PayGol IPN

<?php
$MySQL_host = 'localhost';
$MySQL_user = '';
$MySQL_pw = '';
$MySQL_db = '';
$MySQL_db_table = 'users';

$PayGol_IPs = array
(
        '109.70.3.48',
        '109.70.3.146',
        '109.70.3.58'
);

$min_price = 50;
$allowed_currencies = array('NOK');

$logging = true;
$log_path = 'log_paygol_'; // error|success

function pgLog($type, $msg)
{
        global $logging, $log_path;
        if (!$logging) return false;

        $fh = @fopen($log_path . $type, 'a');
        if ($fh)
        {
                fwrite($fh, "------\n Date: " . date('d.m.Y H:i:s') . "\tIP: " . $_SERVER['REMOTE_ADDR'] . (isset($_GET['sender']) ? ("\tSender: " . $_GET['sender']) : "") . "\n Msg: " . $msg . "\n------\n");
                fclose($fh);
        }
        else
        {
                echo '!!! Not allowed to write to ' . $log_path . $type . ' !!!' . PHP_EOL;
                echo 'whoami: ' . @exec('whoami') . PHP_EOL;
        }
}

try
{
        if (!in_array($_SERVER['REMOTE_ADDR'], $PayGol_IPs))
        {
                throw new Exception('Invalid remote IP');
        }

        if ($_GET['price'] < $min_price)
        {
                throw new Exception('Too low price: ' . $_GET['price']);
        }

        if (!in_array($_GET['currency'], $allowed_currencies))
        {
                throw new Exception('Invalid currency');
        }

        $db = new mysqli($MySQL_host, $MySQL_user, $MySQL_pw, $MySQL_db);
        if ($db->connect_error)
        {
                throw new Exception('MySQL connect error (' . $db->connect_errno . '): ' . $db->connect_error);
        }

        if (@$db->query('UPDATE `' . $MySQL_db_table . '` SET `vip_points` = `vip_points` + 100 WHERE `id` = \'' . $db->real_escape_string($_GET['custom']) . '\' '))
        {
                if ($db->affected_rows == 0)
                {
                        throw new Exception('Query: No rows affected (non-existing user-id? custom = ' . $_GET['custom'] . ')');
                }
        }
        else
        {
                throw new Exception('Query error (' . $db->errno . '): ' . $db->error);
        }

        $db->close();

        header('Content-Type: text/plain');
        echo 'OK';

        pgLog('success', "User-Id: " . $_GET['custom'] . "\tPrice: " . $_GET['price']);
}
catch (Exception $ex)
{
        header('HTTP/1.1 400 Bad Request');
        header('Content-Type: text/plain');

        pgLog('error', $ex->getMessage());
        echo $ex->getMessage();
        exit;
}
?>