<?php
  $noSession = 1;
  require("db.php");
  include("include/school-functions.php");
  include("include/logging-functions.php");
  include("include/date-time.php");
  include "table.php";

  if (!is_array($_POST) || count($_POST) == 0) {
    // $contents = file_get_contents("/m/data1/hotlunches.net/ppPayment.log");
    // echo(nl2br(htmlentities($contents)));
    // echo($contents);
    echo("Permission denied");
    exit();
  }


  $ptime = time();
  $time = date("Y-m-d H:i:s",$ptime);
  $ltime = date("Y-m-d.H.i.s",$ptime);

  // start capturing output
  //
  // NOTE: logging here must never be fatal. This runs inside the ob_start()
  // handler at script shutdown, so an error escaping this function kills the
  // response and PayPal sees a 500 and retries the IPN - even though the
  // payment itself was already processed successfully.
  function ppWriteLog($path, $contents, $mode = "w") {
    $dir = dirname($path);
    if (!is_dir($dir)) @mkdir($dir, 0775, true);
    $f = @fopen($path, $mode);
    if ($f === false) {
      error_log("ppPayment: unable to open log file $path");
      return;
    }
    @fwrite($f, $contents);
    @fclose($f);
  }

  function saveOutput($contents) {
    global $ltime, $school_num;

    // Log beside this script unless PPPAYMENT_LOGDIR overrides it, so the
    // path follows the deployment instead of being pinned to one server.
    $BASEDIR = getenv('PPPAYMENT_LOGDIR');
    if (!$BASEDIR) $BASEDIR = __DIR__;

    ppWriteLog("$BASEDIR/ppPayment.log", $contents, "w");
    ppWriteLog("$BASEDIR/ppPayment.trx.log", $contents, "a");
    ppWriteLog("$BASEDIR/logs/paypal/pp.$school_num.$ltime", $contents, "w");

    return nl2br(htmlentities($contents));
  }

  // function to execute a mysql query after echoing the query statement and return result
  function pp_query($query) {
    echo("{$query}\n");
    $r = db_query($query);
    if (stripos($query,"update") !== false || stripos($query,"insert") !== false || stripos($query,"delete") !== false) {
      $n = db_affected_rows();
      echo("Affected Rows: $n\n");
    }
    return($r);
  }

  // function to execute a mysql query after echoing the query statement and return value
  function pp_getVal($query) {
    echo("{$query}\n");
    $r = db_getVal($query);
    return($r);
  }

  function ppCacertPath() {
    $cacert = dirname(__FILE__) . '/cacert.pem';
    return is_file($cacert) ? $cacert : '';
  }

  function ppAddResolvedIp(&$ips, $ip) {
    $ip = trim($ip, "[] \t\r\n");
    if (filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4)) {
      if (!in_array($ip, $ips['v4'], true)) $ips['v4'][] = $ip;
    } elseif (filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_IPV6)) {
      if (!in_array($ip, $ips['v6'], true)) $ips['v6'][] = $ip;
    }
  }

  function ppParseDohAnswers($json) {
    $ips = array('v4' => array(), 'v6' => array());
    $data = json_decode($json, true);
    if (!is_array($data) || empty($data['Answer']) || !is_array($data['Answer'])) return $ips;
    foreach ($data['Answer'] as $ans) {
      if (empty($ans['data'])) continue;
      $type = isset($ans['type']) ? intval($ans['type']) : 0;
      if ($type === 1 || $type === 28) ppAddResolvedIp($ips, $ans['data']);
    }
    return $ips;
  }

  function ppMergeIps($into, $from) {
    if (!is_array($from)) return $into;
    foreach (array('v4', 'v6') as $k) {
      if (empty($from[$k]) || !is_array($from[$k])) continue;
      foreach ($from[$k] as $ip) ppAddResolvedIp($into, $ip);
    }
    return $into;
  }

  function ppCurlGetByIp($url, $headers = array(), $verifyTls = true) {
    if (!function_exists('curl_init')) return false;
    $ch = curl_init($url);
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
    curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 4);
    curl_setopt($ch, CURLOPT_TIMEOUT, 6);
    curl_setopt($ch, CURLOPT_HTTP_VERSION, CURL_HTTP_VERSION_1_1);
    curl_setopt($ch, CURLOPT_HTTPHEADER, $headers);
    curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, $verifyTls ? 1 : 0);
    curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, $verifyTls ? 2 : 0);
    $cacert = ppCacertPath();
    if ($cacert) curl_setopt($ch, CURLOPT_CAINFO, $cacert);
    $res = curl_exec($ch);
    curl_close($ch);
    return is_string($res) ? $res : false;
  }

  // Resolve PayPal hostnames without depending on the web server's DNS.
  // Shared hosts often have a broken resolver (curl error: Could not resolve host)
  // even though outbound HTTPS to public IPs still works.
  function ppResolveHostIps($host) {
    static $cache = array();
    if (isset($cache[$host])) return $cache[$host];

    $ips = array('v4' => array(), 'v6' => array());

