OXIESEC PANEL

Name	Size	Modified	Perms
📁 ..	-	10/10/2024 10:20:39 AM	rwxr-xr-x
📁 PHPMailer	-	08/29/2024 12:14:12 PM	rwxr-xr-x
📄 bcommon.js	40.38 KB	08/29/2024 12:14:11 PM	rw-r--r--
📄 bconfig.php	10.12 KB	08/29/2024 12:14:11 PM	rw-r--r--
📄 common.js	41.63 KB	08/29/2024 12:14:11 PM	rw-r--r--
📄 config.php	18.75 KB	08/29/2024 12:14:11 PM	rw-r--r--
📁 fontawesome	-	08/29/2024 12:14:24 PM	rwxr-xr-x
📄 function.php	2.8 KB	08/29/2024 12:14:11 PM	rw-r--r--
📄 genai_func.js	13.09 KB	08/29/2024 12:14:11 PM	rw-r--r--
📄 genai_style.css	3.13 KB	08/29/2024 12:14:11 PM	rw-r--r--
📄 grayscale.min.css	4.55 KB	08/29/2024 12:14:11 PM	rw-r--r--
📄 handler.php	5.02 KB	08/29/2024 12:14:11 PM	rw-r--r--
📄 hhandler.php	4.51 KB	08/29/2024 12:14:11 PM	rw-r--r--
📄 jquery.magnific-popup.min.js	19.74 KB	08/29/2024 12:14:11 PM	rw-r--r--
📄 magnific-popup.css	6.79 KB	08/29/2024 12:14:11 PM	rw-r--r--
📄 old_genai_func.js	10.34 KB	08/29/2024 12:14:11 PM	rw-r--r--
📄 old_genai_style.css	2.21 KB	08/29/2024 12:14:12 PM	rw-r--r--
📄 oldcommon.js	45.07 KB	08/29/2024 12:14:11 PM	rw-r--r--
📄 repconfig.php	16.79 KB	08/29/2024 12:14:12 PM	rw-r--r--
📁 simplepie	-	08/29/2024 12:14:24 PM	rwxr-xr-x
📄 style.css	7.75 KB	08/29/2024 12:14:12 PM	rw-r--r--
📄 validate.logged.php	433 bytes	08/29/2024 12:14:12 PM	rw-r--r--
📄 zconfig.php	9.7 KB	08/29/2024 12:14:12 PM	rw-r--r--
📄 zzconfig.php	10.02 KB	08/29/2024 12:14:12 PM	rw-r--r--

Editing: hhandler.php

<?php

include 'config.php';

// Get the JSON data from the AJAX request
$data = json_decode(file_get_contents('php://input'), true);

// Check if action and itemId are provided
if (isset($data['action'])) {
    $action = $data['action'];
    $userId = isset($data['userId']) ? $data['userId'] : null;

if ($action === 'checkColl') {
        $url = isset($data['url']) ? $data['url'] : null;
        checkCollection($db, $userId, $url);
    } else {        
        $title = isset($data['title']) ? $data['title'] : null;
        $url = isset($data['url']) ? $data['url'] : null;
        $description = isset($data['description']) ? $data['description'] : null;

if ($action === 'add') {
            addCollection($db, $userId, $title, $url, $description);

} elseif ($action === 'remove') {
            removeCollection($db, $url, $userId);

} else {
            http_response_code(400);
            echo json_encode(['status' => 'error', 'message' => 'Invalid action']);
        }
    }
} else {
    http_response_code(400);
    echo json_encode(['status' => 'error', 'message' => 'Missing action or itemId']);
}

function checkCollection($db, $userId, $url)
{
    try {
        $url = $db->real_escape_string($url);
        $result = $db->query("SELECT COUNT(*) AS count FROM user_collection WHERE url = \"$url\" AND user_id = $userId");

// Check for query errors
        if (!$result) {
            throw new Exception("Database query failed: " . $db->error);
        }

// Fetch the result
        $row = $result->fetch_assoc();
        $count = isset($row['count']) ? (int)$row['count'] : 0;

// Output the result in JSON format
        echo json_encode(['status' => 'success', 'count' => $count]);
    } catch (Exception $e) {
        // Handle other exceptions
        http_response_code(500);
        echo json_encode(['status' => 'error', 'message' => 'An unexpected error occurred: ' . $e->getMessage()]);
    } finally {
        $db->close();
    }
}

function addCollection($db, $userId, $title, $url, $description)
{
    // Enable exception handling for mysqli
    mysqli_report(MYSQLI_REPORT_ERROR | MYSQLI_REPORT_STRICT);

try {
        // Escape inputs to avoid SQL injection
        // $userId = $db->real_escape_string($userId);
        $title = $db->real_escape_string($title);
        $url = $db->real_escape_string($url);
        $description = $db->real_escape_string($description);

// Execute the query
        $db->query("INSERT INTO user_collection(user_id,title,url,description,date_added) VALUES($userId,'$title','$url','$description',Now())");

// Check if an error occurred
        if ($db->errno === 1062) {  // 1062 is the error code for duplicate entry
            http_response_code(409);  // HTTP status code for conflict
            echo json_encode(['status' => 'error', 'message' => 'Duplicate entry detected']);
        } else {
            // Successful insertion
            echo json_encode(['status' => 'success', 'message' => 'Added to collection']);
        }
    } catch (mysqli_sql_exception $e) {
        // Handle MySQL-related exceptions
        if ($e->getCode() == 1062) {  // 1062 is the error code for duplicate entry
            http_response_code(409);  // HTTP status code for conflict
            echo json_encode(['status' => 'error', 'message' => 'Duplicate entry detected']);
        } else {
            // Other MySQL errors
            http_response_code(500);
            echo json_encode(['status' => 'error', 'message' => 'Failed to add to collection: ' . $e->getMessage()]);
        }
    } catch (Exception $e) {
        // Handle other exceptions
        http_response_code(500);
        echo json_encode(['status' => 'error', 'message' => 'An unexpected error occurred: ' . $e->getMessage()]);
    } finally {
        // Close the connection
        $db->close();
    }
}

function removeCollection($db, $url, $userId)
{
    // Remove from collection
    $stmt = $db->prepare("DELETE FROM user_collection WHERE url = ? AND user_id = ?");
    $stmt->bind_param('ss', $url, $userId);

if ($stmt->execute()) {
        $stmt->close();
        $db->close();
        echo json_encode(['status' => 'success', 'message' => 'Removed from collection']);
    } else {
        $stmt->close();
        $db->close();
        http_response_code(500);
        echo json_encode(['status' => 'error', 'message' => 'Failed to remove from collection']);
    }
}