0

I'm very new to programming and I'm in school and we have a project where we need to create a website for a fake company. We have been given a database to use and have to integrate a payment system. We have decided to use mollie. I have use to standard example payment creation and it works fine but now I want to get the data from the order into my database. I've used a html form to get the information needed and now only need to get it into the database and this is how I've tried but no success yet.

$mail_err=$firstname_err=$lastname_err=$city_err=$phone_err=$postal_err=$adres_err="";
$mail_err=$firstname=$lastname=$city=$phone=$postal=$adres="";
if(isset($_POST['Betalen'])) {
    if(empty(trim($_POST['firstname']))){
        $firstname_err = "Voer een voornaam in";
    } else{
        if(!ctype_alpha(str_replace(array(' ', "'", '-'),'',$_POST['firstname']))){
            $firstname_err="De voornaam mag alleen letters bevatten m.u.v. ' en -";
        } else{
            $firstname=$_POST['firstname'];
        }
    }
    if(empty(trim($_POST['lastname']))){
        $lastname_err = "Voer een achternaam in";
    } else{
        if(!ctype_alpha(str_replace(array(' ', "'", '-'),'',$_POST['lastname']))){
            $lastname_err="De achternaam mag alleen letters bevatten m.u.v. ' en -";
        } else{
            $lastname=$_POST['lastname'];
        }
    }
    if(empty(trim($_POST['mail']))){
        $mail_err = "Voer een emailadres in";
    } else{
        $email=$_POST['email'];
    }
    if(empty(trim($_POST['city']))){
        $city_err = "Voer een stad in";
    } else{
        $city=$_POST['city'];
    }
    if(empty(trim($_POST['adres']))){
        $adres_err = "Voer een adres in";
    } else{
        $adres=$_POST['adres'];
    }
    if(empty(trim($_POST['postcode']))){
        $postal_err = "Voer een postcode in";
    } else{
        if(PostcodeCheck($_POST['postcode']) == false){
            $postal_err="Ongeldige postcode";
        } else{
            $postal=$_POST['postcode'];
        }
    }
    if(trim(!ctype_digit($_POST['phone']))){
        $phone_err="Voer alleen cijfers in bijvoorbeeld 0612345678";
    } else{
        $phone=$_POST['phone'];
    }
    if(empty($mail_err) && empty($firstname_err) && empty($lastname_err) && empty($city_err) && empty($phone_err) && empty($postal_err) && empty($adres_err)) {
        try {
            /*
             * Initialize the Mollie API library with your API key.
             *
             * See: https://www.mollie.com/dashboard/developers/api-keys
             */
            require "initialize.php";

            /*
             * Generate a unique order id for this example. It is important to include this unique attribute
             * in the redirectUrl (below) so a proper return page can be shown to the customer.
             */
            $orderId = time();
            $total = $_POST['total'];
            /*
             * Determine the url parts to these example files.
             */
            $protocol = isset($_SERVER['HTTPS']) && strcasecmp('off', $_SERVER['HTTPS']) !== 0 ? "https" : "http";
            $hostname = $_SERVER['HTTP_HOST'];
            $path = dirname(isset($_SERVER['REQUEST_URI']) ? $_SERVER['REQUEST_URI'] : $_SERVER['PHP_SELF']);

            /*
             * Payment parameters:
             *   amount        Amount in EUROs. This example creates a € 10,- payment.
             *   description   Description of the payment.
             *   redirectUrl   Redirect location. The customer will be redirected there after the payment.
             *   webhookUrl    Webhook location, used to report when the payment changes state.
             *   metadata      Custom metadata that is stored with the payment.
             */
            $payment = $mollie->payments->create([
                "amount" => [
                    "currency" => "EUR",
                    "value" => "$total" // You must send the correct number of decimals, thus we enforce the use of strings
                ],
                "description" => "Order #{$orderId}",
                "redirectUrl" => "{$protocol}://{$hostname}{$path}/return.php?order_id={$orderId}",
                "webhookUrl" => "{$protocol}://{$hostname}{$path}/payments/webhook.php",
                "metadata" => [
                    "order_id" => $orderId,
                ],
            ]);

            /*
             * In this example we store the order with its payment status in a database.
             */

            mysqli_query($conn, "INSERT INTO ordersprivate (OrderID, orderstatus, price, email, first_name, last_name, adres, postal, city, phone) VALUES ($orderId,$status,$total,$email,$firstname,$lastname,$adres,$postal,$city,$phone)");
//($conn, $orderId, $payment->status, $total, $email, $firstname, $lastname, $adres, $postal, $city, $phone);
            /*
            $sql1 = "INSERT INTO ordersprivate (OrderID, orderstatus, price, email, first_name, last_name, adres, postal, city, phone) VALUES (?,?,?,?,?,?,?,?,?,?)";
            if($stmt1=mysqli_prepare($conn,$sql1)) {
                mysqli_stmt_bind_param($stmt1, "isssssssss", $param_OrderID, $param_status, $param_price, $param_email, $param_firstname, $param_lastname, $param_adres, $param_postal, $param_city, $param_phone);
                $param_email=$email;
                $param_OrderID=$orderId;
                $param_status=$status;
                $param_price=$total;
                $param_firstname=$firstname;
                $param_lastname=$lastname;
                $param_adres=$adres;
                $param_postal=$postal;
                $param_city=$city;
                $param_phone=$phone;
                mysqli_stmt_execute($stmt1);

            } */

            /*
             * Send the customer off to complete the payment.
             * This request should always be a GET, thus we enforce 303 http response code
             */
            header("Location: " . $payment->getCheckoutUrl(), true, 303);
        } catch (\Mollie\Api\Exceptions\ApiException $e) {
            echo "API call failed: " . htmlspecialchars($e->getMessage());
        }
    }

You can see I've tried a couple different solutions but the data never gets stored in the database. I'm probably stupid and overlooking something. I've made sure the connection to the database is working and it is stored in a different file with the variable $conn and it works everywhere else.

Thanks in advance, Niels van Dijk

  • Is `$mail_err` on the second line supposed to be `$email`? – Barmar Jan 04 '20 at 00:31
  • You need quotes around the string values in the query. But it would be better to learn how to use prepared statements. – Barmar Jan 04 '20 at 00:32
  • 1
    See https://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php – Barmar Jan 04 '20 at 00:32
  • @Barmar They did try a prepared statement. Look through their code again and you'll see some of it was commented out. – Funk Forty Niner Jan 04 '20 at 01:34
  • 1
    The commented code should work. I'm not sure why you need all those `$param_XXX` variables, just bind to the original variables. – Barmar Jan 04 '20 at 01:38

0 Answers0