Yearly Archives: 2009

Save this code as verifypurchase.php:

<?php

include “connection.php”;

//////////////////////////////////////////////////////////////

function check_txnid($con, $txnid)

{

$valid_txnid = false;

//get result set

$strsql = “SELECT * FROM tblorders “.

” WHERE txnid = ‘$txnid'”;

$rs = $con->query($strsql);

if($rs->num_rows == 0)

{

$valid_txnid = true;

}

return $valid_txnid;

}

//////////////////////////////////////////////////////////////

function check_price($con, $price, $inventoryid)

{

$valid_price = false;

//get result set

$strsql = “SELECT listprice FROM tblbooks “.

” WHERE inventorynumber = ‘$inventoryid'”;

$rs = $con->query($strsql);

$row = $rs->fetch_array();

$num = (float)$row[0];

if($num == $price)

{

$valid_price = true;

}

return $valid_price;

}

//////////////////////////////////////////////////////////////

function check_email($email)

{

$valid_email = false;

//compare to paypal merchant email

if($email == “seller@netultimate.com” )

{

$valid_email = true;

}

return $valid_email;

}

//////////////////////////////////////////////////////////////

function do_post($data)

{

//now send back to paypal

$c = curl_init(‘https://www.paypal.com/cgi-bin/webscr’);

curl_setopt($c, CURLOPT_POST,1);

curl_setopt($c, CURLOPT_POSTFIELDS, $data);

curl_setopt($c, CURLOPT_SSL_VERIFYPEER,FALSE);

curl_setopt($c, CURLOPT_RETURNTRANSFER, 1);

$status = curl_exec($c);

curl_close($c);

return $status;

}

//////////////////////////////////////////////////////////////

//loop for posted values

$data = “”;

foreach($_POST as $key => $value)

{

$value = urlencode(stripslashes($value));

$data .= “$key=$value&”;

}

//must add this before returning to paypal

$data .= “cmd=_notify-validate”;

$status = do_post($data);

//strip CR

$status = rtrim($status);

$payment_status = $_POST[‘payment_status’];

//get transaction id

$txn_id = $_POST[‘txn_id’];

if ($status == “VERIFIED” && $payment_status == “Completed”)

{

//need these variables

$price = $_POST[‘mc_gross’];

//get order number

$orderid = $_POST[‘custom’];

$inventoryid = $_POST[‘item_number’];

//merchant’s email i.e. paypal account

//equals business in paynow.html

$receiver_email = $_POST[‘receiver_email’];

//create a mysqli connection

$con = new mysqli($hostname, $username, $password, $databasename, 3306,

“/var/lib/mysql/mysql.sock”);

//check merchant email, price & not recycled txn id

//no need to change syntax to pass object by reference

$valid_txnid = check_txnid($con, $txn_id);

$valid_price = check_price($con, $price, $inventoryid);

$valid_email = check_email($receiver_email);

//if all checks write record

if($valid_price && $valid_email && $valid_txnid)

{

//update database with txn id

$strsql = “UPDATE tblorders SET txnid = ‘$txn_id’ “.

“WHERE orderid = $orderid”;

$con->query($strsql);

$message =”Successful, transaction id: $txn_id\n”;

}

else

{

//unsuccessful transaction

$message =”Unsuccessful, transaction id: $txn_id\n”;

}

}

else if($status == “INVALID”)

{

//notify suspicious transaction

$message =”Suspicious IPN with transaction id: $txn_id”;

}

else

{

//deal with other types

$message =”Incomplete purchase with transaction id: $txn_id”;

}

mail (“notify@netultimate.com”, “PayPal”, $message);

?>

Running the Hack

First you will need a PayPal account. Create one by going to the PayPal home page and signing up for a business account.

Then you need to alter the files to your specifications. Your buynow.html file will of course reflect the product you are selling. You will also need to change the email addresses in both the buynow.html file and the verifypurchase.php file. Replace “seller@netultimate.com” with the email address associated with your PayPal account. This is important because it identifies the account that will receive payment. Change “notify@netultimate.com” to the appropriate address for receiving confirmation of payment. You may not need a payment confirmation at all or you may want to replace it with code to write a log file, especially in the case of a failed payment. Change the connection.php file to reflect values appropriate to your MySQL server. No changes are required for the presubmit.php file unless you change the database structure.

