creating auto destroy function in php

Question

I am creating a functionality called tentative booking.

When a user books a ticket, he is given a temporary pnr-number and he should be given about 10 minutes to perform his payment.

If he fails to pay within 10 minutes, the transaction should be cancelled. Otherwise a success-message should be displayed.

Please ignore the logic for the payment. It can be any method.

I'm generating the temporary pnr-number and storing it into the database.

I can't understand how should I proceed here.

Is there any functionality in php which I can use for this?

Here is my code :

    $pnr = getPnr();
        echo "You temporarary pnr num is : $pnr <br>";
    echo "Check you mail and save it for future use";
    if($book_ticket == 'true')
    {       DoTentativeBooking($userid,$book_ticket,$from,$to,$date,$pnr,$seats,$email);

    }
function DoTentativeBooking($userid,$book_ticket,$from,$to,$date,$pnr,$seats,$email)
{
        $con = mysqli_connect('server', 'user', 'password', 'database');                
        if (mysqli_connect_errno())
        {
        echo "Failed to connect to MySQL: " . mysqli_connect_error();
            return;
        }
        $insertQuery1 = "INSERT INTO tbl_user(`user_id`,`book_ticket`,`from`,`to`,`date`,`user_pnr`,`seat`,`email`,`isConfirm`) VALUES ('".$userid."','".$book_ticket."','".$from."','".$to."','".$date."','".$pnr."','".$seats."','".$email."','No')";
        if (!mysqli_query($con,$insertQuery1))
            {
            //  die('Error: ' . mysqli_error($con));
                echo "error";
            }       
        return; 
}

I hope none of parameters of `DoTentativeBooking` directly come from `$_GET` or `$_POST`, because your query seem vunerable to SQL injection. — Antonio Ragagnin, Mar 31 '14 at 13:30
@AntonioRagagnin if `$_GET or $_POST` can't be used than how to get data?? — Nishant Solanki, Mar 31 '14 at 13:33
It can be used, but you're injecting your data directly into your query string, use MySQL parameters instead. — Brovoker, Mar 31 '14 at 13:34
You should really change your database credentials, as you have published them in your question!!! — vanMartijn, Mar 31 '14 at 13:34
server or client side? client side js+ajax server side background php or sql job — VeNoMiS, Mar 31 '14 at 13:35
I suggest you tu use `prepared-statements` to perform queries: http://it1.php.net/pdo.prepared-statements — Antonio Ragagnin, Mar 31 '14 at 13:36
@NishantSolanki, maybe I didn't used right technical language, I meant, I hope the author didn't used something like `$user=$_GET['user']`. A solution would be `$user=mysql_escape_string ($_GET['user'])` — Antonio Ragagnin, Mar 31 '14 at 13:40
@AntonioRagagnin mysql_escape_string isn't safe ad it's deprecated — VeNoMiS, Mar 31 '14 at 13:42
@AntonioRagagnin @VeNoMiS ... i would say `$_GET` isnt safe either.. for this type of apps `session and post variables` are best.. :P — Nishant Solanki, Mar 31 '14 at 13:48
@VeNoMiS: mysqli_escape_string(), any issue with this? I have still not switched to pdo — , Mar 31 '14 at 14:22

deceze · Answer 1 · 2014-03-31T14:25:36.883

3

Save a timestamp of when the order was created and/or when it expires together with the order in the database.
Set some flag that you're awaiting payment, e.g. set the status column to "awaiting_payment" or whatever, in the database.
Whenever handling any orders, filter them by their status flag/handle them accordingly.
On the payment confirmation page, when flipping the status to "paid", check the expiration timestamp.

In other words, you're not doing anything at a specific time or are expiring anything at a specific time. You simply save enough information that lets you figure out at any time when you need it what the status of the order is.

edited Mar 31 '14 at 14:25

answered Mar 31 '14 at 13:28

deceze

510,633
85
743
889

this logic I understand, i am facing probelm how to give time of 10 minutes. Any php code snippet will help me more – Mar 31 '14 at 13:31
1

What's the exact problem? Creating a timestamp 10 minutes in the future? Checking if the current time is before or after a timestamp? – deceze Mar 31 '14 at 13:38
yes, waiting for 10 minutes for some action. If that does not occur withing stipulated time, so transaction failed – Mar 31 '14 at 14:19
1

So, what is the concrete problem? Saving the timestamp into the database when you insert the order? Comparing the saved timestamp to the current time when you're about to accept or reject the payment? – deceze Mar 31 '14 at 14:20
Do i need to save it in db? I am not sure. Consider checking `isPaymentCompleted` variable in database after 10 minutes, if this is set to no, then display error message – Mar 31 '14 at 14:24
I saved in database, but now do I need to check it continously? how to do it – Mar 31 '14 at 14:43
1

You have obviously *not* understood the logic. Please try to read the individual rules I wrote again one by one. – deceze Mar 31 '14 at 14:48

Nishant Solanki · Accepted Answer · 2014-03-31T17:45:16.857

-1

you can try this...

set a time variable while you are setting temporary pnr number..

$date = new DateTime();
$time1 = $date->getTimestamp(); // this will give you current timestamp..

and put a checking condition in header like..

$time2 = $date->getTimestamp();
if(round(abs($time1 - $time2) / 60,2) >= 10)
{
   unset($pnr);
}

edited Mar 31 '14 at 17:45

answered Mar 31 '14 at 13:30

Nishant Solanki

2,119
3
19
32

What happens if they start at 1:56 then don't go to the checkout page until 2:24? Your value would be -32 and it wouldn't be kicked out. – Pitchinnate Mar 31 '14 at 13:51
-32 is not less than -50 your edit doesn't make it any better. – Pitchinnate Mar 31 '14 at 13:53
3

You need to use a complete timestamp and calculate the number of seconds (and convert it to minutes if needed) as @deceze has recommended above. – Pitchinnate Mar 31 '14 at 13:55
@Pitchinnate yeah you are right.. let me edit my answer.. Thanks btw :) – Nishant Solanki Mar 31 '14 at 13:58
@NishantSolanki How can set condition which keep checking timestamp exiperation? – Mar 31 '14 at 14:27
@cyclic I will suggest you to use javascript and ajax... call one ajax file every minute(or whatever you want) using `javascript's timer() function..` – Nishant Solanki Mar 31 '14 at 17:43
1

@cyclic this will help you out... http://stackoverflow.com/questions/4542863/jquery-ajax-call-with-timer... – Nishant Solanki Mar 31 '14 at 17:53

creating auto destroy function in php

2 Answers2