Fallagassrini Bypass Shell

<?php
header('Content-Type: application/json; charset=utf-8');
session_start();

include("../configuration.php");
include("../includes/fonctions.php");

// limite sécurisée
$limit = isset($_GET['limit']) ? (int)$_GET['limit'] : 5;
if ($limit < 1) $limit = 5;
if ($limit > 50) $limit = 50; // anti-abus

$rows = $db->get_results("
  SELECT ville, postal_code, pays,
       SUM(compteur) AS total,
       MAX(rayon_km) AS rayon_km_max,
       (
         SELECT nombre_voyageurs
         FROM ville_recherche_cache v2
         WHERE v2.ville = v1.ville
           AND v2.postal_code = v1.postal_code
           AND v2.pays = v1.pays
         ORDER BY compteur DESC
         LIMIT 1
       ) AS voyageurs_populaire
FROM ville_recherche_cache v1
GROUP BY ville, postal_code, pays
ORDER BY total DESC
LIMIT " . $limit."
");

$out = [];

if ($rows) {
  foreach ($rows as $r) {
    $postal_code = trim((string)($r->postal_code ?? ''));

    $ville_pays = $postal_code !== ''
      ? $r->ville . ', ' . $postal_code . ', ' . strtoupper($r->pays)
      : $r->ville . ', ' . strtoupper($r->pays);

    $label = $postal_code !== ''
      ? $r->ville . ' (' . $postal_code . '), ' . strtoupper($r->pays)
      : $r->ville . ', ' . strtoupper($r->pays);

    $out[] = [
	  'ville_pays' => $ville_pays,
	  'label'      => $label,
	  'compteur'   => (int)$r->total,
	  'rayon_km'   => (int)$r->rayon_km_max,
	  'nombre_voyageurs' => (int)($r->voyageurs_populaire ?? 0),
	];
  }
}

echo json_encode(['ok' => true, 'items' => $out]);