    // Bypass the local resolver first. This host already fails to resolve
    // ipnpb.paypal.com / www.paypal.com through PHP cURL's DNS.
    foreach (array('1.1.1.1', '8.8.8.8') as $ns) {
      $ips = ppMergeIps($ips, ppDnsUdpA($host, $ns));
      if (!empty($ips['v4'])) break;
    }

    if (empty($ips['v4']) && empty($ips['v6'])) {
      $dohUrls = array(
        'https://1.1.1.1/dns-query?name=' . rawurlencode($host) . '&type=A',
        'https://8.8.8.8/resolve?name=' . rawurlencode($host) . '&type=A',
      );
      $dohHeaders = array('Accept: application/dns-json');
      foreach (array(true, false) as $verifyTls) {
        foreach ($dohUrls as $dohUrl) {
          $json = ppCurlGetByIp($dohUrl, $dohHeaders, $verifyTls);
          if ($json) $ips = ppMergeIps($ips, ppParseDohAnswers($json));
          if (!empty($ips['v4']) || !empty($ips['v6'])) break 2;
        }
      }
    }

    if (empty($ips['v4']) && empty($ips['v6'])) {
      if (function_exists('dns_get_record')) {
        foreach (array(DNS_A, DNS_AAAA) as $type) {
          $recs = @dns_get_record($host, $type);
          if (!is_array($recs)) continue;
          foreach ($recs as $rec) {
            if (!empty($rec['ip'])) ppAddResolvedIp($ips, $rec['ip']);
            if (!empty($rec['ipv6'])) ppAddResolvedIp($ips, $rec['ipv6']);
          }
        }
      }
      $byName = @gethostbyname($host);
      if (is_string($byName) && $byName !== $host) ppAddResolvedIp($ips, $byName);
    }

    $cache[$host] = $ips;
    return $ips;
  }

  function ppDnsSkipName($resp, $offset) {
    $len = strlen($resp);
    $jumps = 0;
    while ($offset < $len && $jumps < 10) {
      $lab = ord($resp[$offset]);
      if ($lab === 0) return $offset + 1;
      if (($lab & 0xC0) === 0xC0) return $offset + 2;
      $offset += $lab + 1;
      $jumps++;
    }
    return $offset;
  }

  function ppDnsUdpA($host, $server, $timeout = 2) {
    $ips = array('v4' => array(), 'v6' => array());
    if (!function_exists('fsockopen')) return $ips;
    $id = function_exists('random_int') ? random_int(0, 65535) : mt_rand(0, 65535);
    $qname = '';
    foreach (explode('.', $host) as $label) {
      $qname .= chr(strlen($label)) . $label;
    }
    $query = pack('n', $id) . "\x01\x00\x00\x01\x00\x00\x00\x00\x00\x00" . $qname . "\x00" . pack('nn', 1, 1);
    $errno = 0;
    $errstr = '';
    $fp = @fsockopen('udp://' . $server, 53, $errno, $errstr, $timeout);
    if (!$fp) return $ips;
    stream_set_timeout($fp, $timeout);
    fwrite($fp, $query);
    $resp = fread($fp, 512);
    fclose($fp);
    if (!is_string($resp) || strlen($resp) < 12) return $ips;
    $header = unpack('nid/nflags/nqdcount/nancount/nnscount/narcount', substr($resp, 0, 12));
    if (!$header || $header['id'] !== $id || $header['ancount'] < 1) return $ips;
    $offset = ppDnsSkipName($resp, 12) + 4;
    for ($i = 0; $i < $header['ancount'] && $offset + 10 <= strlen($resp); $i++) {
      $offset = ppDnsSkipName($resp, $offset);
      if ($offset + 10 > strlen($resp)) break;
      $rr = unpack('ntype/nclass/Nttl/nrdlength', substr($resp, $offset, 10));
      $offset += 10;
      if (!$rr) break;
      $rdlen = $rr['rdlength'];
      if ($offset + $rdlen > strlen($resp)) break;
      if ($rr['type'] === 1 && $rdlen === 4) {
        ppAddResolvedIp($ips, implode('.', unpack('C4', substr($resp, $offset, 4))));
      }
      $offset += $rdlen;
    }
    return $ips;
  }

  function ppApplyIpnCurlOpts($ch, $req) {
    curl_setopt($ch, CURLOPT_HTTP_VERSION, CURL_HTTP_VERSION_1_1);
    curl_setopt($ch, CURLOPT_POST, 1);
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
    curl_setopt($ch, CURLOPT_POSTFIELDS, $req);
    curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 1);
    curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 2);
    if (defined('CURL_SSLVERSION_TLSv1_2')) {
      curl_setopt($ch, CURLOPT_SSLVERSION, CURL_SSLVERSION_TLSv1_2);
    } else {
      curl_setopt($ch, CURLOPT_SSLVERSION, 6);
    }
    curl_setopt($ch, CURLOPT_FORBID_REUSE, 1);
    curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 8);
    curl_setopt($ch, CURLOPT_TIMEOUT, 20);
    curl_setopt($ch, CURLOPT_HTTPHEADER, array(
      'User-Agent: PHP-IPN-VerificationScript',
      'Connection: Close',
    ));
    $cacert = ppCacertPath();
    if ($cacert) curl_setopt($ch, CURLOPT_CAINFO, $cacert);
  }

  function ppIpnCurlPost($url, $req, $resolveRules = array(), $dnsServers = '', $ipresolve = 0) {
    $ch = curl_init($url);
    ppApplyIpnCurlOpts($ch, $req);
    if ($resolveRules) curl_setopt($ch, CURLOPT_RESOLVE, $resolveRules);
    if ($dnsServers !== '' && defined('CURLOPT_DNS_SERVERS')) {
      @curl_setopt($ch, CURLOPT_DNS_SERVERS, $dnsServers);
    }
    if ($ipresolve && defined('CURL_IPRESOLVE_V4')) {
      curl_setopt($ch, CURLOPT_IPRESOLVE, $ipresolve);
    }
    $res = curl_exec($ch);
    $info = array(
      'body' => $res,
      'http' => curl_getinfo($ch, CURLINFO_HTTP_CODE),
      'error' => ($res === false) ? curl_error($ch) : '',
      'primary_ip' => curl_getinfo($ch, CURLINFO_PRIMARY_IP),
    );
    curl_close($ch);
    return $info;
  }

