php..free account help

<?
require_once("conn.php");
require_once("includes.php");

if(empty($_GET[SelectedPackage]))
{
	header("location:prices.php?e=1&PaymentGateway=$_GET[PaymentGateway]");
}
elseif(empty($_GET[PaymentGateway]))
{
	header("location:prices.php?e=2&SelectedPackage=$_GET[SelectedPackage]");
}
else
{
	//get the price details
	$q1 = "select * from re2_prices where PriceID = '$_GET[SelectedPackage]' ";
	$r1 = mysql_query($q1) or die(mysql_error());
	$a1 = mysql_fetch_array($r1);

	//update the advertiser's record/credits
	$aexp =  mktime(0,0,0,date(m) + $a1[Duration],date(d),date(Y));

	//set the expire date
	//$q1 = "update re2_agents set PriorityLevel = '$a1[PriorityLevel]', offers = '$a1[offers]', ExpDate = '$aexp' where AgentID = '$_SESSION[AgentID]' ";
	//mysql_query($q1) or die(mysql_error());

	//get the agent details
	$q1 = "select * from re2_agents where AgentID = '$_SESSION[AgentID]' ";
	$r1 = mysql_query($q1) or die(mysql_error());
	$a1 = mysql_fetch_array($r1);

	//get the price details
	$q2 = "select * from re2_prices, re2_priority where re2_prices.PriceID = '$_GET[SelectedPackage]' and re2_prices.PriorityLevel = re2_priority.PriorityLevel ";
	$r2 = mysql_query($q2) or die(mysql_error());
	$a2 = mysql_fetch_array($r2);

	if($_GET[PaymentGateway] == "paypal")
	{
		//paypal post
		header("location:https://www.paypal.com/xclick?business=$aset[PayPalEmail]&item_name=$a2[PackageName] for $a1[FisrtName] $a1[LastName] ($a1[username])&first_name=$a1[FirstName]&last_name=$a1[LastName]&email=$a1[email]&item_number=1&custom=$_SESSION[AgentID]|$_GET[SelectedPackage]&amount=$a2[PriceValue]&currency_code=GBP&notify_url=$site_url/notify.php&return=$site_url");


		exit();

	}
	elseif($_GET[PaymentGateway] == "stormpay")
	{
		header("location:https://www.stormpay.com/stormpay/handle_gen.php?generic=1&vendor_email=$aset[sp_vendor_email]&payee_email=$aset[sp_payee_email]&transaction_ref=$_SESSION[AgentID]|$_GET[SelectedPackage]&product_name=$a2[PackageName] for $a1[FisrtName] $a1[LastName] ($a1[username])&amount=$a2[PriceValue]&require_IPN=1&notify_URL=$site_url/sp_notify.php&return_URL=$site_url");

		exit();
	}
	elseif($_GET[PaymentGateway] == "2checkout")
	{
		// 2checkout redirect
		header("location:https://www.2checkout.com/cgi-bin/sbuyers/cartpurchase.2c?sid=$aset[SellerID]&total=$a2[PriceValue]&cart_order_id=$_SESSION[AgentID]|$_GET[SelectedPackage]&card_holder_name=$a1[FirstName] $a1[LastName]&email=$a1[email]&phone=$a1[phone]");
	}
	else
	{
		//manual

		//send an email to the admin
		$to = $aset[ContactEmail];
		$subject = "Manual Service Activation Request";
		$message = "A client has selected Manual Service Activation\nHere are the details:\n\n";
		$message .= "Username: $a1[username]\nNames: $a1[FirstName] $a1[LastName]\nSelected Package: $a2[PackageName] $a2[PriorityName], $a2[Duration] months, $a2[offers] offers\n\n";

		$headers = "MIME-Version: 1.0\n";
		$headers .= "Content-type: text/plain; charset=iso-8859-1\n";
		$headers .= "Content-Transfer-Encoding: 8bit\n";
		$headers .= "From: $_SERVER[HTTP_HOST] <$aset[ContactEmail]>\n";
		$headers .= "X-Priority: 1\n";
		$headers .= "X-MSMail-Priority: High\n";
		$headers .= "X-Mailer: PHP/" . phpversion()."\n";

		mail($to, $subject, $message, $headers);

