|
查看: 1496|回复: 7
|
(已解决)求助php cart和paypal问题
[复制链接]
|
|
|
本帖最后由 Andrew97 于 11-8-2016 03:30 PM 编辑
我刚刚跟人家学做了一个cart→paypal给钱
Product.php , success.php , cancel.php
这个就成功进到去Php的test给钱哪里，有show item code n 几多钱。不过不好就是这个只能买一个东西，他没cart
问题来了：
我刚刚做了一个大概一样的，只不过我加了cart和update cart.
我所开启的有
Index.php , viewcart.php , updatecart.php , success.php , cancel.php
全部搞定后dB 也set好了，一按PayPal 的buy now button就是美反应。。。除非要delete那个link to update cart.php的action post...
有谁能帮帮忙，
config.php
<?php
$db_username = 'andrew';
$db_password = 'pass';
$db_name = 'banana';
$db_host = 'localhost';
//connect to MySql
$db = new mysqli($db_host, $db_username, $db_password,$db_name);
if ($db->connect_error) {
die('Error : ('. $db->connect_errno .') '. $db->connect_error);
}
?>
viewcart.php
<?php
session_start();
include_once("config.php");
//Set useful variables for paypal form
$paypal_url = 'https://www.sandbox.paypal.com/cgi-bin/webscr'; //Test PayPal API URL
$paypal_id = 'andrew@gmail.com'; //Business Email
//fetch products from the database
$results = $db->query("SELECT * FROM products");
?>
<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>View shopping cart</title>
<link href="style/style.css" rel="stylesheet" type="text/css"></head>
<body>
<h1 align="center">View Cart</h1>
<div class="cart-view-table-back">
<form method="post" action="cart_update.php">
<table width="100%" cellpadding="6" cellspacing="0"><thead><tr><th>Quantity</th><th>Name</th><th>Price</th><th>Total</th><th>Remove</th></tr></thead>
<tbody>
<?php
if(isset($_SESSION["cart_products"])) //check session var
{
$total = 0; //set initial total value
$b = 0; //var for zebra stripe table
foreach ($_SESSION["cart_products"] as $cart_itm)
{
//set variables to use in content below
$product_name = $cart_itm["product_name"];
$product_qty = $cart_itm["product_qty"];
$product_price = $cart_itm["product_price"];
$product_code = $cart_itm["product_code"];
$product_color = $cart_itm["product_color"];
$subtotal = ($product_price * $product_qty); //calculate Price x Qty
$bg_color = ($b++%2==1) ? 'odd' : 'even'; //class for zebra stripe
echo '<tr class="'.$bg_color.'">';
echo '<td><input type="text" size="2" maxlength="2" name="product_qty['.$product_code.']" value="'.$product_qty.'" /></td>';
echo '<td>'.$product_name.'</td>';
echo '<td>RM'.$product_price.'</td>';
echo '<td>RM'.$subtotal.'</td>';
echo '<td><input type="checkbox" name="remove_code[]" value="'.$product_code.'" /></td>';
echo '</tr>';
$total = ($total + $subtotal); //add subtotal to total var
}
}
?>
<tr><td colspan="5"><span style="float:right;text-align: right;">Amount Payable : <?php echo 'RM'.$total;?></span></td></tr>
<tr><td colspan="5"><a href="index.php" class="button">Add More Items</a><button type="submit">Update</button></td></tr>
</tbody>
</table>
<form action="<?php echo $paypal_url; ?>" method="post">
<!-- Identify your business so that you can collect the payments. -->
<input type="hidden" name="business" value="<?php echo $paypal_id; ?>">
<!-- Specify a Buy Now button. -->
<input type="hidden" name="cmd" value="_xclick">
<!-- Specify details about the item that buyers will purchase. -->
<input type="hidden" name="product_name" value="<?php echo $row['product_name']; ?>">
<input type="hidden" name="item_number" value="<?php echo $row['product_code']; ?>">
<input type="hidden" name="amount" value="<?php echo $row['total']; ?>">
<input type="hidden" name="currency_code" value="MYR">
<!-- Specify URLs -->
<input type='hidden' name='cancel_return' value='http://example.com/cancel.php'>
<input type='hidden' name='return' value='http://example.com/success.php'>
<!-- Display the payment button. -->
<!-- Display the payment button. -->
<input type="image" name="submit" border="0"
src="https://www.paypalobjects.com/en_US/i/btn/btn_buynow_LG.gif" alt="PayPal - The safer, easier way to pay online">
<img alt="" border="0" width="1" height="1" src="https://www.paypalobjects.com/en_US/i/scr/pixel.gif" >
</form>
</form>
</div>
</body>
</html>
cart_update.php
<?php
session_start();
include_once("config.php");
//add product to session or create new one
if(isset($_POST["type"]) && $_POST["type"]=='add' && $_POST["product_qty"]>0)
{
foreach($_POST as $key => $value){ //add all post vars to new_product array
$new_product[$key] = filter_var($value, FILTER_SANITIZE_STRING);
}
//remove unecessary vars
unset($new_product['type']);
unset($new_product['return_url']);
//we need to get product name and price from database.
