0byt3m1n1
Path:
C:
/
wamp64
/
www
/
id
/
[
Home
]
File: upload.php
<?php session_start(); include("db_connect.php"); if(isset($_COOKIE['adminid'])){$adminid = $_COOKIE['adminid'];} if(isset($_POST['editemployee'])) { $id = mysqli_real_escape_string($db,$_POST['empid']); $first_name = mysqli_real_escape_string($db,$_POST['fname']); $last_name = mysqli_real_escape_string($db,$_POST['lname']); $designation=mysqli_real_escape_string($db,$_POST['designation']); $division =mysqli_real_escape_string($db,$_POST['division']); $project_code = mysqli_real_escape_string($db,$_POST['pcode']); $principal_investigator=mysqli_real_escape_string($db,$_POST['principal_investigator']); $mail_id = mysqli_real_escape_string($db,$_POST['mail_id']); $address = mysqli_real_escape_string($db,$_POST['address']); $blood_group = mysqli_real_escape_string($db,$_POST['bloodgroup']); $phone = mysqli_real_escape_string($db,$_POST['phone']); $dob=mysqli_real_escape_string($db,$_POST['dob']); $mobile = mysqli_real_escape_string($db,$_POST['mobile']); $valid_from = mysqli_real_escape_string($db,$_POST['validfrom']); $valid_to = mysqli_real_escape_string($db,$_POST['validto']); $pagex = mysqli_real_escape_string($db,$_POST['page']); $check="SELECT * FROM employees WHERE id='$id' "; $checks=mysqli_query($db,$check); $found=mysqli_num_rows($checks); if($found!=0) { $photo=$_FILES['filed']['name']; $tmp=$_FILES['filed']['tmp_name']; $new=time().$photo; $new="upload/".$new; $f=move_uploaded_file($tmp,$new); if(isset($f)) { //,photo='$new' $nid = mysqli_real_escape_string($db,$_POST['emp_nid']); $quer = "UPDATE employees SET id='$nid',first_name='$first_name',last_name='$last_name',designation='$designation',division='$division',project_code='$project_code',principal_investigator='$principal_investigator',mail_id='$mail_id',address='$address',blood_group='$blood_group',phone='$phone',mobile='$mobile',dob='$dob',valid_from='$valid_from',valid_to='$valid_to' $photo_sql WHERE id='$id' "; $db->query($quer) or die('Erorr, query failed to update'); $_SESSION['pass']="okjs"; header("Location:admin.php"); } } } if(isset($_POST['addmember'])) { if($_POST['fname']!=''&&$_POST['lname']!=''&&$_POST['designation']!=''&&$_POST['division']!=''&&$_POST['pcode']!=''&&$_POST['principal_investigator']!=''&&$_POST['address']!='' &&$_POST['mail_id']!=''&&$_POST['bloodgroup']!=''&&$_POST['phone']!=''&&$_POST['mobile']!=''&&$_POST['dob']!=''&&$_POST['validfrom']!=''&&$_POST['validto']!='') { $first_name = mysqli_real_escape_string($db,$_POST['fname']); $last_name = mysqli_real_escape_string($db,$_POST['lname']); $designation=mysqli_real_escape_string($db,$_POST['designation']); $division =mysqli_real_escape_string($db,$_POST['division']); $project_code = mysqli_real_escape_string($db,$_POST['pcode']); $principal_investigator = mysqli_real_escape_string($db,$_POST['principal_investigator']); $mail_id = mysqli_real_escape_string($db,$_POST['mail_id']); $address = mysqli_real_escape_string($db,$_POST['address']); $blood_group = mysqli_real_escape_string($db,$_POST['bloodgroup']); $phone = mysqli_real_escape_string($db,$_POST['phone']); $mobile = mysqli_real_escape_string($db,$_POST['mobile']); $dob = mysqli_real_escape_string($db,$_POST['dob']); $valid_from = mysqli_real_escape_string($db,$_POST['validfrom']); $valid_to = mysqli_real_escape_string($db,$_POST['validto']); $photo_url = mysqli_real_escape_string($db,$_POST['photo']); $pagex = mysqli_real_escape_string($db,$_POST['page']); $check="SELECT * FROM employees WHERE first_name='$first_name' && mail_id='$mail_id'"; $checks=mysqli_query($db,$check); $found=mysqli_num_rows($checks); if($found==0) { $photo=$_FILES['filed']['name']; $tmp=$_FILES['filed']['tmp_name']; $new=time().$photo; $new="upload/".$new; $f=move_uploaded_file($tmp,$new); $query = "INSERT INTO employees (first_name,last_name,designation,division,project_code,principal_investigator,mail_id,address,blood_group,phone,mobile,dob,valid_from,valid_to,photo,status) ". "VALUES ('$first_name','$last_name', '$designation','$division','$project_code','$principal_investigator','$mail_id','$address','$blood_group','$phone','$mobile','$dob','$valid_from','$valid_to','$new','NEW')"; $db->query($query) or die('Error1, query failed'); $memberadd="tyy"; $_SESSION['memberadded']=$memberadd; header("Location:$pagex"); //member added successfully }else{ $_SESSION['memberexist']="member already exist"; header("Location:$pagex"); } } else { $_SESSION['emptytextboxes']="Not all text boxes were completed"; $pagex = mysqli_real_escape_string($db,$_POST['page']); header("Location:$pagex"); } } if(isset($_POST['add_desig'])) { if($_POST['desig_name']!