First Commit

paypal_checkout_create_order.php

@@ -0,0 +1,145 @@
+<?php
+/**
+ * PayPal Checkout - Create Order Endpoint
+ * 
+ * Called by the PayPal JS SDK when user clicks the PayPal button.
+ * Creates a PayPal order with amount from session/database (server-side validation).
+ * 
+ * Returns JSON: { "id": "PAYPAL_ORDER_ID" } or { "error": "message" }
+ */
+
+header('Content-Type: application/json');
+
+// Start session if not already started
+if (session_status() === PHP_SESSION_NONE) {
+    session_start();
+}
+
+// Include database and required files
+// Adjust this path if your db.php is elsewhere
+if (file_exists(__DIR__ . '/db.php')) {
+    require_once __DIR__ . '/db.php';
+}
+
+require_once __DIR__ . '/paypal_checkout_api.php';
+
+try {
+    // =========================================================================
+    // IMPORTANT: Get amount from SERVER-SIDE (database/session), NOT from client
+    // This prevents users from tampering with the payment amount
+    // =========================================================================
+    
+    // Method 1: If you have school_num and user_num in session (like your existing flow)
+    // Only use this branch if the db helpers are available in the current app.
+    if (
+        isset($_SESSION['UserInfo']['record_num']) &&
+        isset($_SESSION['SchoolInfo']['record_num']) &&
+        function_exists('db_getVal') &&
+        function_exists('db_query') &&
+        function_exists('db_num_rows') &&
+        function_exists('db_fetch_array') &&
+        (function_exists('db_fetch_assoc') || function_exists('db_fetch_array')) &&
+        function_exists('db_insert_id')
+    ) {
+        $user_num = intval($_SESSION['UserInfo']['record_num']);
+        $school_num = intval($_SESSION['SchoolInfo']['record_num']);
+        
+        // Get balance from database (same query as payment_form.php)
+        $balance = db_getVal("SELECT SUM(transaction_amount) as balance FROM user_account WHERE school_num = $school_num AND user_num = $user_num AND (deleted != 'Y' OR deleted IS NULL)");
+        if (!$balance) $balance = 0.00;
+        
+        // Get school record for PayPal settings
+        // Some codebases use db_fetch_assoc, others use db_fetch_array
+        $schoolQuery = db_query("SELECT * FROM schools WHERE record_num = $school_num");
+        if (function_exists('db_fetch_assoc')) {
+            $school_record = db_fetch_assoc($schoolQuery);
+        } else {
+            $school_record = db_fetch_array($schoolQuery);
+        }
+        
+        // Calculate transaction fee (same as payment_form.php)
+        $trx_fee = intval($balance * $school_record['paypal_percentage']) / 100 + $school_record['paypal_fee'];
+        $owing = $balance + $trx_fee;
+        
+        // Get or create TRX number (same logic as payment_form.php)
+        $now = time();
+        $trx_time = date("Y-m-d H:i:s", $now);
+        
+        $query = "SELECT * FROM user_online_payments WHERE school_num = $school_num AND user_num = $user_num AND status = 'Pending'";
+        $results = db_query($query);
+        
+        if (db_num_rows($results) > 0) {
+            $row = db_fetch_array($results);
+            $trxnum = $row['record_num'];
+            $query = "UPDATE user_online_payments SET user_account_balance = $balance, transaction_fee = $trx_fee, balance_owing = $owing, transaction_datetime = '$trx_time', transaction_time = $now WHERE school_num = $school_num AND user_num = $user_num AND status = 'Pending'";
+            db_query($query);
+        } else {
+            $query = "INSERT INTO user_online_payments (school_num, user_num, transaction_datetime, transaction_time, user_account_balance, transaction_fee, balance_owing, status) VALUES ($school_num, $user_num, '$trx_time', $now, $balance, $trx_fee, $owing, 'Pending')";
+            db_query($query);
+            $trxnum = db_insert_id();
+        }
+        
+        $currency = $school_record['paypal_currency'] ?: PAYPAL_CURRENCY;
+        $description = $school_record['school_name'] . " Order Payment";
+        
+    }
+    // Method 2: Fallback - use session variables if set directly
+    else if (isset($_SESSION['paypal_checkout_amount']) && isset($_SESSION['paypal_checkout_trxnum'])) {
+        $owing = floatval($_SESSION['paypal_checkout_amount']);
+        $trxnum = intval($_SESSION['paypal_checkout_trxnum']);
+        $currency = $_SESSION['paypal_checkout_currency'] ?? PAYPAL_CURRENCY;
+        $description = $_SESSION['paypal_checkout_description'] ?? 'Order Payment';
+    }
+    // Method 3: For testing/demo - use POST data (NOT recommended for production)
+    else if (isset($_POST['amount']) && isset($_POST['trxnum'])) {
+        // WARNING: In production, ALWAYS validate this against your database
+        $owing = floatval($_POST['amount']);
+        $trxnum = intval($_POST['trxnum']);
+        $currency = $_POST['currency'] ?? PAYPAL_CURRENCY;
+        $description = $_POST['description'] ?? 'Order Payment';
+        
+        // You should validate that this trxnum exists and the amount matches!
+        // This is just for demo purposes
+    }
+    else {
+        throw new Exception('No payment information found. Please ensure you are logged in.');
+    }
+    
+    // Validate amount
+    if ($owing <= 0) {
+        throw new Exception('Invalid payment amount: ' . $owing);
+    }
+    
+    // Create PayPal order
+    $paypal = new PayPalCheckoutAPI();
+    $order = $paypal->createOrder($owing, $currency, $description, strval($trxnum));
+
+    // Store order ID in session for verification during capture
+    $_SESSION['paypal_order_id'] = $order['id'];
+    $_SESSION['paypal_order_trxnum'] = $trxnum;
+    $_SESSION['paypal_order_amount'] = $owing;
+
+    // Approve link — where the redirect-based button sends the buyer to
+    // log in to PayPal and approve the payment (not used by the JS SDK
+    // button flow, which drives approval in its own popup/iframe instead).
+    $approveUrl = '';
+    foreach (($order['links'] ?? []) as $link) {
+        if (($link['rel'] ?? '') === 'approve') {
+            $approveUrl = $link['href'];
+            break;
+        }
+    }
+
+    // Return order ID (used by the PayPal JS SDK button) and approve URL
+    // (used by the plain themed button's redirect flow)
+    echo json_encode([
+        'id' => $order['id'],
+        'approveUrl' => $approveUrl
+    ]);
+    
+} catch (Exception $e) {
+    http_response_code(500);
+    echo json_encode([
+        'error' => $e->getMessage()
+    ]);
+}