$statement = $db->prepare("SELECT product_name, price FROM products WHERE product_code=? LIMIT 1");
$statement->bind_param('s', $new_product['product_code']);
$statement->execute();
$statement->bind_result($product_name, $price);
while($statement->fetch()){
//fetch product name, price from db and add to new_product array
$new_product["product_name"] = $product_name;
$new_product["product_price"] = $price;
if(isset($_SESSION["cart_products"])){ //if session var already exist
if(isset($_SESSION["cart_products"][$new_product['product_code']])) //check item exist in products array
{
unset($_SESSION["cart_products"][$new_product['product_code']]); //unset old array item
}
}
$_SESSION["cart_products"][$new_product['product_code']] = $new_product; //update or create product session with new item
}
}
//update or remove items
if(isset($_POST["product_qty"]) || isset($_POST["remove_code"]))
{
//update item quantity in product session
if(isset($_POST["product_qty"]) && is_array($_POST["product_qty"])){
foreach($_POST["product_qty"] as $key => $value){
if(is_numeric($value)){
$_SESSION["cart_products"][$key]["product_qty"] = $value;
}
}
}
//remove an item from product session
if(isset($_POST["remove_code"]) && is_array($_POST["remove_code"])){
foreach($_POST["remove_code"] as $key){
unset($_SESSION["cart_products"][$key]);
}
}
}
//back to return url
$return_url = (isset($_POST["return_url"]))?urldecode($_POST["return_url"]):''; //return url
header('Location:'.$return_url);
?>
success.php
<?php
include 'config.php';
//Store transaction information from PayPal
$item_number = $_GET['item_number'];
$txn_id = $_GET['tx'];
$payment_gross = $_GET['amt'];
$currency_code = $_GET['cc'];
$payment_status = $_GET['st'];
//Get product price
$productResult = $db->query("SELECT price FROM products WHERE id = ".$item_number);
$productRow = $productResult->fetch_assoc();
$productPrice = $productRow['price'];
if(!empty($txn_id) && $payment_gross == $productPrice && $prevRowNum == 0){
//Check if payment data exists with the same TXN ID.
$prevPaymentResult = $db->query("SELECT payment_id FROM payments WHERE txn_id = '".$txn_id."'");
if($prevPaymentResult->num_rows > 0){
$paymentRow = $prevPaymentResult->fetch_assoc();
$last_insert_id = $paymentRow['payment_id'];
}else{
//Insert tansaction data into the database
$insert = $db->query("INSERT INTO payments(item_number,txn_id,payment_gross,currency_code,payment_status) VALUES('".$item_number."','".$txn_id."','".$payment_gross."','".$currency_code."','".$payment_status."')");
$last_insert_id = $db->insert_id;
}
?>
<h1>Your payment has been successful.</h1>
<h1>Your Payment ID - <?php echo $last_insert_id; ?>.</h1>
<?php
}else{
?>
<h1>Your payment has failed.</h1>
<?php
}
?>
|
|
|
|
|
|
|
|
|
|
|
|
发表于 11-8-2016 09:20 PM
|
显示全部楼层
你不会全都用这 code 吧.  |
|
|
|
|
|
|
|
|
|
|
|
楼主 |
发表于 12-8-2016 12:22 AM
来自手机
|
显示全部楼层
路過人甲 发表于 11-8-2016 09:20 PM
你不会全都用这 code 吧.
什么意思@.@？ |
|
|
|
|
|
|
|
|
|
|
|
发表于 25-9-2016 09:54 PM
|
显示全部楼层
|
你的code根本不安全，假如我们直接post value 去success.php, 你有想过这样的结果吗？因为我可以不需要经过付款页面。最安全的方式是不要让人知道你post的value出现在html code，因为我们可以从google developer tool查看html code |
|
|
|
|
|
|
|
|
|
|
|
楼主 |
发表于 26-9-2016 12:43 AM
来自手机
|
显示全部楼层
hooiyijun 发表于 25-9-2016 09:54 PM
你的code根本不安全，假如我们直接post value 去success.php, 你有想过这样的结果吗？因为我可以不需要经过付款页面。最安全的方式是不要让人知道你post的value出现在html code，因为我们可以从google developer too ...
Hi,不好意思你说得可以用google 按source code看html code，那如何才为之安全。。不要拿上面那个来说(很乱)。。。打个比如来说。。。类似form还是其他的说法 |
|
|
|
|
|
|
|
|
|
|
|
发表于 26-9-2016 09:31 PM
|
显示全部楼层
本帖最后由 hooiyijun 于 26-9-2016 09:32 PM 编辑
在google chrome, 按右键， 选inspect
或可以按右上角，选More tools -> Developers Tools
可是，你的success.php只是存paypal transaction id，从来没什么update order status。所以算是大概安全下。假如你直接改code成update order status 和让人家拿到confirmation，就不安全咯。
|
|
|
|
|
|
|
|
|
|
|
|
楼主 |
发表于 26-9-2016 11:25 PM
来自手机
|
显示全部楼层
hooiyijun 发表于 26-9-2016 09:31 PM
在google chrome, 按右键， 选inspect
或可以按右上角，选More tools -> Developers Tools
可是，你的success.php只是存paypal transaction id，从来没什么update order status。所以算是大概安全下。假如你 ...
Developer tools same as ctrl+u ?
可以帮我看下我现在试做的全部安全？yik6886.com只是用来texting罢了。。。那个chat还没弄好。。。
Login哪里是如果你是user就去user page,可是如果他detect到你是admin就会安排去admin page |
|
|
|
|
|
|
|
|
|
|
|
发表于 27-9-2016 10:38 AM
|
显示全部楼层
developer tools not same with ctrl+u
因为developer tools可以实时反映页面的变化。for example: <input type='hidden' name='fname' id='fname' value='test123'>，我们可以从developer tool得知value是test123
不能简单检查html code，必须读所有php code才能知道安不安全。假如还是需要我帮忙检查，可以私下pm。出力要有回报啊。 |
|
|
|
|
|
|
|
|
|
| |
 本周最热论坛帖子
|
变色卡
千斤顶
1428 
28
