<?php
require('../config.php');
$mode = $_GET['mode'];
if($mode == 'verify') {
	// Verify mode variables
	$api = mysql_real_escape_string($_GET['key']);
	$email = mysql_real_escape_string($_GET['email']);
	$userpass = mysql_real_escape_string($_GET['pass']); // The password is already in MD5
	// MySQL query to look for the apikey
	$q = 'SELECT * FROM `games` WHERE `apikey`=\''.$api.'\'';
	$res = mysql_query($q) or die(mysql_error());
	$resc = mysql_num_rows($res);
	if($resc == 1) {
		$game = mysql_fetch_array($res);
		// Found the what game it is. Let's verify the user's password.
		$q = "SELECT * FROM `users` WHERE `email`='".$email."' AND `password`='".$userpass."'";
		$res = mysql_query($q) or die(mysql_error());
		$resc = mysql_num_rows($res);
		if($resc == 1) {
			// Verified the user's password. Now to check if the user bought the application.
			$user = mysql_fetch_array($res);
			$games = explode(',', $user['gameid']);
			$v = 0;
			foreach($games as $g) {
				if($g == $game['gameid']) {
					// The user bought the application, let's output the XML code
					$xml = new SimpleXMLElement('<info></info>');
					$xml->addChild('mode', 'verify');
					$xml->addChild('API_key', $api);
					$xml->addChild('secret_key', $game['secretkey']);
					$xml->addChild('user_firstname', $user['firstname']);
					$xml->addChild('user_lastname', $user['lastname']);
					$xml->addChild('status', 'verified');
					$v = 1;
				}
				// End foreach loop
			}
			if($v == 0) {
				// The user hasn't bought the game.
				$xml = new SimpleXMLElement('<info></info>');
				$xml->addChild('mode', 'verify');
				$xml->addChild('API_key', $api);
				$xml->addChild('secret_key', $game['secretkey']);
				$xml->addChild('user_firstname', $user['firstname']);
				$xml->addChild('user_lastname', $user['lastname']);
				$xml->addChild('status', 'error 1');
				$xml->addChild('error', 'The user hasn\'t bought the application.');
			}
		} else {
			// The user's data doesn't match up.
			$xml = new SimpleXMLElement('<info></info>');
			$xml->addChild('mode', 'verify');
			$xml->addChild('API_key', $api);
			$xml->addChild('secret_key', $game['secretkey']);
			$xml->addChild('status', 'error 2');
			$xml->addChild('error', 'The user\'s data doesn\'t match up.');
		}
	} else {
		// No application with that API key found.
		$xml = new SimpleXMLElement('<info></info>');
		$xml->addChild('mode', 'verify');
		$xml->addChild('status', 'error 3');
		$xml->addChild('error', 'No application with that API key found.');
	}
	// End verify if
}
if($mode == 'register') {
	// Register a bought app with ExiaApps
	$apikey = mysql_real_escape_string($_GET['key']);
	$userkey = mysql_real_escape_string($_GET['userkey']);
	$q = 'SELECT * FROM `games` WHERE `apikey`=\''.$apikey.'\'';
	$res = mysql_query($q) or die(mysql_error());
	$resc = mysql_num_rows($res);
	if($resc == 1) {
		$game = mysql_fetch_array($res);
		// The app exists and we have the variables, now to check if the user exists.
		$q = 'SELECT * FROM `users` WHERE `key`=\''.$userkey.'\'';
		$res = mysql_query($q) or die(mysql_error());
		$resc = mysql_num_rows($res);
		if($resc == 1) {
			$user = mysql_fetch_array($res);
			// The user exists and we have the variables, now to check if the user hasn't already bought the app.
			$games = explode(',', $user['gameid']);
			foreach($games as $g) {
				if($g == $game['gameid']) {
					// The user has already bought the game, abort.
					$xml = new SimpleXMLElement('<info></info>');
					$xml->addChild('api_key', $apikey);
					$xml->addChild('secret_key', $game['secretkey']);
					$xml->addChild('status', 'error 1');
					$xml->addChild('error', 'The user has already bought the application');
					header('Content-type: text/xml');
					echo $xml->asXML();
					die();
				}
			}
			// The user hasn't bought the app before, now to register the app.
			$games = $user['gameid'];
			if($games == '') {
				$g = $game['gameid'];
			} else {
				$g = $games + ',' + $game['gameid'];
			}
			$q = "UPDATE `users` SET `gameid`='".$g."' WHERE `id`=".$user['id'].";";
			mysql_query($q) or die(mysql_error());
			// The app has been registered as being bought by the user, now to output the success XML
			$xml = new SimpleXMLElement('<info></info>');
			$xml->addChild('api_key', $apikey);
			$xml->addChild('secret_key', $game['secretkey']);
			$xml->addChild('firstname', $user['firstname']);
			$xml->addChild('lastname', $user['lastname']);
			$xml->addChild('email', $user['email']);
			$xml->addChild('status', 'success');
		} else {
			// This application doesn't exist.
			$xml = new SimpleXMLElement('<info></info>');
			$xml->addChild('api_key', $apikey);
			$xml->addChild('secret_key', $game['secretkey']);
			$xml->addChild('status', 'error 2');
			$xml->addChild('error', 'The user doesn\'t exist');
		}
	} else {
		// This application doesn't exist.
		$xml = new SimpleXMLElement('<info></info>');
		$xml->addChild('api_key', $apikey);
		$xml->addChild('secret_key', $game['secretkey']);
		$xml->addChild('status', 'error 3');
		$xml->addChild('error', 'This application doesn\'t exist');
	}
}
header('Content-type: text/xml');
echo $xml->asXML();