  function ppIpnStreamPost($host, $req, $ip) {
    $remote = filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_IPV6) ? '[' . $ip . ']' : $ip;
    $ssl = array(
      'verify_peer' => true,
      'verify_peer_name' => true,
      'peer_name' => $host,
      'SNI_enabled' => true,
    );
    $cacert = ppCacertPath();
    if ($cacert) $ssl['cafile'] = $cacert;
    $errno = 0;
    $errstr = '';
    $fp = @stream_socket_client(
      'ssl://' . $remote . ':443',
      $errno,
      $errstr,
      20,
      STREAM_CLIENT_CONNECT,
      stream_context_create(array('ssl' => $ssl))
    );
    if (!$fp) {
      return array('body' => false, 'http' => 0, 'error' => "stream $ip: $errno $errstr", 'primary_ip' => $ip);
    }
    $out = "POST /cgi-bin/webscr HTTP/1.1\r\n"
         . "Host: {$host}\r\n"
         . "User-Agent: PHP-IPN-VerificationScript\r\n"
         . "Content-Type: application/x-www-form-urlencoded\r\n"
         . "Content-Length: " . strlen($req) . "\r\n"
         . "Connection: close\r\n\r\n"
         . $req;
    fwrite($fp, $out);
    stream_set_timeout($fp, 20);
    $resp = '';
    while (!feof($fp)) {
      $chunk = fread($fp, 8192);
      if ($chunk === false || $chunk === '') break;
      $resp .= $chunk;
    }
    fclose($fp);
    $headerEnd = strpos($resp, "\r\n\r\n");
    $headers = $headerEnd === false ? $resp : substr($resp, 0, $headerEnd);
    $body = $headerEnd === false ? '' : substr($resp, $headerEnd + 4);
    $http = 0;
    if (preg_match('/HTTP\/\d\.\d\s+(\d+)/', $headers, $m)) $http = intval($m[1]);
    return array('body' => $body, 'http' => $http, 'error' => '', 'primary_ip' => $ip);
  }

  function ppIpnStatusFromBody($res) {
    if (!is_string($res)) return '';
    $body = trim($res);
    if ($body === 'VERIFIED' || $body === 'INVALID') return $body;
    if (preg_match('/^(VERIFIED|INVALID)\s*$/m', $body, $m)) return $m[1];
    return '';
  }

  function ppFormatIpnAttempt($url, $info, $via) {
    return $url
      . " via=" . $via
      . " ip=" . (isset($info['primary_ip']) ? $info['primary_ip'] : '')
      . " http_code=" . $info['http']
      . " curl_error='" . $info['error'] . "'"
      . " response=" . var_export($info['body'], true);
  }

  // POST the IPN back to PayPal per
  // https://developer.paypal.com/api/nvp-soap/ipn/IPNImplementation/
  // Live:  https://ipnpb.paypal.com/cgi-bin/webscr
  // Sandbox: https://ipnpb.sandbox.paypal.com/cgi-bin/webscr
  // www.paypal.com/cgi-bin/webscr remains a documented legacy fallback.
  function ppVerifyIpnWithPaypal($req) {
    $useSandbox = !empty($_POST['test_ipn']);
    $endpoints = $useSandbox
      ? array(
          'https://ipnpb.sandbox.paypal.com/cgi-bin/webscr',
          'https://www.sandbox.paypal.com/cgi-bin/webscr',
        )
      : array(
          'https://ipnpb.paypal.com/cgi-bin/webscr',
          'https://www.paypal.com/cgi-bin/webscr',
        );

    $attempts = array();
    foreach ($endpoints as $url) {
      $host = parse_url($url, PHP_URL_HOST);
      $ips = ppResolveHostIps($host);
      $resolveRules = array();
      $addrList = array();
      foreach ($ips['v4'] as $ip) $addrList[] = $ip;
      foreach ($ips['v6'] as $ip) $addrList[] = '[' . $ip . ']';
      if ($addrList) $resolveRules[] = $host . ':443:' . implode(',', $addrList);
      $attempts[] = $host . " resolved=" . ($addrList ? implode(',', $addrList) : '(none)');

      $variants = array();
      if ($resolveRules) {
        $variants[] = array('rules' => $resolveRules, 'dns' => '', 'ipresolve' => 0, 'via' => 'curl+resolve');
      } else {
        $variants[] = array('rules' => array(), 'dns' => '', 'ipresolve' => 0, 'via' => 'curl');
        $variants[] = array('rules' => array(), 'dns' => '1.1.1.1,8.8.8.8', 'ipresolve' => 0, 'via' => 'curl+dnsservers');
      }

      foreach ($variants as $variant) {
        $info = ppIpnCurlPost($url, $req, $variant['rules'], $variant['dns'], $variant['ipresolve']);
        $attempts[] = ppFormatIpnAttempt($url, $info, $variant['via']);
        $status = ppIpnStatusFromBody($info['body']);
        if ($status === 'VERIFIED' || $status === 'INVALID') {
          return array('status' => $status, 'url' => $url, 'attempts' => $attempts);
        }
      }

      $streamIps = array_slice(array_merge($ips['v4'], $ips['v6']), 0, 2);
      foreach ($streamIps as $ip) {
        $info = ppIpnStreamPost($host, $req, $ip);
        $attempts[] = ppFormatIpnAttempt($url, $info, 'stream');
        $status = ppIpnStatusFromBody($info['body']);
        if ($status === 'VERIFIED' || $status === 'INVALID') {
          return array('status' => $status, 'url' => $url, 'attempts' => $attempts);
        }
      }
    }

    return array('status' => 'ERROR', 'url' => '', 'attempts' => $attempts);
  }

  // Callback name must be a string. A bare constant was tolerated by older
  // PHP (it fell back to the bareword as a string) but is a fatal Error in PHP 8.
  ob_start('saveOutput');

  date_default_timezone_set("Canada/Pacific");

  // output date and POST-ed values
  echo(date('r') . "\n\n");
  $x = $_POST;
  if (isset($x['callbackPW'])) unset($x['callbackPW']);
  print_r($x);
  echo("\n\n");

  // Exit if there is no TRXnum
  if (!array_key_exists('custom',$_POST) || !is_numeric($_POST['custom']) || $_POST['custom'] == 0) {
    exit();
  }