		//get the templates
		require_once("templates/HeaderTemplate.php");
		require_once("templates/ManualTemplate.php");
		require_once("templates/FooterTemplate.php");
	}

}

?>

<?php

// IPN validation modes, choose: 1 or 2

$postmode=1;

           //* 1 = Live Via PayPal Network
           //* 2 = Test Via EliteWeaver UK



// Debugger, 1 = on and 0 = off

$debugger=0;



// Convert super globals on older php builds

	if (phpversion() <= '4.0.6')
	{
		$_SERVER = ($HTTP_SERVER_VARS);
		$_POST = ($HTTP_POST_VARS); }



// No ipn post means this script does not exist

	if (!@$_POST['txn_type'])
	{
		@header("Status: 404 Not Found"); exit; }

	else
	{
		@header("Status: 200 OK");  // Prevents ipn reposts on some servers



// Add "cmd" to prepare for post back validation
// Read the ipn post from paypal or eliteweaver uk
// Fix issue with php magic quotes enabled on gpc
// Apply variable antidote (replaces array filter)
// Destroy the original ipn post (security reason)
// Reconstruct the ipn string ready for the post


		$postipn = 'cmd=_notify-validate'; // Notify validate

	foreach ($_POST as $ipnkey => $ipnval)
	{
	if (get_magic_quotes_gpc())
		$ipnval == stripslashes ($ipnval); // Fix issue with magic quotes
	if (!eregi("^[_0-9a-z-]{1,30}£",$ipnkey)
	|| !strcasecmp ($ipnkey, 'cmd'))
	{ // ^ Antidote to potential variable injection and poisoning
	unset ($ipnkey); unset ($ipnval); } // Eliminate the above
	if (@$ipnkey != '') { // Remove empty keys (not values)
		@$_PAYPAL[$ipnkey] = $ipnval; // Assign data to new global array
	unset ($_POST); // Destroy the original ipn post array, sniff...

		$postipn.='&'.@$ipnkey.'='.urlencode(@$ipnval); }} // Notify string
		$error=0; // No errors let's hope it's going to stays like this!



// IPN validation mode 1: Live Via PayPal Network

	if ($postmode == 1)
	{
		$domain = "www.paypal.com"; }

// IPN validation mode 2: Test Via EliteWeaver UK

	elseif ($postmode == 2)
	{
		$domain = "www.eliteweaver.co.uk"; }

// IPN validation mode was not set to 1 or 2

	else
	{
		$error=1;
		$bmode=1;
	if ($debugger) debugInfo(); }


@set_time_limit(60); // Attempt to double default time limit incase we switch to Get



// Post back the reconstructed instant payment notification

		$socket = @fsockopen($domain,80,$errno,$errstr,30);
		$header = "POST /cgi-bin/webscr HTTP/1.0\r\n";
		$header.= "User-Agent: PHP/".phpversion()."\r\n";
		$header.= "Referer: ".$_SERVER['HTTP_HOST'].
		$_SERVER['PHP_SELF'].@$_SERVER['QUERY_STRING']."\r\n";
		$header.= "Server: ".$_SERVER['SERVER_SOFTWARE']."\r\n";
		$header.= "Host: ".$domain.":80\r\n";
		$header.= "Content-Type: application/x-www-form-urlencoded\r\n";
		$header.= "Content-Length: ".strlen($postipn)."\r\n";
		$header.= "Accept: */*\r\n\r\n";

//* Note: "Connection: Close" is not required using HTTP/1.0



// Problem: Now is this your firewall or your ports?

            if (!$socket && !$error)
            {

// Switch to a Get request for a last ditch attempt!

