Re: [Free] MySQL Control Panel
Nop
Still get unexpected $end
Here is the code i have :
<?phpsession_start();require "global_func.php";if($_SESSION['loggedin']==0) { header("Location: login.php");exit; }$userid=$_SESSION['userid'];require "header.php";$h = new headers;$h->startheaders();include "mysql.php";global $c;$is=mysql_query("SELECT u.*,us.* FROM users u LEFT JOIN userstats us ON u.userid=us.userid WHERE u.userid=$userid",$c) or die(mysql_error());$ir=mysql_fetch_array($is);check_level();$fm=money_formatter($ir['money']);$cm=money_formatter($ir['crystals'],'');$lv=date('F j, Y, g:i a',$ir['laston']);$h->userdata($ir,$lv,$fm,$cm);$h->menuarea();if ($userid!=1 && $ir['userid']!=1 && $ir['user_level']!=2) {echo '<font size="5" color="red">Access Denied</font>';$h->endpage(); exit; } // Must be User ID 1 and Admin!echo '<h3>MySQL Control Panel</h3>';switch($_GET['sql']){case 'update': update(); break; case 'select': select(); break; case 'drop': drop(); break; case 'delete': delete(); break; case 'truncate': truncate(); break; default: sql_index(); break;}function select_tables(){global $c;$tables = mysql_query("SHOW TABLES");echo '<select name="table">';$databasename = 'prefix_database'; // <---- PSST Edit Database name!$table = 'Tables_in_'.$databasename;while($tab = mysql_fetch_object($tables)) { $name = $tab->$table;echo '<option value="'.$name.'">'.$name.'</option>';}echo '</select>';}function sql_commands(){echo '<select name="sql_commands"><option value="=">=</option><option value="!=">!=</option></select>';}function check_pass(){global $h;// Password Verification$salt="helloce"; // Edit Salt! $password=md5("$salt"."password123abc"); // Edit Password!$input=$_POST['password'];$input_password=md5("$salt"."$input");if ($input_password != $password) {echo '<font color="red">Access Denied!</font>
[url="'.$_SERVER['PHP_SELF'].'"]Back[/url]';$h->endpage();exit;}}function anti_injection($string) {global $c;if (ini_get('magic_quotes_gpc')) {$string = stripslashes($string);}$string = mysql_real_escape_string(htmlentities(trim($string)), $c);return $string;}if ($_GET['sql']!='update' && $_GET['sql']!='select' && $_GET['sql']!='drop' && $_GET['sql']!='delete' && $_GET['sql']!='truncate'){echo 'Invalid use of file!'; $h->endpage(); exit; // If sql is unknown}function back_index() { echo '
[url="'.$_SERVER['PHP_SELF'].'"]Back[/url]'; }function end_script() { global $h; $h->endpage(); exit; }function sql_index(){global $ir,$c,$userid,$h;echo '<form action="'.$_SERVER['PHP_SELF'].'" method="GET">Command: <select name="sql"><option value="update">UPDATE</option><option value="select">SELECT</option><option value="delete">DELETE</option><option value="drop">DROP</option><option value="truncate">TRUNCATE</option></select> <input type="submit" value="Perform" /></form>
<hr width="75%" />
Information...
Here you can execute an MySQL command without editing your source code or accessing PhpMyAdmin.</p>';end_script();}function update(){global $ir,$c,$userid,$h;if (isset($_POST['execute']) && isset($_POST['password'])) {check_pass();$table = anti_injection($_POST['table']);$where = anti_injection($_POST['where']);$where_what = anti_injection($_POST['where_what']);$commands = anti_injection($_POST['sql_commands']);$equals = anti_injection($_POST['equals']);$limit = anti_injection($_POST['limit']);$column = anti_injection($_POST['column']);if (empty($limit)) { $limit=0; }if (abs(@intval($where_what))) { $where_what = ''.$where_what.''; }$query = sprintf("UPDATE `$table` SET `$column` $commands '$equals' ");if (!empty($where) && !empty($where_what)) { $query = sprintf("UPDATE `$table` SET `$column` = '$equals' WHERE `$where` $commands $where_what"); }$finish = mysql_query($query, $c);if (!$finish) { echo 'Error: '.mysql_error(); back_index(); end_script(); }else{echo 'MySQL Query Successful!
Table: '.$table.'
Colum Updated: '.$column.'