  // ***************
  // post back to PayPal system to validate
  // ***************
 /* $req = 'cmd=_notify-validate';
  foreach ($_POST as $key => $value) {
    $value = urlencode(stripslashes($value));
    $req .= "&$key=$value";
  }
  $header .= "POST /cgi-bin/webscr HTTP/1.1\r\n";
  $header .= "Content-Type: application/x-www-form-urlencoded\r\n";
  $header .= "Content-Length: " . strlen($req) . "\r\n";
  $header .= "Host: www.paypal.com\r\n";
  $header .= "Connection: close\r\n";
  $header .= "\r\n";*/

  // connect to the server
  /*if (array_key_exists('test_ipn',$_POST)) $server = "www.sandbox.paypal.com"; else $server = "www.paypal.com";
  $fp = fsockopen($server, 80, $errno, $errstr, 30);
  $unexpectedErrors = 0;
  if ($fp === false) {
    $errorMessage = "ERROR: Error connecting to PayPal server to validate IPN: $errno - $errstr";
    echo("$errorMessage\n");
    $unexpectedErrors = 1;
  } else {

    // post the data
    fputs ($fp, $header . $req);
    while (!feof($fp)) {

      // get the return status
      $res = trim(fgets($fp, 1024));
      if ($res === "VERIFIED") {
        echo("VERIFIED");
      } elseif ($res === "INVALID") {
        $errorMessage = "ERROR: The PayPal server could not validate the IPN";
        echo("$errorMessage\n");
        $unexpectedErrors = 1;
      }
    }
    fclose ($fp);
  }*/
  echo("\n\n");

################## Start Post Back to PayPal #####################################
	$unexpectedErrors = 0;
	$raw_post_data = file_get_contents('php://input');
	$myPost = array();
	if (is_string($raw_post_data) && strlen($raw_post_data) > 0) {
	  $raw_post_array = explode('&', $raw_post_data);
	  foreach ($raw_post_array as $keyval)
	  {
	    $keyval = explode ('=', $keyval);
	    if (count($keyval) == 2) {
	      // Official PayPal sample: keep the timezone '+' in payment_date.
	      if ($keyval[0] === 'payment_date' && substr_count($keyval[1], '+') === 1) {
	        $keyval[1] = str_replace('+', '%2B', $keyval[1]);
	      }
	      $myPost[$keyval[0]] = urldecode($keyval[1]);
	    }
	  }
	}
	if (count($myPost) == 0 && is_array($_POST)) {
	  $myPost = $_POST;
	}

    // read the IPN message sent from PayPal and prepend 'cmd=_notify-validate'
	$req = 'cmd=_notify-validate';
	// get_magic_quotes_gpc() was removed in PHP 8, so this is always false there.
	$get_magic_quotes_exists = function_exists('get_magic_quotes_gpc');
	foreach ($myPost as $key => $value) {
	  if ($get_magic_quotes_exists && get_magic_quotes_gpc() == 1) {
		$value = urlencode(stripslashes($value));
	  } else {
		$value = urlencode($value);
	  }
	  $req .= "&$key=$value";
	}

	$verify = ppVerifyIpnWithPaypal($req);
	echo("IPN verify attempts:\n" . implode("\n", $verify['attempts']) . "\n");
	if ($verify['url']) echo("IPN " . $verify['status'] . " via " . $verify['url'] . "\n");

	// Fail CLOSED: anything that is not an explicit "VERIFIED" must be treated
	// as unverified. A curl failure (network/TLS/timeout) previously fell
	// through both branches and the payment was credited as if PayPal had
	// confirmed it, which would credit an account for money never received.
	if ($verify['status'] === 'VERIFIED')
	{
		echo("VERIFIED\n");
	}
	elseif ($verify['status'] === 'INVALID')
	{
	  // IPN invalid, log for manual investigation
	   $errorMessage = "ERROR: The PayPal server could not validate the IPN. The response from IPN was: INVALID";
       echo("$errorMessage\n");
       $unexpectedErrors = 1;
	}
	else
	{
	   // curl failed, timed out, or returned an unexpected body.
	   // Do not insert a blocking transaction row: PayPal must be able to retry.
	   $errorMessage = "ERROR: Unable to verify IPN with PayPal. " . implode(" | ", $verify['attempts']);
	   echo("$errorMessage\n");
	   error_log("ppPayment: $errorMessage");
	   http_response_code(503);
	   exit();
	}

################## End Post Back to PayPal #####################################	
	

  // Use the posted transaction number value to determine the school_num
  $TRXnum = $_POST['custom'];
  $query = "SELECT school_num FROM user_online_payments WHERE record_num = {$TRXnum} ORDER BY record_num DESC LIMIT 0,1";
  $school_num = intval(pp_getVal($query));
  if (!$school_num) {
    $business = $_POST['business'];
    $school_num = pp_getVal("SELECT record_num FROM schools WHERE paypal_code = '$business' LIMIT 0,1");
    if (!$school_num) {
      $business = $_POST['receiver_email'];
      $school_num = pp_getVal("SELECT record_num FROM schools WHERE paypal_code = '$business' LIMIT 0,1");
      if (!$school_num) $school_num = 0;
    }
  }

  $curr_school_num = $school_num;


