PHP stopping tamper data in html form -


back story: hey, i've @ few , couldn't quit find fix this, user's been spoofing value $price let's $5 firefox addon tamper data can change $_post value whatever wish $0.01, i'm trying prevent this.

code:

<?php $price = "5.00"; ?> <input type="hidden" name="cmd" value="_donations">     <input type="hidden" name="upload" value="1">     <input type="hidden" name="business" value="paypal@email.com">     <input type="hidden" name="item_name" value="ap">     <input type="hidden" name="amount" value="<?php if($price != "5.00") { $price = "5.00"; echo $price; } else { echo $price; } ?>">     <input type="hidden" name="notify_url" value="/ipn/ipn.php?user=<?php echo $username; ?>"index.php?thank=yes">     <input type="hidden" name="cancel_return" value="index.php">     <input type="hidden" name="custom" value="<?php echo $username; ?>">     <input class="button" type="submit" name="pp" value="buy subscription" /> <?php if (isset($_post['pp'])) { if($price != "5.00") { $price = "5.00"; echo $price . " debug: scammer"; } else { echo $price . " nothing found"; } } ?>

you can't influence - form sent directly paypal, , never touches server.

you should check in ipn notification php script whether amount received matches amount expecting, , take whatever steps necessary if doesn't.


-

Comments

Post a Comment

Popular posts from this blog

php - regexp cyrillic filename not matches -

i take list of files php glob(."*.pdf") . files have cyrillic names. example: ООО «Рога и копыта» then load company names database , try find them in file names: preg_match("/$firm_name/ui", $file_name, $match); i have problem: firms if $firm_name visually similar $file_name , preg_match says there no match. mb_detect_encoding both variables return utf-8. there problem in file name, or maybe there encoding or something, can not understand, ask help. upd: $file_name='ООО «Рога и копыта»'; preg_match("/... .Рога и копыта./ui", $file_name, $match); as result, ОО «Рога и копыта» , 1 О missing
Read more

c# - OpenXML hanging while writing elements -

Image
i have program pulls data database, caches file , exports data multiple formats (excel, excel 2003, csv). i'm using openxml sdk 2.0 excel work. these export processes run in parallel (using parallel.foreach ), , amount of data can pretty large - e.g. csvs 800mb. during these larger exports, i've noticed writing of xml documents hang. instance, if have 8 exporting in parallel, @ point "pause". hang around same point: //this.writer openxmlwriter created worksheetpart. this.writer.writeelement(new cell() { cellvalue = new cellvalue(value), datatype = cellvalues.string }); when happens, pause debugger (vs2013 in case) , notice threads blocking around same portion of code - bit deeper in openxml sdk - stem call openxmlwriter.writeelement . i dug through source using justdecompile didn't find answers. appears there intermediary stream in use writing isolated storage , is, reason, blocking. underlying stream each of these filestream . here screenshot ...
Read more

sql - Select Query has unexpected multiple records (MS Access) -

i may tired, can't seem figure out happening. have 2 queries. query 1 has 10 fields. query 2 has 5 fields. fields 1 through 3 same in both queries. trying write select query , simple add field 5 query2 query1 result should query1 additional field (query2.field5). i join first 3 fields both queries , choose select records in query1 , in query2 match. don't know sql, use query designer. expect same number of records have query 1 instead have 3 times or more. can tell me doing wrong. tried reversing joins still seem same records. thanks in advance. here query: the fields in common divisionname , supplierid = vendorid , commodityname . select [part revenue exposed query p1].divisionname, [part revenue exposed query p1].commodityname, [part revenue exposed query p1].suppliername, [part revenue exposed query p1].partnumber, [part revenue exposed query p1].partdescription, [part revenue exposed query p1].bucode, ...
Read more