API SMS - #66568

<?php

//POST vs GET?

    if($_GET){

   // Filtracja przesłanych danych


    if(isset($_GET['key'])==0){

    die("Brak klucz api!
");

    }

    if(isset($_GET['pay'])==0){

    die("Brak klucza platnosci!
");

    }

    if(isset($_GET['buyer'])==0){

    $buyer = NULL;

    }else{

    $buyer = urldecode($_GET['buyer']);}

    if(isset($_GET['code'])==0){

    die("Brak kodu do sprawdzenia!
");

    }

    $code = $_GET['code'];

    if(!preg_match("/^[A-Za-z0-9]{8}$/",$code)){

    die("Zly format kodu!
");

    }




        try{

        $servername = "localhost";

        $username = "root";

        $password = "T45R52g2";

        $dbname = "sms";


        $dbHandle = new PDO("mysql:host=$servername;dbname=$dbname", $username, $password);

        //echo 'Połączenie nawiązane!
';

        //$dbHandle->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);

            }

    catch (PDOException $e)

        {

        //$dbHandle = null;

        die("Błąd połączenia z bazą!: " . $e->getMessage() . "
");

        }


        //pobiera id z klucza api

        $statement = $dbHandle->prepare('SELECT id FROM api_key WHERE aut = :key');

        $statement->bindValue(':key', $_GET['key'], PDO::PARAM_STR);

        $statement->execute();

        //czy zwraca

        if($statement->rowCount() != 1){$dbHandle  = null; $statement->closeCursor(); die("Błędny klucz  API!
");}


        foreach($statement as $row)

        $iduser = $row['id'];

        $statement->closeCursor();

        //echo 'Dobry klucz API! '.$iduser.'
';


        //sprawdza poprawnosc i istnienie pay

        $statement = $dbHandle->prepare('SELECT inter FROM api_sms_pay WHERE id = :pay');

        $statement->bindValue(':pay', $_GET['pay'], PDO::PARAM_INT);

        $statement->execute();

        //czy zwraca

        if($statement->rowCount() != 1){$dbHandle  = null; $statement->closeCursor(); die("Błędny klucz platnosci!
");}


        foreach($statement as $row)

        $inter = $row['inter'];

        $statement->closeCursor();

        //echo 'Dobry klucz platnosci! Inter = '.$inter.'
';





                        // 0 - HomePay 1 - CashBill

            switch ($inter) {

                case 0:

                    $statement = $dbHandle->prepare('SELECT id_acc, cost FROM api_sms_pay WHERE id = :pay');

                $statement->bindValue(':pay', $_GET['pay'], PDO::PARAM_INT);

                $statement->execute();

                foreach($statement as $row){

                $acc = $row['id_acc'];

                $cost = $row['cost'];

                }

                $statement->closeCursor();

                                 /*KOD MA WYKONYWAC PO DOSTARCZENIU CODE*/

                    $handle=fopen("http://homepay.pl/API/check_code.php?usr_id=3078 &acc_id=".$acc."&code=".$code,'r');

                    $check=fgets($handle,8);

                    fclose($handle); //dotad ok!!

                        //$check=1; //debug

                    switch($check){

                        case 0:

                            die("0"); //Nieprawidlowy kod

                            break;

                        case 1:


                            $cost*=0.47; //normalnie 48%


                            $statement = $dbHandle->prepare('INSERT INTO api_sms_history (id_user, code, buyer, cost) VALUES (:id, :code, :buyer, :cost)');

                        $statement->bindValue(':buyer', $buyer, PDO::PARAM_STR);

                        $statement->bindValue(':code', $code, PDO::PARAM_STR);

                        $statement->bindValue(':cost', $cost, PDO::PARAM_INT);

                        $statement->bindValue(':id', $iduser, PDO::PARAM_INT);

                        $statement->execute();


                            $statement = $dbHandle->prepare('SELECT wallet1 FROM konta WHERE id = :id');

                        $statement->bindValue(':id', $iduser, PDO::PARAM_INT);

                        $statement->execute();

                        foreach($statement as $row)

                        $wallet1 = $row['wallet1'];


                        $wallet1+=$cost;


                            $statement = $dbHandle->prepare("UPDATE konta SET wallet1=:wallet1 WHERE  id = :id");

                        $statement->bindValue(':id', $iduser, PDO::PARAM_INT);

                        $statement->bindValue(':wallet1', $wallet1, PDO::PARAM_INT);

                        $statement->execute();



                            $dbHandle = null; die ("1"); //powodzenie platnosci

                            break;

                        case 2:

                        $dbHandle = null; die ("1"); //powodzenie platnosci

                        break;

                        default:

                            $dbHandle = null; die("Niepowodzenie płatności"); //niepowodzenie platnosci

                            break;

                        }

                    break;

                case 1:

                        $statement = $dbHandle->prepare('SELECT sufix, numer, cost FROM api_sms_pay WHERE id = :pay');

                $statement->bindValue(':pay', $_GET['pay'], PDO::PARAM_INT);

                $statement->execute();

                foreach($statement as $row){

                $sufix = $row['sufix'];

                $numer = $row['numer'];

                $cost = $row['cost'];

                }

                $statement->closeCursor();

                                 /*KOD MA WYKONYWAC PO DOSTARCZENIU CODE*/

                    $idcb = '';  # kod referencyjny (ref)

                    $txt = urlencode('ag.'.$sufix); # pelny prefiks kodów bezobslugowych

                    $handle=fopen("http://sms.cashbill.pl/backcode_check_fulloutput.php?id=".$idcb."&code=".$txt."&check=".$code."", 'r');

                    $status = fgets($handle, 8);

                    $czas_zycia = fgets($handle, 24);

                    $foo = fgets($handle, 96); //tresc

                    $bramka = fgets($handle, 96); //nr na ktory wyslano

                    fclose($handle); //dotad ok!!


                    //echo $numer.'='.$bramka.'';


                         if($status == '0')

 {

die("0"); //Nieprawidlowy kod

 }

 else

 {

    if($numer!=$bramka){unset($numer); $dbHandle = null; die("Nie oszukuj");}


// kod prawidlowy

    $cost*=0.49; //normalnie 50%


                            $statement = $dbHandle->prepare('INSERT INTO api_sms_history (id_user, code, buyer, cost) VALUES (:id, :code, :buyer, :cost)');

                        $statement->bindValue(':buyer', $buyer, PDO::PARAM_STR);

                        $statement->bindValue(':code', $code, PDO::PARAM_STR);

                        $statement->bindValue(':cost', $cost, PDO::PARAM_INT);

                        $statement->bindValue(':id', $iduser, PDO::PARAM_INT);

                        $statement->execute();


                            $statement = $dbHandle->prepare('SELECT wallet1 FROM konta WHERE id = :id');

                        $statement->bindValue(':id', $iduser, PDO::PARAM_INT);

                        $statement->execute();

                        foreach($statement as $row)

                        $wallet1 = $row['wallet1'];


                        $wallet1+=$cost;


                            $statement = $dbHandle->prepare("UPDATE konta SET wallet1=:wallet1 WHERE  id = :id");

                        $statement->bindValue(':id', $iduser, PDO::PARAM_INT);

                        $statement->bindValue(':wallet1', $wallet1, PDO::PARAM_INT);

                        $statement->execute();



                        $dbHandle = null; die ("1"); //powodzenie platnosci

 }


                    break;

            }


        } else {

            $dbHandle = null; die("Błąd danych klienta!");

        }

$dbHandle = null;
>[/code]