  // Check if this entry is in the user_paypal_transactions table
  $payment_type = '';
  $payment_status = '';
  if (array_key_exists('payment_type', $_POST)) $payment_type = $_POST['payment_type'];
  if (array_key_exists('payment_status', $_POST)) $payment_status = $_POST['payment_status'];
  $txn_id = $_POST['txn_id'];
  $query = "SELECT * FROM user_paypal_transactions WHERE school_num = $school_num AND payment_type = '$payment_type' AND payment_status = '$payment_status' AND txn_id = '$txn_id' AND current_year != 'N'";
  $r = pp_query($query);
  $trxID = 0;
  if (db_num_rows($r) > 0) {
    $existing = db_fetch_assoc($r);
    $existingResult = isset($existing['posting_result']) ? trim($existing['posting_result']) : '';
    // Only skip IPNs that were already credited or fully handled. A previous
    // verify/network Error must remain retryable or the payment stays stuck.
    $alreadyHandled = in_array($existingResult, array('Posted', 'Reversed', 'Canceled Reversal', 'Pending'), true);
    if ($alreadyHandled) {
      $errorMessage = "Duplicate Posting - Transaction Has Already Been Processed: $txn_id";
      echo("$errorMessage\n");
      exit();
    }
    $trxID = intval($existing['record_num']);
    echo("Reprocessing previous IPN attempt record_num=$trxID posting_result='$existingResult'\n");
  }

  if (!$trxID) {
    // Create entry in user_paypal_transactions table
    $trxFields = array('transaction_subject','payment_date','txn_type','first_name','last_name','payer_email','payer_status','item_name',
                       'business','receiver_email','mc_currency','mc_gross','mc_fee','reference','payment_type','payment_status',
                       'pending_reason','txn_id','receipt_id','current_year');
    $trxInsert = "school_num,posting_time,ptime,error_handled";
    $trxValues = "$school_num,'$time',$ptime,'N'";
    $current_year = 'Y';
    for ($i = 0; $i < count($trxFields); $i++) {
      $fieldName = $trxFields[$i];
      // Not every IPN carries every field (eg. reference, pending_reason,
      // receipt_id), so default to '' rather than emitting undefined-key
      // warnings and passing null into db_escape_string().
      $fieldValue = '';
      if (isset($$fieldName)) $fieldValue = $$fieldName;
      if (array_key_exists($fieldName, $_POST)) $fieldValue = db_escape_string(isset($_POST[$fieldName]) ? $_POST[$fieldName] : '');
      $trxInsert .= ",$fieldName";
      $trxValues .= ",'$fieldValue'";
    }
    $trxSQL = "INSERT INTO user_paypal_transactions ($trxInsert) VALUES ($trxValues)";
    // pp_query("START TRANSACTION");
    pp_query($trxSQL);
    $trxID = db_insert_id();
    echo("Insert ID: $trxID\n");
  }


  extract($_POST,EXTR_PREFIX_ALL,'P');
  $TRXnum = $P_custom;

  if (isset($P_case_type) && $P_case_type == 'complaint') {
    $errorMessage = "Non transaction Posting - Complaint Transaction: $txn_id";
    echo("$errorMessage\n");
    $query = "UPDATE user_paypal_transactions SET posting_result = 'Complaint', posting_message = '" . db_escape_string($errorMessage) . "' WHERE record_num = $trxID";
    exit();
  }

  if (isset($P_case_type) && $P_case_type == 'dispute') {
    $errorMessage = "Non transaction Posting - Dispute Transaction: $txn_id";
    echo("$errorMessage\n");
    $query = "UPDATE user_paypal_transactions SET posting_result = 'Dispute', posting_message = '" . db_escape_string($errorMessage) . "' WHERE record_num = $trxID";
    exit();
  }

  if (isset($P_case_type) && $P_case_type == 'chargeback') {
    $errorMessage = "Non transaction Posting - Chargeback Transaction: $txn_id";
    echo("$errorMessage\n");
    $query = "UPDATE user_paypal_transactions SET posting_result = 'Chargeback', posting_message = '" . db_escape_string($errorMessage) . "' WHERE record_num = $trxID";
    exit();
  }


  // If we were unable to verify the transaction
  if ($unexpectedErrors == 1) {
    $query = "SELECT * FROM user_online_payments WHERE record_num = {$TRXnum} AND status = 'Pending'";
    $r = pp_query($query);
    if (db_num_rows($r) == 1) {
      extract(db_fetch_assoc($r), EXTR_PREFIX_ALL, 'p');
      if (isset($p_user_num)) {
         pp_query("UPDATE user_paypal_transactions SET school_num = $p_school_num, user_num = $p_user_num, trx_num = $TRXnum WHERE record_num = $trxID");
      }
    }

    // Update the log with the error message
    $query = "UPDATE user_paypal_transactions SET posting_result = 'Error', posting_message = '" . db_escape_string($errorMessage) . "' WHERE record_num = $trxID";
    pp_query($query);
    exit();
  }


  // Load user information from the database
  $query = "SELECT * FROM user_online_payments WHERE record_num = {$TRXnum}";
  $r = pp_query($query);
  if (db_num_rows($r) != 1) {
    $errorMessage = "Invalid transaction number or status: $TRXnum";
    echo("$errorMessage\n");
    pp_query("UPDATE user_paypal_transactions SET posting_result = 'Error', posting_message = '" . db_escape_string($errorMessage) . "' WHERE record_num = $trxID");
  } else {
    extract(db_fetch_assoc($r), EXTR_PREFIX_ALL, 'p');
  }


  // Load school information from the database
  if (!isset($p_school_num) || intval($p_school_num) == 0) $p_school_num = $school_num;
  $r = pp_query("SELECT * FROM schools WHERE record_num = {$p_school_num}");
  if (db_num_rows($r) != 1) {
    echo("Invalid school.\n");
    pp_query("UPDATE user_paypal_transactions SET posting_result = 'Error', posting_message = 'Invalid school' WHERE record_num = $trxID");
    exit();
  } else {
    extract(db_fetch_assoc($r), EXTR_PREFIX_ALL, 's');
  }


  // Update user_paypal_transactions with school and user info
  pp_query("UPDATE user_paypal_transactions SET school_num = {$p_school_num}, user_num = {$p_user_num}, trx_num = $TRXnum WHERE record_num = $trxID");
  

