Zploit 0-Day Shell

:: Editing File: search.php

<?php
	include"admin/func.php";
	include"admin/param.php";
	include"live.php";
	$P_img_news = '';
	$QRY = qry_run("select * from tbl_banners WHERE mainid = 25");
	if (num_rec($QRY) > 0)
	{
		$rs_b = fetch_rec($QRY);
		$P_img_news = $rs_b['img1'];
	}
?>
<?php include("top.php"); ?>
<?php include("top_menu.php"); ?>
<?php if ($P_img_news != ""){?>
<div class="container-fluid">
	<div class="row">
		<div class="col-md-12"><img src="admin/pictures/<?=$P_img_news?>" class="img-responsive"></div>
	</div>
</div>
<?php }?>
<div class="container-fluid">
	<div class="row" style="padding-bottom:20px;">
		<div class="col-md-3">
				<?php include("left.php"); ?>
		</div>
		<div class="col-md-9">
			<h3 class="cat_heading">Search Result '<?=ch('txt_search')?>'</h3>
			<div class="row breadcrumb_top">
				<div class="col-md-12">
					<ol class="breadcrumb" style="margin-bottom: 0px;">
					  <li><a href="index.php">Home</a></li>
					  <li class="active">Search Result</li>
					</ol>
				</div>
			</div>
			<?php
			$cur_page = ch_page('cur');
            $PER_PAGE = 20;
            $prod_page = $PER_PAGE;
            $perpage = $prod_page;
            if ($cur_page == 1)
            {
            	$subt = 0;
            }else{
				$subt = $cur_page * $prod_page;
				$subt = $subt - $prod_page;
            }
			$sqln = "Select * from tbl_prods where pshow = 'Yes' AND (pname Like '%".chf('txt_search')."%' OR part Like '%".chf('txt_search')."%' OR pdetail Like '%".chf('txt_search')."%') order by part";
            $queryn = qry_run($sqln);
            $rs_n = num_rec($queryn);
			
				$sql = "Select * from tbl_prods where pshow = 'Yes' AND (pname Like '%".chf('txt_search')."%' OR part Like '%".chf('txt_search')."%' OR pdetail Like '%".chf('txt_search')."%') order by part limit $subt,$perpage";
				$query = qry_run($sql);
				if (num_rec($query) > 0)
				{
					while ($rs = fetch_rec($query))
					{
				?>
				<a href="detail.php?live=<?=$rs['mainid']?>_<?=$rs['secid']?>_<?=$rs['catid']?>_<?=$rs['pid']?>" class="tab_menu_sub">
				<div class="row" style="margin-bottom:20px;">
					<div class="col-md-12" style="margin-bottom:20px;"><h4 style="color:#FFF;background:#232d6f;padding:10px;margin:0px;"><?=$rs['pname']?></h4></div>
					<div class="col-md-3">
						<img src="admin/pictures/<?=$rs['img1']?>" class="img-responsive">
					</div>
					<div class="col-md-9"><?=stripslashes(html_entity_decode($rs['sdetail']))?></div>
				</div>
				</a>
				<?php
					}
				}
				?>
			</div>
		</div>
	</div>
</div>
<?php include("btm.php"); ?>
</body>
</html>