Php help

[HellBoy 229]

Hello recently tryed to switch to SupperReward payment sistem all goes well till i tryed to configure the postback wich i failed like few hundrets of time to do it 

 

 

this is how i stand now 

<?php
/*
	SuperRewards.com App Postback Handling Script for Publishers.
	You will need a web server running PHP and a MySQL database (or MySQL-like database). 
	This script uses PHP's PDO which can be configured to use different database types.
	Installation Instructions:
	1. Fill in the configuration options below.
	2. Place the script on your web server and make sure it is accessible from the Internet. 
		Ex: http://www.example.com/app/postback.php
	3. Automatically setup the database tables for use with this script by passing the setup option in the URL. 
		Ex: http://www.example.com/app/postback.php?setup=1 
	4. Test your integration by sending a Test Postback. 
		See: http://support.playerize.com/entries/22612522-Publishers-Signing-Up-and-Getting-Started#postback_test
	5. Use the information in the database to award in-game currency to your users.
	For more details, see our documentation at: 
	http://support.playerize.com/entries/22612522-Publishers-Signing-Up-and-Getting-Started
*/
define('APP_SECRET', 'TheKey'); // App Secret Key. Find it by going to the Apps page, select Edit on the App of your choice, then Integrate.
define('DB_USER', 'MyUser'); // Your database user.
define('DB_PASSWORD', 'MyPassword'); // Your database password.
define('DB_HOST', '127.0.0.1'); // Your database host (usually 127.0.0.1).
define('DB_HOST_PORT', 'MyPort'); // Your database host port (usually 3306).
define('DB_NAME', 'account'); // Your database name.
define('DB_PREFIX', 'app1_'); // OPTIONAL: A database table prefix, such as 'app1_'. This easily allows multiple apps to be served from the same database.
error_reporting(E_WARNING);
// *** No more configuration below this line. ***
header('Content-Type:text/plain');
// If &setup is passed in, setup tables needed to use this script.
if(isset($_REQUEST['setup']))
{
	$query = 
	"CREATE TABLE IF NOT EXISTS `".DB_PREFIX."transactions` (
	`id` INT NOT NULL,
	`uid` BIGINT,
	`oid` INT,
	`new` INT,
	`time` DATETIME,
	PRIMARY KEY (`id`)) 
	CHARACTER SET utf8 COLLATE utf8_general_ci;
	CREATE TABLE IF NOT EXISTS `".DB_PREFIX."users` (
	`uid` BIGINT NOT NULL,
	`total` INT,
	`time` DATETIME,
	PRIMARY KEY (`uid`)) 
	CHARACTER SET utf8 COLLATE utf8_general_ci;";
	try 
	{
		// Connect to Database.
		$dbh = new PDO("mysql:host=".DB_HOST.";dbname=".DB_NAME.";port=".DB_HOST_PORT, DB_USER, DB_PASSWORD, array( PDO::ATTR_ERRMODE => PDO::ERRMODE_WARNING ));
		$query = $dbh->prepare($query);
		if(!$query->execute())
			echo "Could not create tables in database: ".DB_NAME." @ ".DB_HOST.'. Check your configuration above.';
		else
			echo "Tables setup successfully!";
		$dbh = null;
	}
	catch (PDOException $e) 
	{
		exit($e->getMessage());
	}
	exit();
}
$id = $_REQUEST['id']; // ID of this transaction.
$uid = $_REQUEST['uid']; // ID of the user which performed this transaction. 
$oid = $_REQUEST['oid']; // ID of the offer or direct payment method.
$new = $_REQUEST['new']; // Number of in-game currency your user has earned by completing this offer.
$total = $_REQUEST['total']; // Total number of in-game currency your user has earned on this App.
$sig = $_REQUEST['sig']; // Security hash used to verify the authenticity of the postback.
/**
 * Sanity check.
 *
 * If you are using alphanumeric user ids, remove the is_numeric($uid) check. Alphanumeric
 * ids can only be enabled by Super Rewards Support
 *
 * If you are using alphanumeric user ids, please ensure that you use the appropriate URL-encoding
 * for non-text or unicode characters. For example: ~ should be encoded as %7E
 */

if(!(is_numeric($id) && is_numeric($uid) && is_numeric($oid) && is_numeric($new) && is_numeric($total)))
	exit('0'); // Fail.
$result = 1;
$sig_compare = md5($id.':'.$new.':'.$uid.':'.APP_SECRET);