='' ) { include ('db_connect.php'); $desig_name = mysqli_real_escape_string($db,$_POST["desig_name"]); $cd="SELECT * FROM designation WHERE desig_name='$desig_name ' "; $chd=mysqli_query($db,$cd); $found=mysqli_num_rows($chd); if($found==0) { $query = "INSERT INTO designation(desig_name) ". "VALUES ('$desig_name')"; $db->query($query) or die('Error1, query failed'); /* $_SESSION['status']="Designation has been inserted successfully. ";*/ $_SESSION['add_desig']="Designation has been inserted successfully. "; header("Location:designation.php"); } else { $_SESSION['alreadyexist']="member already exist"; header("Location:designation.php"); } /* else { $_SESSION['status']=" Sorry ! This is already exist."; } */ } } if(isset($_POST['add_division'])) { if($_POST['division_name']!='' ) { include ('db_connect.php'); $division_name = mysqli_real_escape_string($db,$_POST["division_name"]); $cd="SELECT * FROM division WHERE division_name='$division_name ' "; $chd=mysqli_query($db,$cd); $found=mysqli_num_rows($chd); if($found==0) { $query = "INSERT INTO division(division_name) ". "VALUES ('$division_name')"; $db->query($query) or die('Error1, query failed'); $_SESSION['add_division']="Division has been inserted successfully. "; header("Location:division.php"); } else { $_SESSION['alreadyexist']="member already exist"; header("Location:division.php"); } } } if(isset($_POST['add_pi'])) { if($_POST['principal_investigator']!='' ) { include ('db_connect.php'); $principal_investigator = mysqli_real_escape_string($db,$_POST["principal_investigator"]); $pd="SELECT * FROM principleinvestigator WHERE principal_investigator='$principal_investigator ' "; $phd=mysqli_query($db,$pd); $found=mysqli_num_rows($phd); if($found==0) { $query = "INSERT INTO principleinvestigator(principal_investigator) ". "VALUES ('$principal_investigator')"; $db->query($query) or die('Error1, query failed'); $_SESSION['add_pi']="principal investigator has been inserted successfully. "; header("Location:pi.php"); } else { $_SESSION['alreadyexist']="member already exist"; header("Location:pi.php"); } } } if(isset($_POST['Valuedel'])){ $tutor=$_POST['Valuedel']; $querry="SELECT * FROM employees WHERE id='$tutor' "; $results=mysqli_query($db,$querry); $checks=mysqli_num_rows($results); if($checks!=0) { $querry="DELETE FROM employees WHERE id='$tutor'"; $results=mysqli_query($db,$querry); echo"ok"; } } if(isset($_POST['desigdel'])){ $tutor=$_POST['desigdel']; $querry="SELECT * FROM designation WHERE id='$tutor' "; $results=mysqli_query($db,$querry); $checks=mysqli_num_rows($results); if($checks!=0) { $querry="DELETE FROM designation WHERE id='$tutor'"; $results=mysqli_query($db,$querry); echo"ok"; } } if(isset($_POST['divdel'])){ $tutor=$_POST['divdel']; $querry="SELECT * FROM division WHERE id='$tutor' "; $results=mysqli_query($db,$querry); $checks=mysqli_num_rows($results); if($checks!=0) { $querry="DELETE FROM division WHERE id='$tutor'"; $results=mysqli_query($db,$querry); echo"ok"; } } if(isset($_POST['pidel'])){ $tutor=$_POST['pidel']; $querry="SELECT * FROM principleinvestigator WHERE id='$tutor' "; $results=mysqli_query($db,$querry); $checks=mysqli_num_rows($results); if($checks!=0) { $querry="DELETE FROM principleinvestigator WHERE id='$tutor'"; $results=mysqli_query($db,$querry); echo"ok"; } } if(isset($_POST['editdivision'])) { $id = mysqli_real_escape_string($db,$_POST['id']); $division_name = mysqli_real_escape_string($db,$_POST['division']); $checkdiv="SELECT * FROM division WHERE id='$id' "; $checkd=mysqli_query($db,$checkdiv); $found=mysqli_num_rows($checkd); if($found!=0) { $querr = "UPDATE division SET division_name='$division_name' WHERE id='$id' "; $db->query($querr) or die('Error, query failed to update'); $_SESSION['editdiv']="Division name edited successfully. "; header("Location:division.php"); } } if(isset($_POST['editpi'])) { $id = mysqli_real_escape_string($db,$_POST['id']); $pi = mysqli_real_escape_string($db,$_POST['principal_investigator']); $checkpi="SELECT * FROM principleinvestigator WHERE id='$id' "; $checkp=mysqli_query($db,$checkpi); $found=mysqli_num_rows($checkp); if($found!=0) { $querr = "UPDATE principleinvestigator SET principal_investigator='$pi' WHERE id='$id' "; $db->query($querr) or die('Error, query failed to update'); $_SESSION['editpi']="pi name edited successfully. "; header("Location:pi.php"); } } if(isset($_POST['editdesignation'])) { $id = mysqli_real_escape_string($db,$_POST['id']); $designation = mysqli_real_escape_string($db,$_POST['designation']); $checkpi="SELECT * FROM designation WHERE id='$id' "; $checkp=mysqli_query($db,$checkpi); $found=mysqli_num_rows($checkp); if($found!=0) { $querr = "UPDATE designation SET desig_name='$designation' WHERE id='$id' "; $db->query($querr) or die('Error, query failed to update'); $_SESSION['editdesig']="designation edited successfully. "; header("Location:designation.php"); } } ?>