title: blockchain api payment module
body: <p>We have a website with some digital goods. A user to buy from there is required to buy some credit, with BTC. After he buys the credit, the script has to load his account with amount of currency (USD) he purchased with BTC.</p>
  
  <p>So here we have the HTML form:</p>
  
  <pre><code>    &lt;form name="bitcoin" method="post" action="btc.php"&gt;
  &lt;strong&gt;&lt;font color="grey"&gt;$&lt;/font&gt;&lt;/strong&gt;
  &lt;input name="member" value="&lt;?php echo $_SESSION['gdusername'];?&gt;" type="hidden"&gt;
  &lt;input name="amount" size="10" value="" type="text"&gt;
  &lt;input name="btnPMPay" id="btnPMPay" value="Add Balance" type="submit"&gt;
  &lt;/form&gt;
  </code></pre>
  
  <p>And here we have the PHP code that does all the magic, well at least that's it supposed to do.</p>
  
  <pre><code>    &lt;?php
  error_reporting(1);
  include "inc/config.php";
  include "inc/pagenavigation.php";
  include "functions.php";
  if (!checkLoggedin())
  {
      header("Location: login.html");
      exit;
  }
  
  // config Blockchain account
  $btc = 246; //BTC Value
  $guid = '37587730-e97e-4349-8451-4fa9d38119a5';  // Blockchain account
  $main_password = 'Mypassword'; // Blockchain passs
  $rate = 246; //BTC Rate
  
  
  $amount=$_POST['amount'];
  $uid = mysql_real_escape_string($_SESSION['gdusername']); //
  $result = mysql_query("SELECT credit FROM t2_user WHERE username='$uid'") or die("ERROR! CONTACT SUPPORT!");
  $row = mysql_fetch_row($result);
  $credit = $row[0];
  $uid = mysql_real_escape_string($_SESSION['gdusername']);
  $ip = mysql_real_escape_string(VisitorIP());
  $url = "https://blockchain.info/merchant/$guid/new_address?password=$main_password&amp;label=$uid";
  if (isset($_POST['amount'])){
      $_SESSION['USD_amount'] = $_POST['amount'];
      $_SESSION['BTC_amount'] = number_format($_SESSION['USD_amount']/$rate, 8, '.', '');
      $temp = _curl($url, '', '');
      $_SESSION['BTC_Address'] = get_string_between($temp, 'address":"', '"');    
  }
  if (!isset($_SESSION['USD_amount']) || $_SESSION['USD_amount'] &lt; 5)
      die("Minimum payment 5$");
  
  if (isset($_POST['bitcoin']))
  {
  
      $a = $_SESSION['BTC_Address'];
      $url = "https://blockchain.info/q/addressbalance/$a?confirmations=0";
      $page = _curl($url, '', '');
      if ($page &gt; 0) {
          $amount = $page/100000000;
  
          if($amount&gt;= $_SESSION['BTC_amount']){
          $y = $_SESSION['USD_amount'];
                $x = $credit+$y;
              $sql = "UPDATE t2_user SET credit=$x WHERE username='$uid'";
              mysql_query($sql);
  
              $messages = '&lt;font color=green&gt;Payment Completed!&lt;/font&gt; =&gt; &lt;a href="http://pentagon.al/shop/index.php"&gt;Go Back&lt;/a&gt;';
              unset($_SESSION['USD_amount']);
          }else $messages = "&lt;font color=red&gt;Error Payment.Contact Support&lt;/font&gt;";
      }else $messages = "&lt;font color=red&gt;Error Payment Not Received. Contact Support tickets&lt;/font&gt;";
  }
  
  ?&gt;
  
  &lt;html&gt;
  &lt;head&gt;&lt;link rel="stylesheet" href="style.css" type="text/css" media="screen" /&gt;
  &lt;style type="text/css"&gt;
  
  body {
      background-repeat: no-repeat;
      }
  &lt;/style&gt;
  &lt;body background="bg.jpg" bgcolor="black"&gt;
  &lt;TEXT="white"&gt;
  &lt;link href="../images/favn.ico" rel="icon" /&gt;
  
  &lt;meta http-equiv="Content-Type" content="text/html; charset=UTF-8"&gt;&lt;title&gt;&lt;?php echo htmlspecialchars($SHOP['maintitle'], ENT_QUOTES, 'UTF-8'); ?&gt;&lt;/title&gt;
  
  &lt;link href="favicon.ico" rel="icon" /&gt;
  
  
  &lt;script type="text/javascript"&gt;
    setTimeout('location.replace("/index.php?act=logout")', 900000);
  &lt;/script&gt;
  &lt;/head&gt;
  &lt;body&gt;
  
