HEX
Server: Apache
System: Linux www3.pit.tblive.com 5.14.0-687.38.1.el9_8.x86_64 #1 SMP PREEMPT_DYNAMIC Wed Aug 12 17:19:12 EDT 2026 x86_64
User: awaldron (1020)
PHP: 8.1.34
Disabled: exec,passthru,shell_exec,system
Upload Files
File: //home/awaldron/public_html/archive/demo/admin/employee_add.php
<?php
session_start();
include("../_functions.php");
dbconnect();
if (!is_logged()) auto_login();

	$success = FALSE;
	$ldap = FALSE;
	if (LOGIN_METHOD == "ldap") $ldap = TRUE;
	
	if (isset($_GET["update_emp"])) {
		$query = "INSERT INTO tbl_employees SET ";
		$query .= "username='".$_GET["username"]."', ";
		$query .= "fname='".$_GET["fname"]."', ";
		$query .= "lname='".$_GET["lname"]."', ";
		$query .= "title='".$_GET["title"]."', ";
		if ($ldap) $query .= "ldap_login='".($_GET["ldap_login"]==""?"0":$_GET["ldap_login"])."', "; 
		$query .= "start_date='".$_GET["sdyear"].$_GET["sdmon"].$_GET["sdday"]."000000"."', ";
		$query .= "ph_direct='".$_GET["ph_direct"]."', ";
		$query .= "ph_remote_office='".$_GET["ph_remote_office"]."', ";
		$query .= "ph_remote_fax='".$_GET["ph_remote_fax"]."', ";
		$query .= "ph_cell='".$_GET["ph_cell"]."', ";
		$query .= "ph_home='".$_GET["ph_home"]."', ";
		$query .= "birthday='".$_GET["bmon"].$_GET["bday"]."', ";
		$query .= "email='".$_GET["email"]."', ";
		$query .= "manager='".$_GET["manager"]."', ";
		$query .= "location='".$_GET["location"]."', ";
		$query .= "room_num='".$_GET["room_num"]."', ";
		$query .= "dir_display=".$_GET["dir_display"].", ";
		$query .= "emp_type_id=".$_GET["emp_type_id"].", ";
		$query .= "ext_display=".$_GET["ext_display"].", ";
		$query .= "acct_created=".time().", ";
		$query .= "last_updated=".time().", ";
		$query .= "email_confirmed=1, ";
		$query .= "acct_confirmed=1";
		

		
		$result = mysql_query($query);
		if ($result > 0) {		
			$qud = quickUPDATE("INSERT INTO tbl_group_user (group_id,username) VALUES (".$_GET["group_id"].",'".$_GET["username"]."')");	
			header("location: employee_edit.php?u=".$_GET["username"]."&mesg=ok");
		} else {
			echo "<P>".$query;
			echo error("There was an error while adding this user to the database.");
			echo error(mysql_error());
		}
	}

echo "<html>\n";
echo "<head>\n";
echo "<title>".COMPANY_NAME." : Add New Employee</title>\n";
echo "</head>\n";
echo "<link rel=\"stylesheet\" type=\"text/css\" href=\"../default.css\">\n";
echo "<body style=\"margin:15px;\">\n";

if (!admin_panel($_SESSION["auth_user"])) {
	echo "<br><br><br><br>".error("You must be logged in to access the administration panel!");
} else {
	
	echo "<P><img src=\"/gui/icons/cog.gif\" align=\"left\">\n";
	echo "<div class=\"headline\">Add New Employee</div>\n";
	
	echo "<br><br><br>\n";
		echo "<form action=\"employee_add.php\" method=\"get\">\n";
	
		$photo = "/gui/photos/nophoto.jpg";
	
		echo "<P><table class=\"textdn\" border=0 cellspacing=15>\n";
		echo "<tr><td align=\"right\" valign=\"top\"><img src=\"".$photo."\" border=1></td>\n";
		echo "<td valign=\"top\">\n";
		echo "<table class=\"textdn\" border=0 cellspacing=5>\n";
		echo "<tr><td><b style=\"color:#003466;\">Username:</b></td><td><input type=\"text\" maxlength=32 size=35 name=\"username\"></td></tr>\n";
		echo "<tr><td><b style=\"color:#003466;\">First&nbsp;Name:</b></td><td><input type=\"text\" maxlength=32 size=35 name=\"fname\"></td></tr>\n";
		echo "<tr><td><b style=\"color:#003466;\">Last&nbsp;Name:</b></td><td><input type=\"text\" maxlength=32 size=35 name=\"lname\"></td></tr>\n";
		echo "<tr><td><b style=\"color:#003466;\">Job&nbsp;Title:</b></td><td><input type=\"text\" maxlength=255 size=35 name=\"title\"></td></tr>\n";
		if ($ldap) echo "<tr><td><b style=\"color:#003466;\">LDAP&nbsp;Login:</b></td><td><input type=\"text\" maxlength=255 size=35 name=\"ldap_login\"></td></tr>\n";

		echo "<tr><td colspan=2>&nbsp;</td></tr>\n";
		
		echo "<tr><td><b style=\"color:#003466;\">Employee Type:</b></td><td>\n";
		echo "<SELECT name=\"emp_type_id\">\n";
		$res2 = mysql_query("SELECT * FROM tbl_emp_types");
		echo "<option></option>\n";
		for ($i=0; $i < mysql_num_rows($res2); $i++) {
			$et = mysql_fetch_array($res2);
			echo "<option value=\"".$et["emp_type_id"]."\">".$et["emp_type"]."</option>\n";
		}
		echo "</SELECT></td></tr>\n";