		$getrq=1;

	if (phpversion() >= '4.3.0'
	&& function_exists('file_get_contents'))
	{} // Checking for a new function
	else
	{ // No? We'll create it instead

function file_get_contents($ipnget) {
		$ipnget = @file($ipnget);
	return $ipnget[0];
		}}

                   $response = @file_get_contents('http://'.$domain.':80/cgi-bin/webscr?'.$postipn);

	if (!$response)
	{
		$error=1;
		$getrq=0;

	if ($debugger) debugInfo();
	// If this is as far as you get then you need a new web host!
			}}



// If no problems have occured then we proceed with the processing

	else
	{
		@fputs ($socket,$header.$postipn."\r\n\r\n"); // Required on some environments
	while (!feof($socket))
	{
		$response = fgets ($socket,1024); }}
		$response = trim ($response); // Also required on some environments



// uncomment '#' to assign posted variables to local variables
#extract($_PAYPAL); // if globals is on they are already local

// and/or >>>

// refer to each ipn variable by reference (recommended)
// $_PAYPAL['receiver_email']; etc... (see: ipnvars.txt)



// IPN was confirmed as both genuine and VERIFIED

	if (!strcmp ($response, "VERIFIED"))
	{
		if(variableAudit('payment_status','Completed'))
		{
			include_once("conn.php");

			$GetInfo = explode("|", $_PAYPAL[custom]);
			$_SESSION[AdvertiserID] = $GetInfo[0];
			$PriceID = $GetInfo[1];

			//get the price details
			$q1 = "select * from re2_prices where PriceID = '$PriceID' ";
			$r1 = mysql_query($q1) or die(mysql_error());
			$a1 = mysql_fetch_array($r1);

			//update the advertiser's record/credits
			$aexp =  mktime(0,0,0,date(m) + $a1[Duration],date(d),date(Y));

			//$_SESSION[AccountExpireDate] = $aexp;
			//$_SESSION[AccountStatus] = "active";
			//$_SESSION[MaxOffers] = $a1[offers];

			$_SESSION[AgentID] = "";

			$q2 = "update re2_agents set ExpDate = '$aexp', AccountStatus = 'active', PriorityLevel = '$a1[PriorityLevel]', offers = '$a1[offers]' where AgentID = '$GetInfo[0]' ";
			mysql_query($q2) or die(mysql_error());

		}
	}
// Check that the "payment_status" variable is: Completed
// If it is Pending you may want to inform your customer?
// Check your db to ensure this "txn_id" is not a duplicate
// You may want to check "payment_gross" or "mc_gross" matches listed prices?
// You definately want to check the "receiver_email" or "business" is yours
// Update your db and process this payment accordingly

//***************************************************************//
//* Tip: Use the internal auditing function to do some of this! *//
//* **************************************************************************************//
//* Help: if(variableAudit('mc_gross','0.01') &&					 *//
//* 	     variableAudit('receiver_email','paypal@domain.com') && 			 *//
//* 	     variableAudit('payment_status','Completed')){ $do_this; } else { do_that; } *//
//****************************************************************************************//




// IPN was not validated as genuine and is INVALID

	elseif (!strcmp ($response, "INVALID"))
	{

// Check your code for any post back validation problems
// Investigate the fact that this could be a spoofed IPN
// If updating your db, ensure this "txn_id" is not a duplicate

		//connect to database
		include_once("conn.php");

		//delete the order info 1
		$q1 = "delete from devbg_orders where OrderID = '$_PAYPAL[custom]' ";
		mysql_query($q1) or die(mysql_error());

		$q1 = "delete from devbg_orders_content where OrderID = '$_PAYPAL[custom]' ";
		mysql_query($q1) or die(mysql_error());

	}



	else
	{ // Just incase something serious should happen!
			}}

	if ($debugger) debugInfo();



#########################################################
#     Inernal Functions : variableAudit & debugInfo     #
#########################################################



// Function: variableAudit
// Easy LOCAL to IPN variable comparison 
// Returns 1 for match or 0 for mismatch

function variableAudit($v,$c)
{
	global  $_PAYPAL;
    if (!strcasecmp($_PAYPAL[$v],$c)) 
    { return 1; } else { return 0; } 
} 



// Function: debugInfo
// Displays debug info 
// Set $debugger to 1

function debugInfo()
{
	global  $_PAYPAL,
		$postmode,
		$socket,
		$error,
		$postipn,
		$getrq,
		$response;

		$ipnc = strlen($postipn)-21;
		$ipnv = count($_PAYPAL)+1;