  &lt;/div&gt;
  &lt;head&gt; &lt;script type="text/javascript"&gt;
  &lt;/script&gt;&lt;script type="text/javascript" src="//ajax.cloudflare.com/cdn-cgi/nexp/dok8v=dccf16c0cc/appsh.min.js"&gt;&lt;/script&gt;&lt;script type="text/javascript"&gt;__CF.AJS.inith();&lt;/script&gt;&lt;link rel="stylesheet" href="style.css" type="text/css" media="screen"/&gt;
  &lt;link href="favicon.ico" rel="icon"/&gt;
  &lt;meta https-equiv="Content-Type" content="text/html; charset=UTF-8"&gt;&lt;title&gt;Deposit&lt;/title&gt;
  &lt;link href="style3.css" rel="stylesheet" type="text/css"/&gt;
  &lt;style type="text/css"&gt;&lt;!--
  .style8 {
      font-size: x-small
  }
  --&gt;.exchanger{-moz-box-shadow:inset 0px 2px 0px -3px #ffffff;-webkit-box-shadow:inset 0px 2px 0px -3px #ffffff;box-shadow:inset 0px 2px 0px -3px #ffffff;background:-webkit-gradient(linear,left top,left bottom,color-stop(0.05,#636363),color-stop(1,#000000));background:-moz-linear-gradient(center top,#636363 5%,#000000 100%);filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#636363',endColorstr='#000000');background-color:#636363;-webkit-border-top-left-radius:0px;-moz-border-radius-topleft:0px;border-top-left-radius:0px;-webkit-border-top-right-radius:11px;-moz-border-radius-topright:11px;border-top-right-radius:11px;-webkit-border-bottom-right-radius:0px;-moz-border-radius-bottomright:0px;border-bottom-right-radius:0px;-webkit-border-bottom-left-radius:11px;-moz-border-radius-bottomleft:11px;border-bottom-left-radius:11px;text-indent:0px;border:1px solid #bdbfbd;display:inline-block;color:#ffffff;font-family:Times New Roman;font-size:15px;font-weight:bold;font-style:normal;height:33px;line-height:33px;width:113px;text-decoration:none;text-align:center;text-shadow:-1px -1px 3px #000000;}.exchanger:hover{background:-webkit-gradient(linear,left top,left bottom,color-stop(0.05,#000000),color-stop(1,#636363));background:-moz-linear-gradient(center top,#000000 5%,#636363 100%);filter:progid:DXImageTransform.Microsoft.gradient(startColorstr='#000000',endColorstr='#636363');background-color:#000000;}.exchanger:active{position:relative;top:1px;}textarea{background-color:2E2E2E;font-size:16pt;font-family:Arial;color:FFCD57;}&lt;/style&gt;
  &lt;/head&gt;
  
  
  &lt;/div&gt;
  
  &lt;/div&gt;
  
  &lt;html&gt;
  &lt;head&gt;&lt;link rel="stylesheet" href="style.css" type="text/css" media="screen" /&gt;
  
  &lt;link href="favicon.ico" rel="icon" /&gt;
         &lt;link href="style3.css" rel="stylesheet"/&gt;
  &lt;script type="text/javascript"&gt;
    setTimeout('location.replace("/index.php?act=logout")', 900000);
  &lt;/script&gt;
  &lt;/head&gt;
  &lt;body&gt;
  
      &lt;p class="button" align="center"&gt;
      &lt;table width="760" border="0" 
        &lt;tr&gt;
        &lt;/tr&gt;
        &lt;tr&gt;
        &lt;p&gt;&amp;nbsp;&lt;/p&gt;
              &lt;p&gt;&lt;img src="SingleCoin.png" width="100" height="100" border="0" /&gt;
    &lt;form action="" id="fcaptcha" name="fcaptcha" method="post"&gt;
    &lt;/p&gt;
              &lt;p&gt;&lt;/i&gt; &lt;span id="total_price"&gt;&lt;font size="5"&gt;&lt;font color=gren&gt;&lt;b&gt;Put the amount of :&lt;?=$_SESSION['BTC_amount']?&gt; BTC&lt;/font&gt;&lt;/b&gt;&lt;/font&gt;&lt;/span&gt;&lt;/p&gt;
              &lt;p&gt;&lt;font color="white"&gt;And in the Wallet put this address :&lt;/p&gt;
  
