Module-Simple-billing/modules/simple-billing/add_to_cart.php

<?php
/*
 *
 * OGP - Open Game Panel
 * Copyright (C) 2008 - 2010 The OGP Development Team
 *
 * http://www.opengamepanel.org/
 *
 * This program is free software; you can redistribute it and/or
 * modify it under the terms of the GNU General Public License
 * as published by the Free Software Foundation; either version 2
 * of the License, or any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program; if not, write to the Free Software
 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
 *
 */

function exec_ogp_module()
{
	global $db;
	$settings = $db->getSettings();
	
	//This must be add to re-connection with database.
	require('includes/config.inc.php');
	
	/*
	The service id should also be cast to an int, 
	or checked if it's numeric before used in the WHERE clause... otherwise an SQL error is possible currently.
	If it's not an int (or if it's 0 after casting) redirect to the shop page.
	*/	
	$service_id = intval($_REQUEST['service_id']);
	if ($service_id <= 0){
		$view->refresh("home.php?m=simple-billing&p=buy");
		return;
	}
	
	// Query for Selected service info.
	$qry_service = "SELECT DISTINCT service_id, home_cfg_id, mod_cfg_id, service_name, remote_server_id, slot_max_qty, slot_min_qty, price_hourly, price_monthly, price_year, description, img_url FROM ".$table_prefix."billing_services WHERE service_id=".$service_id;
	$result_service = $db->resultQuery($qry_service);		
	$row_service = $result_service[0];
	//Compiling info about invoice to create an invoice order.

	// remote server value
	$remote_server_id = $row_service['remote_server_id'];

	// request ogp user to create a home path.
	$r_server = $db->getRemoteServer($remote_server_id);
	$ogp_user = $r_server['ogp_user'];

	// request the user name and the game name to generate a game home name.
	$home_name = $_POST['home_name'];

	//Calculating Price
	if ($_POST['invoice_duration'] == "hour")
	{
		$price_slot=$row_service['price_hourly'];
	}
	elseif ($_POST['invoice_duration'] == "month")
	{
		$price_slot=$row_service['price_monthly'];
	}
	elseif ($_POST['invoice_duration'] == "year")
	{
		$price_slot=$row_service['price_year']*12;
	}
	else
	{
		$price_slot=$row_service['price_monthly'];
	}
	
	
	//Game Server Values
	$ip_id = $_POST['ip_id'];
	$ip = $db->getIpById($ip_id);
	$max_players = $_POST['max_players'];
	$qty = $_POST['qty'];
	$invoice_duration = $_POST['invoice_duration'];
	$user_id = $_SESSION['user_id'];
	$remote_control_password = $_POST['remote_control_password'];
	$ftp_password = $_POST['ftp_password'];
	$tax_amount = $settings['tax_amount'];
	$currency = $settings['currency'];
	
	/*
	Cast $_REQUEST['service_id'] to an int and then check if its value is higher than 0 before using it in the WHERE clause.
	Checking if it's higher than 0 because if it's a non-numeric value, after casting it to an int it'll be 0.
	*/	
	if(isset($service_id)) $where_service_id = " WHERE service_id=".$service_id; else $where_service_id = "";
	$qry_services = "SELECT * FROM OGP_DB_PREFIXbilling_services".$where_service_id;
	$services = $db->resultQuery($qry_services);			
	foreach ($services as $key => $row) {	
	if($max_players < $row['slot_min_qty'] || $qty < 1){
		$max_players = $row['slot_min_qty'];
		$qty = 1;
		}
	/*
	An extra check added for the inverse: check max_players against slot_max_qty. 
	It would be good to do in the event someone is only selling a max of 16 slots per server.
	*/
	elseif ($max_players > $row['slot_max_qty'])
		{
		$max_players = $row['slot_max_qty'];	
		}
	}
	
	$price = $max_players*$price_slot*$qty;
	
	global $view;
		
	if( isset( $_POST["add_to_cart"] ) )
	{
		if( isset( $_SESSION['CART'] ) )
		{
			$i = count( $_SESSION['CART'] );
			$i++;
		}
		else
		{
			$i = 0;
		}
		
		$_SESSION['CART'][$i] = array( "cart_id" => $i,
									   "service_id" => $service_id,
									   "home_name" => $home_name, 
									   "ip" => $ip_id,
									   "max_players" => $max_players, 
									   "qty" => $qty, 
									   "invoice_duration" => $invoice_duration, 
									   "price" => $price, 
									   "remote_control_password" => $remote_control_password, 
									   "ftp_password" => $ftp_password,
									   "tax_amount" => $tax_amount,
									   "currency" => $currency,
									   "paid" => 0);
		echo '<meta http-equiv="refresh" content="0;url=?m=simple-billing&amp;p=cart">';
	}
}
?>