  // Check for test/sandbox payments
  if (isset($P_test_ipn) && $P_test_ipn==1 && $s_paypal_mode == 'Live') {
    echo("Unexpected sandbox payment - we are not in testing mode.\n");
    pp_query("UPDATE user_paypal_transactions SET posting_result = 'Error', posting_message = 'Unexpected sandbox payment - we are not in testing mode' WHERE record_num = $trxID");
    exit();
  }

  // Check that the payment was made in Canadian funds
  if (!$P_mc_currency || $P_mc_currency != $s_paypal_currency) {
    echo("Unexpected currency - payment should be made in $s_paypal_currency\n");
    pp_query("UPDATE user_paypal_transactions SET posting_result = 'Error', posting_message = 'Unexpected currency' WHERE record_num = $trxID");
    // Stop here: crediting a different currency at face value would post the
    // wrong amount to the user's account.
    error_log("ppPayment: currency mismatch $P_mc_currency => $s_paypal_currency (trx $TRXnum)");
    exit();
  }


  //
  // Process Reversed payments
  //
  if ($P_payment_status == 'Reversed') {
    pp_query("UPDATE user_paypal_transactions SET posting_result = 'Reversed', posting_message = 'Payment reversed' WHERE record_num = $trxID");
    $results = pp_query("SELECT * FROM user_account WHERE payment_reference = '$P_parent_txn_id'");
    $row = db_fetch_assoc($results);
    $order_payments = $row['order_payments'];
    $orders = explode("|",$order_payments);

    // Flag each order
    for ($i = 0; $i < count($orders); $i++) {
      if (array_key_exists($i, $orders)) {
        list($onum,$amt) = explode(":",preg_replace("/{(.*)}/","$1",$orders[$i]));

        if (intval($onum) > 0) {
           $query = "UPDATE hotlunch_order_header " .
                    "SET status = 'Unpaid', " .
                    "payment_method = '', " .
                    "paid_date = NULL, " .
                    "amount_paid = 0 " .
                    "WHERE record_num = {$onum}";
           pp_query($query);
        }

        // logOrderChange($onum,"PAYMENT REVERSED","ppPayment.php");
      }
    }

    // Check if there is a user_account entry already
    $query = "SELECT * FROM user_account WHERE school_num = $p_school_num AND user_num = $p_user_num AND payment_reference = '$P_txn_id'";
    $ua_entries = pp_query($query);
    if (db_num_rows($ua_entries) > 0) {
      echo("Duplicate: This transaction has been entered into user_account already: $P_txn_id\n");
      exit();
    }

    // Post transaction to the user_account
    date_default_timezone_set(mapTimeZone($s_timezone));
    $entered_time = $ptime;
    $trx_time = date("Y-m-d H:i:s",$entered_time);

    $amount = $P_mc_gross * -1;
    $query = "INSERT INTO user_account " .
             "(school_num,user_num,schedule_num,transaction_datetime,transaction_type,note,transaction_amount,transaction_fee,payment_method,payment_reference,order_payments,deleted,entered_time,transaction_status) " .
             "VALUES ($p_school_num,$p_user_num,0,'$trx_time','Reversed Payment','PayPal Reversed Payment',$amount,$P_mc_fee,'PayPal','$P_txn_id','$order_payments','N',$entered_time,'Closed')";
    pp_query($query);

    exit();
  }

 //
  // Process Cancelled Reversed payments
  //
  if ($P_payment_status == 'Canceled_Reversal') {
    pp_query("UPDATE user_paypal_transactions SET posting_result = 'Canceled Reversal', posting_message = 'PayPal Canceled Reversal' WHERE record_num = $trxID");
    $results = pp_query("SELECT * FROM user_account WHERE payment_reference = '$P_parent_txn_id'");
    $row = db_fetch_assoc($results);
    $order_payments = $row['order_payments'];
    $orders = explode("|",$order_payments);

    // Flag each order
    for ($i = 0; $i < count($orders); $i++) {
      list($onum,$amt) = explode(":",preg_replace("/{(.*)}/","$1",$orders[$i]));

      if (intval($onum) > 0) {
         $query = "UPDATE hotlunch_order_header " .
                  "SET status = 'Paid', " .
                  "payment_method = 'PayPal', " .
                  "amount_paid = order_total " .
                  "WHERE record_num = {$onum}";
         pp_query($query);
      }

      // logOrderChange($onum,"PAYMENT REVERSAL CANCELLED","ppPayment.php");
    }

    // Check if there is a user_account entry already
    $query = "SELECT * FROM user_account WHERE school_num = $p_school_num AND user_num = $p_user_num AND payment_reference = '$P_txn_id'";
    $ua_entries = pp_query($query);
    if (db_num_rows($ua_entries) > 0) {
      echo("Duplicate: This transaction has been entered into user_account already: $P_txn_id\n");
      exit();
    }

    // Post transaction to the user_account
    date_default_timezone_set(mapTimeZone($s_timezone));
    $entered_time = $ptime;
    $trx_time = date("Y-m-d H:i:s",$entered_time);

    $amount = $P_mc_gross;
    $query = "INSERT INTO user_account " .
             "(school_num,user_num,schedule_num,transaction_datetime,transaction_type,note,transaction_amount,transaction_fee,payment_method,payment_reference,order_payments,deleted,entered_time,transaction_status) " .
             "VALUES ($p_school_num,$p_user_num,0,'$trx_time','Cancelled Reversed Payment','PayPal Cancelled Reversed Payment',$amount,$P_mc_fee,'PayPal','$P_txn_id','$order_payments','N',$entered_time,'Closed')";
    pp_query($query);

    exit();
  }


  // Check the payment was sent to the correct account
  if (strtolower(trim($P_receiver_email)) != strtolower(trim($s_paypal_code)) && strtolower(trim($P_business)) != strtolower(trim($s_paypal_code))) {
    echo("Payment was sent to an unexpected account - $s_paypal_code.\n");
    echo("$P_receiver_email => $s_paypal_code\n");
    pp_query("UPDATE user_paypal_transactions SET posting_result = 'Error', posting_message = 'Payment was sent to an unexpected account' WHERE record_num = $trxID");
    // Stop here: the money did not land in this school's account, so crediting
    // the user would post funds that were never received.
    error_log("ppPayment: receiver mismatch $P_receiver_email => $s_paypal_code (trx $TRXnum)");
    exit();
  }

