<?php
function write2LogFile( $message, $file = "../ipn_donations_logz.txt" ) { $file = fopen($file, "a"); fputs($file, "[".date('d-m-Y')."] ".$message."\n"); fclose($file); }
$req = 'cmd=_notify-validate';
$email = 'Bruno_127@live.com';
foreach ($_POST as $key => $value) {
$value = urlencode(stripslashes($value));
$req .= "&$key=$value";
}
write2LogFile( 'it works' );
$header = null;
// post back to PayPal system to validate
$header .= "POST /cgi-bin/webscr HTTP/1.0\r\n";
$header .= "Content-Type: application/x-www-form-urlencoded\r\n";
$header .= "Content-Length: " . strlen($req) . "\r\n\r\n";
$fp = fsockopen ('ssl://www.paypal.com', 443, $errno, $errstr, 30);
// assign posted variables to local variables
$payment_status = $_POST['payment_status'];
$payment_amount = $_POST['mc_gross'];
$payment_currency = $_POST['mc_currency'];
$receiver_email = $_POST['receiver_email'];
$txn_id = $_POST['txn_id'];
$payer_email = $_POST['payer_email'];
if (!$fp) {
	write2LogFile( "Could not connect to Paypal");
} else {
fputs ($fp, $header . $req);
while (!feof($fp)) {
$res = fgets ($fp, 1024);
		if (strcmp ($res, "VERIFIED") == 0)
		{
			if (($payment_status == 'Completed'))
			{		
				if( ! isset( $_POST['custom'] ) )
				{
					write2LogFile( "UserNo not set" . " Transaction - " .$_POST['txn_id'] . "  Email - " . $payer_email);
					die();
				}
				
				if( ! $payment_currency == 'USD' )
				{
					write2LogFile( "Invalid Currency UserNo - " . $_POST['custom'] . " Transaction - " .$_POST['txn_id'] . "  Email - " . $payer_email );
					die();
				}

				if( @preg_match( '/[^0-9]/' , $_POST['custom'] ) > 0 )
				{
					write2LogFile( "Hack Attempt string - " . trim( $_POST['custom'] ) );
					die();
				}
				
				 if( $receiver_email <> $email )
				{
					write2LogFile( "Not correct email UserNo - " . $_POST['custom'] . " Transaction - " .$_POST['txn_id'] . "  Email - " . $payer_email);
					die();
				}
				
				$SQL_HOST	 = '.\SQLEXPRESS';
				$SQL_USER 	= 'fewfe1f5we6f';
				$SQL_PASS 	= 'fEWF$_T45!E@EQd6';
				$SQL_DB		= 'Account';
				$coninfo = array( "UID" => $SQL_USER , "PWD" => $SQL_PASS , "Database" => $SQL_DB );
				$conn = @sqlsrv_connect( $SQL_HOST , $coninfo );

				
				$do = sqlsrv_prepare( $conn , "Select * from tUser where nUserNo = ?" , array( &$_POST['custom'] ) );
				sqlsrv_execute( $do );
				if( sqlsrv_has_rows( $do ) == true )
				{
					$totalCoins = round( $payment_amount * 500 );
					$update = sqlsrv_prepare( $conn , "update Account..tCash set cash = cash + ? where userNo = ? and cashtype = 1" , array( &$totalCoins , &$_POST['custom'] ) );
					sqlsrv_execute( $update );
					if( $update )
					{
						$insertLog = sqlsrv_prepare( $conn , "Insert into tCashLog ( [userNo] , [logType] , [cashType] , [cash] , [reference] , [txn_id] ) values ( ? , 1 , 1 , ? , 'add' , ? )" , array( &$_POST['custom'] , &$totalCoins , &$_POST['txn_id'] ) );
						sqlsrv_execute( $insertLog );
						write2LogFile( "SUCCESS1 ".$totalCoins." points added to " .  $_POST['custom'] . " Transaction - " .$_POST['txn_id'] . "  Email - " . $payer_email  );
					}
					else
					{
						write2LogFile( "FAILED ".$totalCoins."  UserNo - " .  $_POST['custom'] . " Transaction - " .$_POST['txn_id'] . "  Email - " . $payer_email  . " Server Error");
					}
				}
				else
				{
					write2LogFile( "User Not Found - " . trim( $_POST['custom'] ) . "  Email : " . $payer_email );
				}
			}
			else
			{
				write2LogFile( "FAILED ".$totalCoins."  UserNo - " .  $_POST['custom'] . " Transaction - " .$_POST['txn_id'] . "  Email - " . $payer_email . " not completed" );
			}
		}
	}
	fclose ($fp);
}
?>