		echo "<tr><td><b style=\"color:#003466;\">Manager's&nbsp;Name:</b></td><td>\n";
		echo "<SELECT name=\"manager\">\n";
		employee_select();
		echo "</SELECT></td></tr>\n";
		
		echo "<tr><td><b style=\"color:#003466;\">Group:</b></td><td>\n";
		echo "<SELECT name=\"group_id\">\n";
		$group = DEF_GROUP;
		group_select(0,0,$group);
		echo "</SELECT></td></tr>\n";
		
		echo "<tr><td colspan=2>&nbsp;</td></tr>\n";
		$month = array("","January","February","March","April","May","June","July","August","September","October","November","December");
		echo "<tr><td>Your Birthday:</td><td>\n";
			echo "<SELECT name=\"bmon\">\n";
			echo "<option></option>\n";
			for ($i=1; $i <= 12; $i++) echo "<option value=\"".($i<10?"0".$i:$i)."\">".$month[$i]."</option>\n";
			echo "</select>\n";
			echo "<SELECT name=\"bday\">\n";
			echo "<option></option>\n";
			for ($j=1; $j <= 31; $j++) echo "<option value=\"".($j<10?"0".$j:$j)."\">".($j<10?"0".$j:$j)."</option>\n";
			echo "</select>\n";
			echo " (age is not calculated)\n";
		echo "</td></tr>\n";
		
		echo "<tr><td><b style=\"color:#003466;\">Employee&nbsp;Since:</b></td><td>\n";
			echo "<SELECT name=\"sdmon\">\n";
			echo "<option></option>\n";
			for ($i=1; $i <= 12; $i++) echo "<option value=\"".($i<10?"0".$i:$i)."\">".$month[$i]."</option>\n";
			echo "</select>\n";
			echo "<SELECT name=\"sdday\">\n";
			echo "<option></option>\n";
			for ($j=1; $j <= 31; $j++) echo "<option value=\"".($j<10?"0".$j:$j)."\">".($j<10?"0".$j:$j)."</option>\n";
			echo "</select>\n";
			echo "<SELECT name=\"sdyear\">\n";
			echo "<option></option>\n";
			for ($k=1987; $k <= date("Y"); $k++) echo "<option value=\"".$k."\">".$k."</option>\n";
			echo "</select>\n";
		echo "</td></tr>\n";
	
		echo "<tr><td colspan=2>&nbsp;</td></tr>\n";
		echo "<tr><td><b style=\"color:#003466;\">Email&nbsp;Address:</b></td><td><input type=\"text\" maxlength=128 size=35 name=\"email\"></td></tr>\n";
		echo "<tr><td><b style=\"color:#003466;\">Direct&nbsp;Phone:</b></td><td><input type=\"text\" maxlength=20 size=35 name=\"ph_direct\"></td></tr>\n";
		echo "<tr><td>Remote&nbsp;Office:</td><td><input type=\"text\" maxlength=20 size=35 name=\"ph_remote_office\"></td></tr>\n";
		echo "<tr><td>Remote&nbsp;Fax:</td><td><input type=\"text\" maxlength=20 size=35 name=\"ph_remote_fax\"></td></tr>\n";
		echo "<tr><td>Mobile&nbsp;Phone:</td><td><input type=\"text\" maxlength=20 size=35 name=\"ph_cell\"></td></tr>\n";
		echo "<tr><td>Home&nbsp;Phone:</td><td><input type=\"text\" maxlength=20 size=35 name=\"ph_home\"></td></tr>\n";
		
		echo "<tr><td colspan=2>&nbsp;</td></tr>\n";
		echo "<tr><td style=\"color:#003466;\"><b style=\"color:#003466;\">Office&nbsp;Location:</b></td><td><input type=\"text\" maxlength=255 size=35 name=\"location\"></td></tr>\n";
		echo "<tr><td style=\"color:#003466;\"><b style=\"color:#003466;\">Room/Cubicle #:</b></td><td><input type=\"text\" maxlength=20 size=10 name=\"room_num\"></td></tr>\n";
		echo "<tr><td colspan=2>Display this user in Employee Directory? &nbsp; <SELECT name=\"dir_display\"><option value=\"1\" SELECTED>Yes</option><option value=\"0\">No</option></SELECT></td></tr>\n";
		echo "<tr><td colspan=2>Display this user in Phone Extension List? &nbsp; <SELECT name=\"ext_display\"><option value=\"1\" SELECTED>Yes</option><option value=\"0\">No</option></SELECT></td></tr>\n";
		echo "<tr><td colspan=2>&nbsp;</td></tr>\n";
		echo "<tr><td colspan=2 align=\"center\"><input type=\"submit\" name=\"update_emp\" value=\"Add New Employee\"></td></tr>\n";
		echo "</table>\n";
		echo "</td></tr></table>\n";
		
		echo "<br><br>\n";
		echo "</form>\n";

	echo "<br><br><br><br>\n";
	echo "<center>Powered by <a href=\"http://www.intrabreeze.com\">IntraBreeze</a> &copy; 2005 IntraBreeze, LLC</center>\n";
}

echo "</body>\n</html>\n";
?>