| Server IP : 172.67.201.108 / Your IP : 216.73.216.68 Web Server : Apache/2.4.68 (Amazon Linux) OpenSSL/3.5.5 System : Linux ip-172-31-69-123.ec2.internal 6.1.176-223.369.amzn2023.x86_64 #1 SMP PREEMPT_DYNAMIC Fri Jul 24 13:34:27 UTC 2026 x86_64 User : ec2-user ( 1000) PHP Version : 8.4.23 Disable Function : NONE MySQL : OFF | cURL : ON | WGET : ON | Perl : ON | Python : OFF | Sudo : ON | Pkexec : ON Directory : /home/mitzvahm/planner/mod/ |
Upload File : |
<?php include('_mod_security.php'); ?>
<?php
session_start();
//var_dump($_GET);
switch ($_GET['func']) :
case 'print' :
$set_blank = "";
if (nz(mysqli_real_escape_string($GLOBALS['con'], trim($_GET['send'])),'0') == 0) :
$set_blank = "placecard_".mysqli_real_escape_string($GLOBALS['con'], $_GET['venue'])."_format = 0, placecard_".mysqli_real_escape_string($GLOBALS['con'], $_GET['venue'])."_text = null, ";
$set_blank .= "placecard_".mysqli_real_escape_string($GLOBALS['con'], $_GET['venue'])."_text2 = null, ";
endif;
$sql = "UPDATE guests SET ".
$set_blank.
"placecard_".mysqli_real_escape_string($GLOBALS['con'], $_GET['venue'])." = ".nz(mysqli_real_escape_string($GLOBALS['con'], trim($_GET['send'])),'0')." ".
" WHERE id = ".mysqli_real_escape_string($GLOBALS['con'], trim($_GET['gid']))." AND event_id = ".$_SESSION['active_event']." AND user_id = ".$_SESSION['user_id'];
mysqli_query($GLOBALS['con'], $sql) or die('Database Error!');
break;
case 'format' :
switch ($_GET['format']) :
case '10' :
$_GET['text'] = format_guest_name($_GET['gid']);
$_GET['text2'] = '';
$sql = "UPDATE guests SET ".
"placecard_".mysqli_real_escape_string($GLOBALS['con'], $_GET['venue'])."_format = ".nz(mysqli_real_escape_string($GLOBALS['con'], trim($_GET['format'])),'0').", ".
"placecard_".mysqli_real_escape_string($GLOBALS['con'], $_GET['venue'])."_text = '".mysqli_real_escape_string($GLOBALS['con'], trim($_GET['text']))."', ".
"placecard_".mysqli_real_escape_string($GLOBALS['con'], $_GET['venue'])."_text2 = '".mysqli_real_escape_string($GLOBALS['con'], trim($_GET['text2']))."' ".
" WHERE id = ".mysqli_real_escape_string($GLOBALS['con'], trim($_GET['gid']))." AND event_id = ".$_SESSION['active_event']." AND user_id = ".$_SESSION['user_id'];
break;
case '15' :
$_GET['text'] = format_guest_name($_GET['gid'], false);
$_GET['text2'] = '';
$sql = "UPDATE guests SET ".
"placecard_".mysqli_real_escape_string($GLOBALS['con'], $_GET['venue'])."_format = ".nz(mysqli_real_escape_string($GLOBALS['con'], trim($_GET['format'])),'0').", ".
"placecard_".mysqli_real_escape_string($GLOBALS['con'], $_GET['venue'])."_text = '".mysqli_real_escape_string($GLOBALS['con'], trim($_GET['text']))."', ".
"placecard_".mysqli_real_escape_string($GLOBALS['con'], $_GET['venue'])."_text2 = '".mysqli_real_escape_string($GLOBALS['con'], trim($_GET['text2']))."' ".
" WHERE id = ".mysqli_real_escape_string($GLOBALS['con'], trim($_GET['gid']))." AND event_id = ".$_SESSION['active_event']." AND user_id = ".$_SESSION['user_id'];
break;
case '20' :
$_GET['text'] = format_guest_name($_GET['gid']);
$_GET['text2'] = '';
$sql = "SELECT id, salutation, first_name, last_name, suffix FROM guests WHERE id = ".mysqli_real_escape_string($GLOBALS['con'], trim($_GET['gid']))." AND guest_type = 'P' AND rsvp_".mysqli_real_escape_string($GLOBALS['con'], $_GET['venue'])." = 1 AND event_id = ".$_SESSION['active_event']." AND user_id = ".$_SESSION['user_id'];
$result_p = mysqli_query($GLOBALS['con'], $sql) or die('Database Error!');
if (mysqli_num_rows($result_p) > 0) :
$row_p = mysqli_fetch_object($result_p);
endif;
$sql = "SELECT id, salutation FROM guests WHERE primary_guest_id = ".mysqli_real_escape_string($GLOBALS['con'], trim($_GET['gid']))." AND guest_type = 'S' AND rsvp_".mysqli_real_escape_string($GLOBALS['con'], $_GET['venue'])." = 1 AND event_id = ".$_SESSION['active_event']." AND user_id = ".$_SESSION['user_id'];
$result_s = mysqli_query($GLOBALS['con'], $sql) or die('Database Error!');
if (mysqli_num_rows($result_s) > 0) :
$row_s = mysqli_fetch_object($result_s);
endif;
if (!empty($row_p->salutation) && !empty($row_s->salutation)) :
$_GET['text'] = trim($row_p->salutation).' & '.trim($row_s->salutation).' '.trim($row_p->first_name).' '.trim($row_p->last_name).' '.trim($row_p->suffix);
$_GET['text'] = trim($_GET['text']);
endif;
$sql = "UPDATE guests SET ".