	@flush();
	@header('Cache-control: private'."\r\n");
	@header('Content-Type: text/plain'."\r\n");
	@header('Content-Disposition: inline; filename=debug.txt'."\r\n");
	@header('Content-transfer-encoding: ascii'."\r\n");
	@header('Pragma: no-cache'."\r\n");
	@header('Expires: 0'."\r\n\r\n");
	echo '#########################################################'."\r\n";
	echo '#    Copyright © EliteWeaver UK All rights reserved.    #'."\r\n";
	echo '#########################################################'."\r\n";
	echo '#              END USER LICENCE AGREEMENT               #'."\r\n";
	echo '# Redistribution and  use in source and/or binary forms #'."\r\n";
	echo '# with or without  modification, are permitted provided #'."\r\n";
	echo '# that the above copyright notice is  reproduced in the #'."\r\n";
	echo '# script, documentation and/or any other materials that #'."\r\n";
	echo '# may  have been provided in the original distribution. #'."\r\n";
	echo '#########################################################'."\r\n";
	echo '# <-- PayPal IPN Variable Output & Status Debugger! --> #'."\r\n";
	echo '#########################################################'."\r\n\r\n";
	if (phpversion() >= '4.3.0' && $socket)
	{
	echo 'Socket Status: '."\r\n\r\n";
	print_r (socket_get_status($socket));
	echo "\r\n\r\n"; }
	echo 'PayPal IPN: '."\r\n\r\n";
	print_r($_PAYPAL);
	echo "\r\n\r\n".'Validation String: '."\r\n\r\n".wordwrap($postipn, 64, "\r\n", 1);
	echo "\r\n\r\n\r\n".'Validation Info: '."\r\n";
	echo "\r\n\t".'PayPal IPN String Length Incoming => '.$ipnc."\r\n";
	echo "\t".'PayPal IPN String Length Outgoing => '.strlen($postipn)."\r\n";
	echo "\t".'PayPal IPN Variable Count Incoming => ';
	print_r(count($_PAYPAL));
	echo "\r\n\t".'PayPal IPN Variable Count Outgoing => '.$ipnv."\r\n";
	if ($postmode == 1)
	{
	echo "\r\n\t".'IPN Validation Mode => Live -> PayPal, Inc.'; }
	elseif ($postmode == 2)
	{
	echo "\r\n\t".'IPN Validation Mode => Test -> EliteWeaver.'; }
	else
	{
	echo "\r\n\t".'IPN Validation Mode => Incorrect Mode Set!'; }
	echo "\r\n\r\n\t\t".'IPN Validate Response => '.$response;
	if (!$getrq && !$error)
	{
	echo "\r\n\t\t".'IPN Validate Method => POST (success)'."\r\n\r\n"; }
	elseif ($getrq && !$error)
	{
	echo "\r\n\t\t".'IPN Validate Method => GET (success)'."\r\n\r\n"; }
	elseif ($bmode)
	{
	echo "\r\n\t\t".'IPN Validate Method => NONE (stupid)'."\r\n\r\n"; }
	elseif ($error)
	{
	echo "\r\n\t\t".'IPN Validate Method => BOTH (failed)'."\r\n\r\n"; }
	else
	{
	echo "\r\n\t\t".'IPN Validate Method => BOTH (unknown)'."\r\n\r\n"; }
	echo '#########################################################'."\r\n";
	echo '#    THIS SCRIPT IS FREEWARE AND IS NOT FOR RE-SALE!    #'."\r\n";
	echo '#########################################################'."\r\n\r\n";
	@flush();

}


// Terminate the socket connection (if open) and exit

	@fclose ($socket); exit;


#########################################################
#    Copyright © EliteWeaver UK All rights reserved.    #
#########################################################
#              END USER LICENCE AGREEMENT               #
# Redistribution and  use in source and/or binary forms #
# with or without  modification, are permitted provided #
# that the above copyright notice is  reproduced in the #
# script, documentation and/or any other materials that #
# may  have been provided in the original distribution. #
#########################################################
#    THIS SCRIPT IS FREEWARE AND IS NOT FOR RE-SALE!    #
#########################################################

