JEMBOT MAWOT Bypass Shell

<?php
include_once '../../../../php/dao/include_dao.php';
include_once '../../outils.php';
session_start();
if (isset($_SESSION['pkFilm'])) {
    ?>

    <div id="listeHoraires">
        <table class="table100pc">
            <tr>
                <td>Horaire</td>
                <td>Patria</td>
                <td>Nos Loisirs</td>
            </tr>
            <?php
            $listeHoraires = DAOFactory::getHoraireDAO()->queryByFkFilm($_SESSION['pkFilm']);
            foreach ($listeHoraires as $horaire) {
                ?>

                <tr>
                    <td>
                        <?php echo Date::formatageDate($horaire->heure, Date::D_M_Y_H_N); ?>

                    </td>
                    <td>
                        <?php
                        echo testValeur($horaire->patria, "-1", '<div class="valid"></div>', '');
                        ?>

                    </td>
                    <td>
                        <?php
                        echo testValeur($horaire->nosLoisirs, "-1", '<div class="valid"></div>', '');
                        ?>
                    </td>
                    <td>
                        <button id="btnHoraire_<?php echo $horaire->pkHoraire ?>">Supprimer</button>
                    </td>
                </tr>
                <?php
            }
            ?>
            <tr>
                <td><input id="heure"></td>
                <td>
                    <input id="patria" type="checkbox"/>
                </td>
                <td>
                    <input id="nosLoisirs" type="checkbox" />
                </td>
                <td>
                    <button id="buttonHorraireAdd">Ajouter</button>

                </td>
            </tr>
        </table>
        <script>

    <?php
    foreach ($listeHoraires as $horaire) {
        ?>
                $("#btnHoraire_<?php echo $horaire->pkHoraire; ?>").button();


                $("#btnHoraire_<?php echo $horaire->pkHoraire; ?>").click(function () {
                    target = '#listeHoraires';
                    execAjax(
                            'php/film/horaire/data.php', target, {
                                op: 'del',
                                pkHoraire: <?php echo $horaire->pkHoraire; ?>

                            }, 1
                            );



                });
        <?php
    }
    ?>
            $("#buttonHorraireAdd").button();
            $('#heure').datetimepicker(
                    {
                        dateFormat: 'dd/mm/yy',
                        timeFormat: ('HH:mm')

                    });

            $("#buttonHorraireAdd").click(function () {
                target = '#listeHoraires';
                execAjax(
                        'php/film/horaire/data.php', target, {
                            op: 'add',
                            fkFilm: pkFilm,
                            heure: $("#heure").val(),
                            patria: $("#patria:checked").val(),
                            nosLoisirs: $("#nosLoisirs:checked").val(),
                        }, 1
                        );



            });
        </script>

    </div>

    <?php
}
else{
    echo "Pas de film selectionné...";
}
?>