jpsagrisolution.com - UnknownSec 403

UnknownSec Bypass 403

: /var/www/zenithentcare/testappnew/cpanel/ [ drwxrwxr-x ]
name : user_save_update.php
 <?php

require_once "../config.php";

$uname = mysqli_real_escape_string($conn,$_POST['uname']);
$mobileno= mysqli_real_escape_string($conn,$_POST['mobileno']);
$username= mysqli_real_escape_string($conn,$_POST['username']);
$password= mysqli_real_escape_string($conn,$_POST['password']);
//$psw= mysqli_real_escape_string($conn,md5($_POST['cuspassword']));
$userrole= mysqli_real_escape_string($conn,$_POST['userrole']);
// $userdetailid= mysqli_real_escape_string($conn,$_POST['userdetailid']);
$id = mysqli_real_escape_string($conn,$_POST['userid']);
// $canteen = mysqli_real_escape_string($conn,$_POST['canteenname']);
$btntext = $_POST['btntext'];

$creationdatetime = date("y-m-d");
$message= "";

// $hash_psw = password_hash($psw,  
//           PASSWORD_DEFAULT); 


$query = "select count(0) as count from logintb where username='".$username."' and status='".$isactive."'  and isdeleted='".$isnotdeleted."'";

$result = mysqli_query($conn,$query);
 while($row = mysqli_fetch_array($result))
 {
    $message=$row["count"];
 }
    if($btntext=="Save")
    {
      if($message=="0")
            {
              $query="insert into logintb(uname,mobileno,username,password,userrole,status,isdeleted)
               Values('".$uname."','".$mobileno."','".$username."','".$password."','".$userrole."','".$isactive."','".$isnotdeleted."')";

            // $query="insert into customerregistrationtb(name,personalno,cusrank,mobileno,cuspassword,isdeleted,active,creationdatetime,userdetailid)
            //    Values('".$name."','".$personalno."','".$rank."','".$mobileno."','".$psw."','".$NotDeleted."','".$gActive."','".$creationdatetime ."','".$userdetailid ."')";
              $result = mysqli_query($conn, $query);

              if($result==true)
               $message="1";
            }
            else
            {
              $message="2";
            }

            }
            else if($btntext=="Update")
            {

            $query = "select count(0) as count from logintb where id!='".$id."' and username='".$username."' and status='".$isactive."'  and isdeleted='".$isnotdeleted."'";

         $result = mysqli_query($conn,$query);
           while($row = mysqli_fetch_array($result))
          {
                  $message= $row["count"];
         }

            if($message=="0")
            {
                  $query="Update logintb set uname='".$uname."',mobileno='".$mobileno."',password='".$password."' where id='".$id."'";
                   $result = mysqli_query($conn, $query);

                   if($result==true)
                      $message="3";
            }
            else
            {
               $message="2";
            }

            }
            else if($btntext=="Active")
            {

                $query="Update logintb set status='".$isactive."' where id='".$id."'";
                $result = mysqli_query($conn, $query);

                if($result==true)   
                $message="4";

            }
            else if($btntext=="DeActive")
            {
                $query="Update logintb set status='".$isnotactive."' where id='".$id."'";
                $result = mysqli_query($conn, $query);

                if($result==true)   
                $message="5";

            }

    echo json_encode($message);

?>