HEX
Server: Apache
System: Linux dev.epsylon.net 3.10.0-1160.144.1.el7.tuxcare.els2.x86_64 #1 SMP Sun Feb 15 11:22:42 UTC 2026 x86_64
User: nexper (1054)
PHP: 8.2.30
Disabled: exec,passthru,shell_exec,system
Upload Files
File: /home/nexper/public_html/nexper_drupal/php/modules/busqueda.php
<!--best start -->
<div id="best">
<?php
/*
$adv = @$_GET['adv'];
if (isset($adv) && !empty($adv)) {
	echo '<form id="advs" name="advs" method="post" enctype="multipart/form-data"><b>'.
	'Filtrar por Marca '.doSelectorX('marcaq', 'marca', 'm_id', 'm_nom', 'WHERE m_disabled = 0', '', $_POST['marcaq']).
	'&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'.
	'Filtrar por Fabricante '.doSelectorX('fabq', 'fabricante', 'f_id', 'f_nom', 'WHERE f_disabled = 0', '', $_POST['fabq']).
	'&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'.	
	'<input type="submit" id="advsubmit" name="advsubmit" value="Buscar" class="inputButton" >'.
	'</b></form>';
}
*/
//if (isset($_POST['querytext'])) {
if ($_POST) {
	$querytext = @$_POST['querytext'];
	$modalidad = @$_POST['modalidad'];

	if (!empty($querytext))	 {
		$formatear = repCHR($querytext, "{}-*/<>[]&=#|_()");
		$valor = "%".$formatear."%";
	} else {
		$valor = "%";
	}
	
	$campo = "(p.descripcion LIKE '".$valor."' OR p.sector LIKE '".$valor."')";
	$orden = "ASC";
	
	if (!empty($modalidad)) {
		$querymf = " AND p.modalidad = '".$modalidad."'";
	} else {
		$querymf = "";
	}
	
	//$query = "SELECT valor, descripcion, modalidad, amoblada, sector FROM productos WHERE ".$campo.$querymf." AND disabled = '0' ORDER BY sector ".$orden;
		$query = "SELECT p.id as pid,".
						" p.valor as precio,".
						" p.fechaing as fechai,".
						" p.createdby as creador,".
						" p.fechamod as fecham,".
						" p.descripcion as des,".
						" p.amoblada as amob,".
						" t.tipo as modalidad,".
						" p.sector as sector,".
						" c.ciudad as ciudad ". 
				 "FROM producto AS p ".
					// "LEFT JOIN sector as s ON (s.id = p.sectorID)".
					 "LEFT JOIN ciudad as c ON (c.id = p.ciudadID)".
					 "LEFT JOIN tipocat as t ON (t.id = p.modalidad)".
				 "WHERE ".$campo.$querymf." AND p.disabled = '0' ORDER BY p.sector ".$orden;



	//------------------
	//echo $query.'<br>';
	$result = mysql_query($query) or die ("ERROR: ".mysql_error());
	$cols = 4;
	$xcols = 1;
	
	echo '<table width="700" align="center" border="0" cellspacing="0" cellpadding="0" id="contenido">'.
	'<tr>'.
	'<td colspan="'.$cols.'" align="left" class="title" valign="top" height="25"><h2>Resultado de la B&uacute;squeda: Coincidencias '.mysql_num_rows($result).'</h2></td></tr>'.
	'<tr>'.
	'<td colspan="'.$cols.'" align="left" valign="top">';


	while ($cant = mysql_fetch_assoc($result)) {
			$nom_url = $cant{'modalidad'};
			
			$image_c = getProdImg($cant{'pid'}, $prod_path, 150, 150, 'link');
			if ($cant{'precio'} == 0 || empty($cant{'precio'})) {
				$precio = "Consulte Precio";
			} else {
				$precio = "<b>Precio $ ".number_format($cant{'precio'}, 0, ',', '.')."</b>";
			}

	echo '<div style="position:relative; margin:auto; display:inline-block; padding:0px; width:175px; height:250px; background:url(images/item_bg.png); background-position:top right; text-align:center;">'.
	'<div style="position:absolute; top:2px; width:175px; height:20px; text-align:center;">'.
	'<p class="bestTxt2"><a href="?sec=3&idp='.$cant{'pid'}.'" target="_self">'.item_name($nom_url).'</a></p></div>'.
	'<div style="position:absolute; top:42px; width:175px; height:80px; text-align:center;"><a href="?sec=3&idp='.$cant{'pid'}.'" target="_self">'.$image_c.'</a></div>'.
	'<div style="position:absolute; top:200px; width:175px; height:20px; text-align:center;"><p class="bestTxt">'.$cant{'ciudad'}.'</p></div>'.
	'<div style="position:absolute; top:225px; width:175px; height:20px; text-align:center;"><p class="bestTxt2">'.$precio.'</p></div>'.
	'</div>';
		}
		echo '</td></tr>'.
			'</table>';

} // end if post

echo '<p align="center"><input type="button" name="cancel" id="cancel" value="Volver" class="inputButton" onClick="javascript:history.go(-1)"></p><br>';    
mysql_close ($conex);
?>
</div>
<!--best end -->