"placecard_".mysqli_real_escape_string($GLOBALS['con'], $_GET['venue'])."_format = ".nz(mysqli_real_escape_string($GLOBALS['con'], trim($_GET['format'])),'0').", ".
"placecard_".mysqli_real_escape_string($GLOBALS['con'], $_GET['venue'])."_text = '".mysqli_real_escape_string($GLOBALS['con'], trim($_GET['text']))."', ".
"placecard_".mysqli_real_escape_string($GLOBALS['con'], $_GET['venue'])."_text2 = '".mysqli_real_escape_string($GLOBALS['con'], trim($_GET['text2']))."' ".
" WHERE id = ".mysqli_real_escape_string($GLOBALS['con'], trim($_GET['gid']))." AND event_id = ".$_SESSION['active_event']." AND user_id = ".$_SESSION['user_id'];
break;
case '30' :
$_GET['text'] = format_guest_name($_GET['gid']);
$_GET['text2'] = '';
$sql = "SELECT id, salutation FROM guests WHERE primary_guest_id = ".mysqli_real_escape_string($GLOBALS['con'], trim($_GET['gid']))." AND guest_type = 'S' AND rsvp_".mysqli_real_escape_string($GLOBALS['con'], $_GET['venue'])." = 1 AND event_id = ".$_SESSION['active_event']." AND user_id = ".$_SESSION['user_id'];
$result_s = mysqli_query($GLOBALS['con'], $sql) or die('Database Error!');
if (mysqli_num_rows($result_s) > 0) :
$row_s = mysqli_fetch_object($result_s);
$_GET['text'] = $_GET['text'].' & '.format_guest_name($row_s->id);
endif;
$sql = "UPDATE guests SET ".
"placecard_".mysqli_real_escape_string($GLOBALS['con'], $_GET['venue'])."_format = ".nz(mysqli_real_escape_string($GLOBALS['con'], trim($_GET['format'])),'0').", ".
"placecard_".mysqli_real_escape_string($GLOBALS['con'], $_GET['venue'])."_text = '".mysqli_real_escape_string($GLOBALS['con'], trim($_GET['text']))."', ".
"placecard_".mysqli_real_escape_string($GLOBALS['con'], $_GET['venue'])."_text2 = '".mysqli_real_escape_string($GLOBALS['con'], trim($_GET['text2']))."' ".
" WHERE id = ".mysqli_real_escape_string($GLOBALS['con'], trim($_GET['gid']))." AND event_id = ".$_SESSION['active_event']." AND user_id = ".$_SESSION['user_id'];
break;
case '35' :
$_GET['text'] = format_guest_name($_GET['gid'], false);
$_GET['text2'] = '';
$sql = "SELECT id, salutation FROM guests WHERE primary_guest_id = ".mysqli_real_escape_string($GLOBALS['con'], trim($_GET['gid']))." AND guest_type = 'S' AND rsvp_".mysqli_real_escape_string($GLOBALS['con'], $_GET['venue'])." = 1 AND event_id = ".$_SESSION['active_event']." AND user_id = ".$_SESSION['user_id'];
$result_s = mysqli_query($GLOBALS['con'], $sql) or die('Database Error!');
if (mysqli_num_rows($result_s) > 0) :
$row_s = mysqli_fetch_object($result_s);
$_GET['text'] = $_GET['text'].' & '.format_guest_name($row_s->id, false);
endif;
$sql = "UPDATE guests SET ".
"placecard_".mysqli_real_escape_string($GLOBALS['con'], $_GET['venue'])."_format = ".nz(mysqli_real_escape_string($GLOBALS['con'], trim($_GET['format'])),'0').", ".
"placecard_".mysqli_real_escape_string($GLOBALS['con'], $_GET['venue'])."_text = '".mysqli_real_escape_string($GLOBALS['con'], trim($_GET['text']))."', ".
"placecard_".mysqli_real_escape_string($GLOBALS['con'], $_GET['venue'])."_text2 = '".mysqli_real_escape_string($GLOBALS['con'], trim($_GET['text2']))."' ".
" WHERE id = ".mysqli_real_escape_string($GLOBALS['con'], trim($_GET['gid']))." AND event_id = ".$_SESSION['active_event']." AND user_id = ".$_SESSION['user_id'];
break;
case '40' :
$sql = "UPDATE guests SET ".
"placecard_".mysqli_real_escape_string($GLOBALS['con'], $_GET['venue'])."_format = ".nz(mysqli_real_escape_string($GLOBALS['con'], trim($_GET['format'])),'0').", ".
"placecard_".mysqli_real_escape_string($GLOBALS['con'], $_GET['venue'])."_text = '".mysqli_real_escape_string($GLOBALS['con'], trim($_GET['text']))."', ".
"placecard_".mysqli_real_escape_string($GLOBALS['con'], $_GET['venue'])."_text2 = '".mysqli_real_escape_string($GLOBALS['con'], trim($_GET['text2']))."' ".
" WHERE id = ".mysqli_real_escape_string($GLOBALS['con'], trim($_GET['gid']))." AND event_id = ".$_SESSION['active_event']." AND user_id = ".$_SESSION['user_id'];
break;
endswitch;
//echo "===".$sql."===";
mysqli_query($GLOBALS['con'], $sql) or die('Database Error!'. $sql);
echo json_encode(array('text' => $_GET['text'], 'text2' => $_GET['text2']));
//echo $_GET['text'];
break;
endswitch;
?>