  // Update hotlunch_orders table
  $query = "SELECT hloh.* FROM hotlunch_order_header as hloh, people as p " .
           "WHERE hloh.school_num = {$p_school_num} " .
           "AND ordered_by_num = p.record_num " .
           "AND p.user_num = {$p_user_num} " .
           "AND hloh.status NOT IN ('Paid','Complimentary','Concession')";
  $orders = pp_query($query);
  echo("Orders Found: " . db_num_rows($orders) . "\n\n");

  // check for non-completed orders (ie. pending for some reason)
  if ($P_payment_status != 'Completed') {
    echo("Payment was not completed. $P_payment_status.\n");

    if ($P_payment_status == 'Pending' && $P_payment_type == 'instant' && $P_pending_reason == 'paymentreview') {
      echo(" - Pending - instant - paymentreview\n");
    }
    else {

      // Process refunds
      if ($P_payment_status == 'Refunded') {
        // Post transaction to the user_account
        date_default_timezone_set(mapTimeZone($s_timezone));
        $entered_time = $ptime;
        $trx_time = date("Y-m-d H:i:s",$entered_time);
        // $snum = intval($snum);

        $amount = $P_mc_gross * -1;
        $query = "INSERT INTO user_account " .
                 "(school_num,user_num,schedule_num,transaction_datetime,transaction_type,note,transaction_amount,transaction_fee,payment_method,payment_reference,order_payments,deleted,entered_time) " .
                 "VALUES ($p_school_num,$p_user_num,0,'$trx_time','Refund','PayPal Refund',$amount,$P_mc_fee,'PayPal','$P_txn_id','','N',$entered_time)";
        pp_query($query);
        pp_query("UPDATE user_paypal_transactions SET posting_result = 'Posted', posting_message = 'Refund posted' WHERE record_num = $trxID");
        echo("Refund Status: $P_payment_status\n");
        exit();
      }

      // Process Pending transactions
      if ($P_payment_status == 'Pending') {
        pp_query("UPDATE user_paypal_transactions SET posting_result = 'Pending', posting_message = 'Payment not completed' WHERE record_num = $trxID");

        // Flag each order
        if (db_num_rows($orders) > 0) {
          while ($row = db_fetch_array($orders)) {
            $onum   = $row['record_num'];

            $query = "UPDATE hotlunch_order_header " .
                     "SET status = 'Pending' " .
                     "WHERE record_num = {$onum}";
            pp_query($query);

            // logOrderChange($onum,"PENDING PAYMENT","ppPayment.php");
          }
        }

        // Update users record to indicate that there are pending transactions
        $query = "update users set trx_status = 'Pending' where record_num = $p_user_num";
        pp_query($query);
        echo("Pending Payment Status: $P_payment_status\n");
        exit();
      }

      // Process Failed transactions
      if ($P_payment_status == 'Failed') {
        pp_query("UPDATE user_paypal_transactions SET posting_result = 'Error', posting_message = 'Payment failed' WHERE record_num = $trxID");

        // Find Pending Orders and reset the status
        $query = "SELECT hloh.* FROM hotlunch_order_header as hloh, people as p " .
                 "WHERE hloh.school_num = {$p_school_num} " .
                 "AND ordered_by_num = p.record_num " .
                 "AND p.user_num = {$p_user_num} " .
                 "AND hloh.status IN ('Pending')";
        $orders = pp_query($query);
        echo("Orders Found: " . db_num_rows($orders) . "\n\n");

        // Flag each order
        if (db_num_rows($orders) > 0) {
          while ($row = db_fetch_array($orders)) {
            $onum   = $row['record_num'];

            $query = "UPDATE hotlunch_order_header " .
                     "SET status = 'Unpaid' " .
                     "WHERE record_num = {$onum}";
            pp_query($query);

            // logOrderChange($onum,"PAYMENT FAILED","ppPayment.php");
          }
        }

        // Update users record to clear the pending status
        $query = "update users set trx_status = '' where record_num = $p_user_num";
        pp_query($query);
        echo("Failed Payment Status: $P_payment_status\n");
        exit();
      }

      $query = "UPDATE user_paypal_transactions SET posting_result = 'Error', posting_message = 'Payment not completed - $P_payment_status' WHERE record_num = $trxID";
      pp_query($query);
      echo("Incomplete Payment Status: $P_payment_status\n");
      exit();
    }
  }

  echo("Payment validated ok - updating database\n\n");


  //
  // Check if this transaction has been entered already
  //
  $query = "SELECT * FROM user_online_payments WHERE record_num = $TRXnum AND status = 'Paid'";
  $paid_payments = pp_query($query);
  if (db_num_rows($paid_payments) > 0) {
    echo("Duplicate: This transaction has been posted to user_online_payments already: $TRXnum\n");
    $row = db_fetch_assoc($paid_payments);
    if ($row['reference'] == $P_txn_id) exit();
    echo("New PayPal Reference ID: $P_txn_id\n\n");
  }


  // Update paypal_payments database table
  $P_mc_fee = floatval($P_mc_fee);
  $query = "UPDATE user_online_payments " .
           "SET status = 'Paid', payment_amount = balance_owing, reference = '{$P_txn_id}', trx_fee = {$P_mc_fee}, completed_time = $ptime " .
           "WHERE record_num = $TRXnum";
  pp_query($query);