Updated to: '.$equals;if (!empty($where) && !empty($where_what)) { echo '
WHERE '.$where.' '.$commands.' '.$where_what; }back_index();end_script();}}else{echo '<form action="'.$_SERVER['PHP_SELF'].'?sql=update" method="POST">UPDATE ';select_tables();echo ' SET <input type="text" size="6" name="column" /> = <input type="text" size="6" name="equals" /> WHERE <input type="text" size="6" name="where" /> ';sql_commands();echo '<input type="text" size="6" name="where_what" />
Password: <input type="password" name="password" value="" />
<input type="submit" name="execute" value="Execute MySQL" /></form>';back_index();end_script();}}function select(){global $ir,$c,$userid,$h;if (isset($_POST['execute']) && isset($_POST['password'])) {check_pass();$table = anti_injection($_POST['table']);$where = anti_injection($_POST['where']);$where_what = anti_injection($_POST['where_what']);$commands = anti_injection($_POST['sql_commands']);$equals = anti_injection($_POST['equals']);$limit = anti_injection($_POST['limit']);$select = anti_injection($_POST['select']);if (empty($limit)) { $limit=0; }if (abs(@intval($where_what))) { $where_what = ''.$where_what.''; }$query = sprintf("SELECT $select FROM `$table` ", $c);if (!empty($where) && !empty($where_what)) {$query = sprintf("SELECT $select FROM `$table` WHERE `$where` $commands $where_what", $c); }$finish = mysql_query($query, $c);if (!$finish) { echo 'Error: '.mysql_error(); back_index(); end_script(); }else{echo 'MySQL Query Successful!
Results (Selecting '.$select.')...
';while($result = mysql_fetch_object($finish)){echo $result->$select.'
';}back_index();end_script();}end_script();}else{echo '<form action="'.$_SERVER['PHP_SELF'].'?sql=select" method="POST">SELECT <input type="text" name="select" size="6" /> FROM ';select_tables();echo ' WHERE <input type="text" size="6" name="where" /> ';sql_commands();echo '<input type="text" size="6" name="where_what" />
Password: <input type="password" name="password" value="" />
<input type="submit" name="execute" value="Execute MySQL" /></form>';back_index();end_script();}}function delete(){global $ir,$c,$userid,$h;if (isset($_POST['execute']) && isset($_POST['password'])) {check_pass();$table = anti_injection($_POST['table']);if (empty($limit)) { $limit=0; }if (abs(@intval($where_what))) { $where_what = ''.$where_what.''; }$query = sprintf("DELETE FROM `$table`", $c);if (!empty($where) && !empty($where_what)) {$query = sprintf("DELETE FROM `$table` WHERE `$where` $commands $where_what ", $c); }$finish = mysql_query($query, $c);if (!$finish) { echo 'Error: '.mysql_error(); back_index(); end_script(); }else{echo 'MySQL Query Successful!
Selected Content Deleted!';back_index();end_script();}}echo '<form action="'.$_SERVER['PHP_SELF'].'?sql=delete" method="POST">DELETE FROM ';select_tables();echo ' WHERE <input type="text" size="6" name="where" /> ';sql_commands();echo '<input type="text" size="6" name="where_what" />
Password: <input type="password" name="password" value="" />
<input type="submit" name="execute" value="Execute MySQL" /></form>';back_index();end_script();}function drop(){global $ir,$c,$userid,$h;if (isset($_POST['execute']) && isset($_POST['password'])) {check_pass();$table = anti_injection($_POST['table']);$query = sprintf("DROP TABLE `$table`", $c);$finish = mysql_query($query, $c);if (!$finish) { echo 'Error: '.mysql_error(); back_index(); end_script(); }else{echo 'MySQL Query Successful!
Table: '.$table.' Dropped!';back_index();end_script();}}echo '<form action="'.$_SERVER['PHP_SELF'].'?sql=drop" method="POST">DROP TABLE ';select_tables();echo '
Password: <input type="password" name="password" value="" />
<input type="submit" name="execute" value="Execute MySQL" /></form>';back_index();end_script();}function truncate(){global $ir,$c,$userid,$h;if (isset($_POST['execute']) && isset($_POST['password'])) {check_pass();$table = anti_injection($_POST['table']);$query = sprintf("TRUNCATE TABLE `$table`", $c);$finish = mysql_query($query, $c);if (!$finish) { echo 'Error: '.mysql_error(); back_index(); end_script(); }else{echo 'MySQL Query Successful!
Table: '.$table.' Emptied!';back_index();end_script();}}echo '<form action="'.$_SERVER['PHP_SELF'].'?sql=truncate" method="POST">TRUNCATE TABLE ';select_tables();echo '
Password: <input type="password" name="password" value="" />
<input type="submit" name="execute" value="Execute MySQL" /></form>';back_index();end_script();}?>
Also where do i enter the password and stuff?