?>

if($_GET[PaymentGateway] == "paypal")
{
//paypal post
header("location:https://www.paypal.com/xclick?business=$aset[PayPalEmail]&item_name=$a2[PackageName] for $a1[FisrtName] $a1[LastName] ($a1[username])&first_name=$a1[FirstName]&last_name=$a1[LastName]&email=$a1[email]&item_number=1&custom=$_SESSION[AgentID]|$_GET[SelectedPackage]&amount=$a2[PriceValue]&currency_code=GBP&notify_url=$site_url/notify.php&return=$site_url");


exit();

}
elseif($_GET[PaymentGateway] == "stormpay")
{
header("location:https://www.stormpay.com/stormpay/handle_gen.php?generic=1&vendor_email=$aset[sp_vendor_email]&payee_email=$aset[sp_payee_email]&transaction_ref=$_SESSION[AgentID]|$_GET[SelectedPackage]&product_name=$a2[PackageName] for $a1[FisrtName] $a1[LastName] ($a1[username])&amount=$a2[PriceValue]&require_IPN=1&notify_URL=$site_url/sp_notify.php&return_URL=$site_url");

exit();
}

if($_GET[PaymentGateway] == "paypal")
{
//paypal post
header("location:https://www.paypal.com/xclick?business=$aset[PayPalEmail]&item_name=$a2[PackageName] for $a1[FisrtName] $a1[LastName] ($a1[username])&first_name=$a1[FirstName]&last_name=$a1[LastName]&email=$a1[email]&item_number=1&custom=$_SESSION[AgentID]|$_GET[SelectedPackage]&amount=$a2[PriceValue]&currency_code=GBP&notify_url=$site_url/notify.php&return=$site_url");


exit();

}
elseif($_GET[PaymentGateway] == "stormpay")
{
header("location:https://www.stormpay.com/stormpay/handle_gen.php?generic=1&vendor_email=$aset[sp_vendor_email]&payee_email=$aset[sp_payee_email]&transaction_ref=$_SESSION[AgentID]|$_GET[SelectedPackage]&product_name=$a2[PackageName] for $a1[FisrtName] $a1[LastName] ($a1[username])&amount=$a2[PriceValue]&require_IPN=1&notify_URL=$site_url/sp_notify.php&return_URL=$site_url");

exit();
}
elseif($_GET[PaymentGateway] == "free")
{
header("location:http://www.yoursite.com/path/to/service/page");
//Give the path where you send visitor after successful payment, in case you charge money
exit();
}

if($_GET[PaymentGateway] == "paypal")
{
//paypal post
header("location:https://www.paypal.com/xclick?business=$aset[PayPalEmail]&item_name=$a2[PackageName] for $a1[FisrtName] $a1[LastName] ($a1[username])&first_name=$a1[FirstName]&last_name=$a1[LastName]&email=$a1[email]&item_number=1&custom=$_SESSION[AgentID]|$_GET[SelectedPackage]&amount=$a2[PriceValue]&currency_code=GBP&notify_url=$site_url/notify.php&return=$site_url");


exit();

}
elseif($_GET[PaymentGateway] == "stormpay")
{
header("location:https://www.stormpay.com/stormpay/handle_gen.php?generic=1&vendor_email=$aset[sp_vendor_email]&payee_email=$aset[sp_payee_email]&transaction_ref=$_SESSION[AgentID]|$_GET[SelectedPackage]&product_name=$a2[PackageName] for $a1[FisrtName] $a1[LastName] ($a1[username])&amount=$a2[PriceValue]&require_IPN=1&notify_URL=$site_url/sp_notify.php&return_URL=$site_url");

exit();
}
elseif($_GET[PaymentGateway] == "free")
{
header("location:http://www.yoursite.com/path/to/service/page");
//Give the path where you send visitor after successful payment, in case you charge money
exit();
}

if(empty($_GET[SelectedPackage]))
{
header("location:prices.php?e=1&PaymentGateway=$_GET[PaymentGateway]");
}
elseif(empty($_GET[PaymentGateway]))
{
header("location:prices.php?e=2&SelectedPackage=$_GET[SelectedPackage]");
}
elseif(($_GET[SelectedPackage]=="sdf")
{
header("location:http://www.officelets.net/notify.php");
}
else

if ($price > 0) {
  // your stuff I am not going to read
} else {
  // "sale" for free
  // do not go to paypal!
  // instead send a mail
  mail();
}

error_reporting(E_ALL); ini_set('display_errors', '1');