search.php

<?php
// ============ HelpDesk Portal · search (REFLECTED HTML INJECTION) ============
require __DIR__ . '/includes/functions.php';
require_login();

$q = (string)($_GET['q'] ?? '');

page_header('Search');
?>
<div class="card" style="max-width:560px">
  <h2>Search</h2>
  <form method="get">
    <label>Kata kunci</label>
    <input type="text" name="q" value="<?= e($q) ?>" placeholder="mis. VPN, laptop…">
    <button>Cari</button>
  </form>

  <?php if ($q !== ''): ?>
    <div class="list-item" style="margin-top:16px">
      <span class="muted">Hasil pencarian untuk:</span>
      <?= $q /* INTENTIONALLY VULNERABLE — reflected HTML injection */ ?>
    </div>
  <?php endif; ?>
</div>
<?php page_footer(); ?>