<?php
require_once 'api.php';

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $xml_decoded = base64_decode($_POST['operation_xml']);
    $xml = new SimpleXMLElement($xml_decoded);
    $signature = base64_encode(sha1(MERCHANT_SIGNATURE . $xml_decoded . MERCHANT_SIGNATURE, true));

    if ($_POST['signature'] == $signature) {

        // success, failure, wait_secure
        if ($xml->status == 'sandbox') { // 'sandbox' ещё пытался менять на 'success'
            echo '<h1>Success</h1>';
                $city = $_POST['city']; // Забирает значения с формы в глобальные переменные $_POST
                $pizza = $_POST['pizza'];
                $adress = $_POST['adress'];
                $code = $_POST['code'];


                $dbc = mysqli_connect('tut host', 'tut user', 'tut moi parol', 'tut moya bd')
                or die('Error connecting to MySQL server.');

                $query = "INSERT INTO orders (city, pizza, adress, code) " .
                "VALUES ('$city', '$pizza', '$adress', '$code')";

                $result = mysqli_query($dbc, $query)
                or die('Error querying database.');

            mysqli_close($dbc);
        }

    } else {
        echo '<h1>Wrong Signature</h1>';
    }

} else {
    echo '<h1>Wrong Method</h1>';
}