You will doubtless create a database suited to your specific business needs but, if you wish to test this code as is, here are the SQL statements that will create the minimum required database structure:

CREATE TABLE `tblbooks` (

`inventorynumber` int(11) NOT NULL auto_increment,

`title` varchar(150) NOT NULL default ”,

`author` varchar(100) NOT NULL default ”,

`cost` float(6,2) NOT NULL default ‘0.00’,

`listprice` float(7,2) NOT NULL default ‘0.00’,

`publicationdate` varchar(4) default NULL,

`publisher` varchar(4) NOT NULL default ”,

PRIMARY KEY  (`inventorynumber`),

KEY `authidx` (`author`),

KEY `titleidx` (`title`),

) ENGINE=MyISAM DEFAULT CHARSET=latin1

CREATE TABLE `tblorders` (

`orderid` int(11) NOT NULL auto_increment,

`customerid` int(11) default NULL,

`orderdate` date default NULL,

`txnid` varchar(17) default NULL,

PRIMARY KEY  (`orderid`)

) ENGINE=MyISAM DEFAULT CHARSET=latin1

CREATE TABLE `tblorderitems` (

`orderid` int(11) NOT NULL default ‘0’,

`inventorynumber` int(11) NOT NULL default ‘0’,

PRIMARY KEY  (`orderid`,`inventorynumber`)

) ENGINE=MyISAM DEFAULT CHARSET=latin1

Next, upload the files to your server ensuring that the connection.php, buynow.html and presubmit.php files are all in the same directory. You can put the verifypurchase.php file in the same directory as well but it’s probably better off in its own directory. If you do put it in a separate directory be sure to change the include path for the connection.php file.

Go to your PayPal account, turn on IPN and enter the fully qualified URL for the verifypurchase.php file. To make a purchase point your browser at buynow.php. You will know that everything is working when you click on the “Buy Now” button, are taken to the PayPal site and, when payment is complete, you then receive an email containing the transaction id.

PHP
PHP works in combination of HTML to display dynamic elements on the page. PHP only parses code within its delimiters, such as . Anything outside its delimiters is sent directly to the output and not parsed by PHP.

PHP strength lies mostly in LAMP. The LAMP architecture has become popular in the Web industry as a way of deploying inexpensive, reliable, scalable, secure web applications. PHP is commonly used as the P in this bundle alongside Linux, Apache and MySQL. PHP can be used with a large number of relational database management systems, runs on all of the most popular web servers and is available for many different operating systems. This flexibility means that PHP has a wide installation base across the Internet; over 18 million Internet domains are currently hosted on servers with PHP installed.

With PHP 5 finally came exception handling and true OOP, but it still lack namespacing to prevent class naming collisions. PHP’s type checking is very loose, potentially causing problems. Another drawback is that variables in PHP are not really considered to have a type. Finally, for some reason big corporations feel that if they’re not paying for something, then it’s not worth buying. If that’s you’re company’s mentality, they just need to wake up and check out all the awesome free software that’s out there

ASP.NET
If you program in ASP.NET you’ll typically get too responses from the other side. Either you’re rich (or your company is) or you’re a Microsoft lover. While the name comes from Microsoft’s old ASP technology, they made a huge leap with the .NET Framework, and the CLR allows you to use other languages for back end processing: typically Visual Basic.NET or C#.

ASP.NET’s strength lies in object oriented features, and it’s flexibility. Because of the CLR you can have C# programmers and VB.NET programmers working on the same project, or switch languages half way through and not have to rewrite all of your old classes. The .NET class library is organized into inheritable classes based around particular tasks, such as working with XML or image manipulation, so a lot of the more common tasks have been already handled for you.

Visual Studio .NET is a massive development IDE that (as long as your computer is fast enough) will shave tons of time of your coding. It has built in debugging along with IntelliSense, which allows for auto-completion of methods and variables so you don’t have to memorize everything.

On the down side, ASP.NET is expensive. One it uses tons more resources on the web server so you’ll require either better server or more servers in the farm. Windows 2003 and Visual Studio .NET are pretty tough on the pocket book as well. It’s extremely rare for an ASP.NET app not to be running on IIS. And if you pay attention to any of the bug reports, you’ll notice that Windows and IIS have had a bit of a history with vulnerabilities being exploited.

So Which Is Better?
We’ll I have my opinions and you may have yours as well. But in general, PHP is cheap, secure, fast, and reliable, while ASP.NET has quicker development time and is easier due to its class library system can probably be maintained more easily. Both are great languages, and it’s up to you to make the decision.