShell

<?php
include_once "conn.php";


$pool = new ConnectionPool();
$connection1 = $pool->getConnection();

$connection2 = $pool->getConnection();

if (!$connection1 && !$connection2) {
    die("Connection failed");
}
$title ='';



function convertPriceToNumber($numericValue,$unit) {
   
    if (preg_match('/l/i',strtolower($unit))) {
        $numericValue *= 100000;
    }else{
        $numericValue *= 10000000;
    }

    return $numericValue;
}



if ($_POST) {
    
    
    $res = array();

    // Handle id and pricelable
    $id = '';
    if (isset($_POST['id'])) {
        $id = $_POST['id'];
        unset($_POST['id']);
    }
    if(isset($_POST['pr_on_request']) && $_POST['pr_on_request'] != ""){
        $_POST['price'] = 'Price on Request';
        unset($_POST['pr_on_request']);
    }else{
        $price = $_POST['price'];
        $price_lable = $_POST['pricelable'];
        $price_num = convertPriceToNumber((int)$price,$price_lable);
        
        if (isset($_POST['pricelable'])) {
            $_POST['price'] .= " " . $_POST['pricelable'];
            unset($_POST['pricelable']);
        }
    }
    if (isset($_POST['title'])) {
        $title = $_POST['title'];
         unset($_POST['title']);
    }
 
    
    if (isset($_FILES['commercial_plan']) && $_FILES['commercial_plan']['error'] == UPLOAD_ERR_OK) {
        $_POST['floor_plan_image'] = uploadImage($_FILES,$title);
    }
    date_default_timezone_set("Asia/Calcutta");
        $date = date("Y-m-d H:i:s");
        $_POST['date'] = $date;
        
    $cols = array();
    foreach ($_POST as $key => $val) {
        $cols[] = strtolower($key) . "= :$key";
    }

    $set = implode(", ", $cols);

    try {
        
        if ($id != "") {
            $query = "UPDATE `plan` SET $set WHERE id = :id";
            $stmt = $connection1->prepare($query);
            $stmt->bindValue(':id', $id, PDO::PARAM_INT);
             work($_POST['updated_by'], $_POST['pid'] ,'Update Commercial plan ID:'.$id);
        } else {
            $column = implode(", ", array_keys($_POST));
            $value = array_map(function ($val) {
                return ":" . str_replace(' ', '', $val);
            }, array_keys($_POST));
            $value = implode(", ", $value);

            $query = "SELECT MAX(`id`) FROM `plan`;
                    SET @max_id = (SELECT IFNULL(MAX(`id`), 0) as max_id FROM `plan`);
                    INSERT INTO `plan` (`id`, $column ) VALUES (@max_id + 1, $value)";
            
           
            $stmt = $connection1->prepare($query);
             
        }
      
        
        foreach ($_POST as $key => $val) {
            $stmt->bindValue(":$key", $val);
        }

        $result = $stmt->execute();
        if($result){
            
                
        $res[0] = 'success';
        $res['result'] = $result;
        if ($id == "") {
            $res['id'] = $stmt->fetch(PDO::FETCH_ASSOC)['MAX(`id`)'] + 1;
            $id = $res['id'];
             work($_POST['updated_by'], $_POST['pid'],'Add Plan ID:'.$id);
        }
        if( $_POST['price'] != 'Price on Request'){
            $price_hisotry = 'SET @max_id = (SELECT MAX(`id`) FROM `price_history`);
                INSERT INTO `price_history`(`id`, `fid`, `price`, `price_lable`, `price_num`, `date`) VALUES (@max_id + 1,?,?,?,?,?);';
                $price_hisotry = $connection2 ->prepare($price_hisotry);
                $price_hisotry = $price_hisotry->execute([$id,$price,$price_lable,$price_num,$date]);
                $res['history'] = $price_hisotry;
             }
        }
        
    } catch (PDOException $e) {
        $res[0] = 'error';
        $res[1] = $e->getMessage();
    } finally {
        $pool->releaseConnection($connection1);
        $pool->releaseConnection($connection2 );
    }

    echo json_encode($res);
}

function convert_img_to_webp($file, $targetDir) {
    $sourceFile = pathinfo($file, PATHINFO_FILENAME);
    $outputFile = $targetDir . $sourceFile . '.webp';

    $image = @imagecreatefromstring(file_get_contents($file));

    if ($image !== false) {
        imagewebp($image, $outputFile);
        imagedestroy($image);
        return $outputFile;
    }

    return false;
}

function uploadImage($file,$title = '') {
    $filename = $_FILES['commercial_plan']['name'];
    $tempPath = $_FILES['commercial_plan']['tmp_name'];
    $targetDir = 'uploads/' . date('Y/m/d') . '/';
    $targetPath = $targetDir . 'urbanpillar_' . $title . "_" . rand() . "_" . basename($filename);

    if (!is_dir($targetDir)) {
        mkdir($targetDir, 0777, true);
    }

    move_uploaded_file($tempPath, $targetPath);

    if (pathinfo($filename, PATHINFO_EXTENSION) != 'webp') {
        $targetPath = convert_img_to_webp($targetPath, $targetDir);
    }

    return $targetPath;
}
?>