// Only accept if the Security Hash matches what we have.
if($sig == $sig_compare)
{
	$timestamp = date("Y-m-d H:i:s", time());
	try 
	{
		// Connect to Database.
		$dbh = new PDO("mysql:host=".DB_HOST.";dbname=".DB_NAME.";port=".DB_HOST_PORT, DB_USER, DB_PASSWORD, array( PDO::ATTR_ERRMODE => PDO::ERRMODE_WARNING ));
		// Add new transaction
		$query = $dbh->prepare("INSERT INTO ".DB_PREFIX."transactions(id, uid, oid, new, time) VALUES (:id,:uid,:oid,:new,:time) ON DUPLICATE KEY UPDATE id=:id,uid=:uid,oid=:oid,new=:new,time=:time");
		$query->bindParam(':id', $id, PDO::PARAM_INT);
		$query->bindParam(':uid', $uid, PDO::PARAM_INT);
		$query->bindParam(':oid', $oid, PDO::PARAM_INT);
		$query->bindParam(':new', $new, PDO::PARAM_INT);
		$query->bindParam(':time', $timestamp, PDO::PARAM_STR);
		if(!$query->execute())
			$result = 7; // Problems executing SQL. Fail.

		$sqlServ1 = mysql_connect('127.0.0.1','MyUser','MyPassword');
		$sqlCoins = "SELECT coins FROM account.account WHERE login='$uid'";
		$qryCoins = mysql_query($sqlCoins,$sqlServ1);
       	$getCoins = mysql_fetch_object($qryCoins);
		$ocoins = $getCoins->coins;
		$nCoins = $ocoins + $new;
		$sqlCmd1 = "UPDATE account.account SET coins = '$nCoins' WHERE login='$uid'";
		$sqlQry1 = mysql_query($sqlCmd1,$sqlServ1);

		// Add/Update user.
		$query = $dbh->prepare("INSERT INTO ".DB_PREFIX."users(uid, total, time) VALUES (:uid,:total,:time) ON DUPLICATE KEY UPDATE uid=:uid,total=:total,time=:time");
		$query->bindParam(':uid', $uid, PDO::PARAM_INT);
		$query->bindParam(':total', $total, PDO::PARAM_INT);
		$query->bindParam(':time', $timestamp, PDO::PARAM_STR);
		if(!$query->execute())
			$result = 8;  // Problems executing SQL. Fail.
		$dbh = null;
	}
	catch (PDOException $e) 
	{
		exit($e->getMessage());
	}
}
else
	$result = 9; // Security hash incorrect. Fail.
echo $result;
// This script will output a status code of 1 (Success) or 0 (Try sending again later).
?> 

I get error at sig compare if i try remove that and get it work either gives the value of coins xxx time or either doesnt reward with coins at all not talking about the table for transactions and history dont get any data

 

 

Now to fix it i dont mind paying for just wanna get it done

 

Thanks

[Ayaka 322]

I recommend that you should use the official supportsite for this problem. You are using an API, if there is an authenticity problem you should contact the supplier. I dont think there is a problem with this prefabricated script. Many other people use this too.

[HellBoy 229]

I recommend that you should use the official supportsite for this problem. You are using an API, if there is an authenticity problem you should contact the supplier. I dont think there is a problem with this prefabricated script. Many other people use this too.

 

 

 i did they made me this1 but doesnt work so i think is something wrong with it first i tought is because of aplfanumeric id removed the check and still dont work when i try run postback i get one of those errors eithher for signature check either for sql lines  when i try test it i do get the curency i send but when i use the buy functions i dont get the coins and the postback sends gives error and the support aint so helpfull i asume that can be made a shorter version of this postback to work sadly my skills dont go that far to do it 

[Ayaka 322]

I get error at sig compare if i try remove that [...]

First of all: I hope you remove it only for testing this script. If you don't compare the md5 hash, users can use security vulnerability to get coins without checking the Security Hash.

 

first i tought is because of aplfanumeric id removed the check and still dont work when i try run postback

You should use "id" for $uid not the "login" column. It cant run without errors if you didnt enabled Alphanumeric

ids by Super Rewards Support.

 

after sending only numeric uid use your SQL statement like this example:

SELECT coins FROM account.account WHERE id='$uid'

edit: Its only speculation because i cant test that script myself but give it a try.

Edited February 27, 2015 by Ayaka