connect_error) { $success=0; die("Connection failed: " . $conn->connect_error); } include "../../../api/php/log/add_server_entry.php"; //to log things if(isset($_GET["add_todolist"])){ $name=htmlspecialchars($_POST["name"]); $incident_id=htmlspecialchars($_GET["incident_id"]); $sql="INSERT INTO todo_lists (name,belongs_to_incident) VALUES(?,?)"; $stmt = $conn->prepare($sql); $stmt->bind_param("si", $name,$incident_id); $name=htmlspecialchars($_POST["name"]); $incident_id=htmlspecialchars($_GET["incident_id"]); $stmt->execute(); $stmt->close(); } if(isset($_GET["add_todoitem"])){ $todoitem=htmlspecialchars($_POST["todoitem"]); $list_id=htmlspecialchars($_GET["list_id"]); $sql="INSERT INTO todo_items (text,done_by,done,belongs_to_list) VALUES(?,0,0,?)"; $stmt = $conn->prepare($sql); $stmt->bind_param("si", $todoitem,$list_id); $todoitem=htmlspecialchars($_POST["todoitem"]); $list_id=htmlspecialchars($_GET["list_id"]); $stmt->execute(); $stmt->close(); } if(isset($_GET["update_box_id"])){ $box_id=htmlspecialchars($_GET["update_box_id"]); $status=htmlspecialchars($_GET["checked"]); if($status=="true") $status=1; else $status=0; $sql="UPDATE todo_items SET done = ?, done_by = ? WHERE id = ?"; $stmt = $conn->prepare($sql); $stmt->bind_param("iii", $status,$userid,$box_id); $stmt->execute(); $stmt->close(); } if(isset($_GET["upload_evidence"])){ $incident_id=htmlspecialchars($_GET["incident_id"]); $target_dir = "/var/www/html/incidents/$incident_id/evidence/"; $original_filename = basename($_FILES["fileToUpload"]["name"]); $new_filename = $original_filename . ".evidence"; $target_file = $target_dir . $new_filename; move_uploaded_file($_FILES["fileToUpload"]["tmp_name"], $target_file); } if(isset($_GET["add_message"])){ $incident_id=htmlspecialchars($_GET["incident_id"]); $message=htmlspecialchars($_POST["message"]); $sent=date("Y-m-d H-i-s"); $sql="INSERT INTO chats (belongs_to_incident,text,sent,from_userid)"; $stmt = $conn->prepare($sql); $stmt->bind_param("iii", $incident_id,$message,$box_id,$sent,$userid); $stmt->execute(); $stmt->close(); } ?> Change Password

Incident

"); //display messages echo("

Messages

"); $sql="SELECT * FROM chats WHERE belongs_to_incident = ?"; $stmt = $conn->prepare($sql_lists); $incident_id=htmlspecialchars($_GET["incident_id"]); $stmt->bind_param("i", $incident_id); $stmt->execute(); $result_lists = $stmt->get_result(); echo(""); echo(""); while($list = $result_lists->fetch_assoc()) { $message=$list["text"]; $date=$list["sent"]; $sql="SELECT username FROM users WHERE id=?"; $stmt2 = $conn->prepare($sql); $stmt2->bind_param("i", $entry["done_by"]); $stmt2->execute(); $result_lists2 = $stmt2->get_result(); $user = $result_lists2->fetch_assoc(); $from=$user["username"]; echo(""); } echo("
MessageFromDate
$message$from$date
"); ?>