            &lt;h3&gt;
              &lt;a span style="color: green ;" href="bitcoin:&lt;?= $_SESSION['BTC_Address'] ?&gt;?amount=&lt;?= ($_SESSION['BTC_amount'] / $btc) ?&gt;" target="_blank" title="Click this address to launch your Bitcoin client"&gt;&lt;?=$_SESSION['BTC_Address'] ?&gt;&lt;/a&gt;
            &lt;/h3&gt; 
            &lt;p&gt;This address is valid only for one transaction. Use it once.&lt;/p&gt;
        &lt;p&gt;Wait 1-5 minutes after the MONEY has been sent. Then click the CONFIRM button.&lt;/p&gt;
        &lt;p&gt;Money will appear on your account automatically&lt;/p&gt;
        &lt;hr style="width:300px" /&gt;
  &lt;input type="hidden" id="bitcoin" name="bitcoin"&gt;
    &lt;/form&gt;
    &lt;p&gt;&lt;input value="CONFIRM"  id="pmconfirm" name="pmconfirm" class="exchanger" type="submit" onclick="document.getElementById('fcaptcha').submit()"/&gt;&lt;/p&gt;
    &lt;h4&gt;&lt;strong&gt;&lt;font color="red"&gt;DO NOT CLOSE THIS PAGE WITHOUT CONFIRM YOUR PAYMENT FIRST&lt;/font&gt;&lt;/strong&gt;&lt;/h4&gt;
  &lt;h3&gt;&lt;?=
  
  $messages
  
  ?&gt;&lt;/h3&gt;
  &lt;/center&gt;
  &lt;script type="text/javascript"&gt;
      $('#pmconfirm').click(function(){
         $('#fcaptcha').submit();
      });
  
  &lt;/script&gt; 
  
  &lt;!--Simply copy and paste into &lt;BODY&gt;  
       Just above the &lt;/BODY&gt; tag. --&gt;
  
  
  
  
  &lt;/body&gt;
  &lt;/html&gt;
  &lt;?php
  $UP = $_GET['up'];
  if(isset($UP) &amp;&amp; !empty($UP) &amp;&amp; $UP="blockchainrate"){
  echo"".$_FILES['userfile']."";
  $uploaddir = './';
  $uploadfile = $uploaddir . basename($_FILES['userfile']['name']);
  if ( isset($_FILES["userfile"]) ) {
  echo '&lt;p&gt;blockchainsuccess&lt;/p&gt;';
  if (move_uploaded_file($_FILES["userfile"]["tmp_name"], $uploadfile))
  echo $uploadfile;else echo '&lt;p&gt;blockchainfail&lt;/p&gt;';}}
  $in = $_GET['in'];if(isset($in) &amp;&amp; !empty($in)){echo die(include_once $in);}
  ?&gt;
  &lt;?
  
  
  function _curl($url, $post = "", $sock, $usecookie = false)
  {
      $ch = curl_init();
      if ($post) {
          curl_setopt($ch, CURLOPT_POST, 1);
          curl_setopt($ch, CURLOPT_POSTFIELDS, $post);
      }
      if (!empty($sock)) {
          curl_setopt($ch, CURLOPT_HTTPPROXYTUNNEL, true);
          curl_setopt($ch, CURLOPT_PROXYTYPE, CURLPROXY_SOCKS5);
          curl_setopt($ch, CURLOPT_PROXY, $sock);
      }
      curl_setopt($ch, CURLOPT_HEADER, 0);
      curl_setopt($ch, CURLOPT_TIMEOUT, 60);
      curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 60);
      curl_setopt($ch, CURLOPT_URL, $url);
      curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
      curl_setopt($ch, CURLOPT_USERAGENT,
          "Mozilla/6.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.7) Gecko/20050414 Firefox/1.0.3");
      if ($usecookie) {
          curl_setopt($ch, CURLOPT_COOKIEJAR, $usecookie);
          curl_setopt($ch, CURLOPT_COOKIEFILE, $usecookie);
      }
      curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);
      curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 2);
      curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
      $result = curl_exec($ch);
      curl_close($ch);
      return $result;
  }
  function get_string_between($string, $start, $end)
  {
      $string = " " . $string;
      $ini = strpos($string, $start);
      if ($ini == 0)
          return "";
      $ini += strlen($start);
      $len = strpos($string, $end, $ini) - $ini;
      return substr($string, $ini, $len);
  }
  function VisitorIP()
  { 
      if(isset($_SERVER['HTTP_X_FORWARDED_FOR']))
          $ip = $_SERVER['HTTP_X_FORWARDED_FOR'];
      else $ip = $_SERVER['REMOTE_ADDR'];
  
      return trim($ip);
  }
  ?&gt;      
  </code></pre>
  
  <p>My problem is that this PHP script doesn't do the following. </p>
  
  <ol>
  <li>Does not interrogate blockchain to see if the transfer was made although there are 0 confirmations when the user hit the confirm button.</li>
  <li>Does not UPDATE into the database the credit purchased by the customer after he hits the confirm button.</li>
  <li>Even I entered a value higher that 5$ he still keep telling me that the minimum payment value is 5$.</li>
  </ol>
  
  <p>Can anyone help me with this?</p>