  $today = date("Y-m-d",$ptime);
  $order_payments = "";
  $snum = 0;
  if (db_num_rows($orders) > 0) {
    while ($row = db_fetch_array($orders)) {
      $onum   = $row['record_num'];
      $ototal = $row['order_total'];
      $opaid  = $row['amount_paid'];
      $snum   = $row['schedule_num'];
      $amt = number_format($ototal - $opaid,2);
      if (strlen($order_payments) > 0) $order_payments .= "|";
      $order_payments .= "{" . $onum . ":" . $amt . "}";

      $query = "UPDATE hotlunch_order_header " .
               "SET amount_paid = order_total, " .
                  "status = 'Paid', " .
                  "paid_date = '$today', " .
                  "payment_method = 'PayPal' " .
               "WHERE record_num = {$onum}";
      pp_query($query);

      // logOrderChange($onum,"PAYMENT COMPLETED","ppPayment.php");
    }
  }


  //
  // Check if there is a user_account entry already
  //
  $query = "SELECT * FROM user_account WHERE school_num = $p_school_num AND user_num = $p_user_num AND payment_reference = '$P_txn_id'";
  $ua_entries = pp_query($query);
  if (db_num_rows($ua_entries) > 0) {
    echo("Duplicate: This transaction has been entered into user_account already: $P_txn_id\n");
    exit();
  }


  // Post transaction to the user_account
  date_default_timezone_set(mapTimeZone($s_timezone));
  $entered_time = $ptime;
  $trx_time = date("Y-m-d H:i:s",$entered_time);

  // Post transaction fee if there is one
  if ($p_transaction_fee != 0) {
    if ($p_transaction_fee > 0) {
      $query = "INSERT INTO user_account " .
               "(school_num,user_num,schedule_num,transaction_datetime,transaction_type,transaction_status,note,transaction_amount,amount_paid,transaction_fee,payment_method,payment_reference,order_payments,deleted,entered_time) " .
               "VALUES ($p_school_num,$p_user_num,$snum,'$trx_time','PayPal Transaction Fee','Closed','',$p_transaction_fee,$p_transaction_fee,0,'PayPal','$P_txn_id',NULL,'N',$entered_time)";
    }
    else {
      $query = "INSERT INTO user_account " .
               "(school_num,user_num,schedule_num,transaction_datetime,transaction_type,transaction_status,note,transaction_amount,amount_paid,transaction_fee,payment_method,payment_reference,order_payments,deleted,entered_time) " .
               "VALUES ($p_school_num,$p_user_num,$snum,'$trx_time','PayPal Transaction Credit','Closed','',$p_transaction_fee,$p_transaction_fee,0,'PayPal','$P_txn_id',NULL,'N',$entered_time)";
    }
    pp_query($query);
    $entered_time += 1;
    $trx_time = date("Y-m-d H:i:s",$entered_time);
  }

  // Insert payment transaction
  $amount = $P_mc_gross * -1;
  $query = "INSERT INTO user_account " .
           "(school_num,user_num,schedule_num,transaction_datetime,transaction_type,note,transaction_amount,transaction_fee,payment_method,payment_reference,order_payments,deleted,entered_time) " .
           "VALUES ($p_school_num,$p_user_num,$snum,'$trx_time','Payment','PayPal Payment',$amount,$P_mc_fee,'PayPal','$P_txn_id','$order_payments','N',$entered_time)";
  pp_query($query);

  // Update any open charge transactions
  $query = "SELECT * FROM user_account " .
           "WHERE school_num = $school_num AND user_num = $p_user_num AND transaction_status = 'Open' AND transaction_amount > 0";
  $results = pp_query($query);
  while ($row = db_fetch_assoc($results)) {
    $rnum = $row['record_num'];
    $query = "UPDATE user_account SET payment_method = 'PayPal', payment_reference = '$P_txn_id', payment_time = $entered_time " .
             "WHERE school_num = $school_num AND record_num = $rnum";
    pp_query($query);
  }

  // Close all transactions
  $query = "SELECT record_num FROM user_account WHERE school_num = $school_num AND user_num = $p_user_num AND transaction_status != 'Closed'";
  $results = pp_query($query);
  while ($row = db_fetch_assoc($results)) {
    $rnum = $row['record_num'];
    $query = "UPDATE user_account SET transaction_status = 'Closed' WHERE school_num = $school_num AND user_num = $p_user_num AND record_num = $rnum";
    pp_query($query);
  }

  // Update all orders to set amount paid
  $query = "SELECT * FROM user_account WHERE school_num = $school_num AND user_num = $p_user_num AND transaction_amount > 0";
  $results = pp_query($query);
  while ($row = db_fetch_assoc($results)) {
    $rnum = $row['record_num'];
    $query = "UPDATE user_account SET amount_paid = transaction_amount WHERE school_num = $school_num AND record_num = $rnum";
    pp_query($query);
  }


  // Make activity_log entry
  $username = pp_getVal("SELECT userid FROM users WHERE record_num = $p_user_num");
  $activity = "PayPal Payment";
  $additional_info = "TRX ID: $P_txn_id\nAmount: " . number_format(abs($amount),2) . "\n";
  $curr_time = $ptime;
  $activity_datetime = date("Y-m-d H:i:s",$curr_time);
  $uname = db_escape_string($username);
  $query = "insert into activity_log (school_num,userid,user_ip,activity_time,activity_datetime,activity,information) " .
           "values($p_school_num,'$uname','0.0.0.0',$curr_time,'$activity_datetime','$activity','$additional_info')";
  pp_query($query);

  // Reset user transaction status
  $query = "update users set trx_status = NULL where record_num = $p_user_num";
  pp_query($query);

  // Reset user can_order flag
  $query = "update users set can_order = 'Yes' where can_order = 'Balance' and record_num = $p_user_num";
  pp_query($query);

  // Update user_paypal_transactions
  pp_query("UPDATE user_paypal_transactions SET posting_message = 'Payment processed ok' WHERE record_num = $trxID");
  pp_query("UPDATE user_paypal_transactions SET posting_result = 'Posted' WHERE school_num = $p_school_num AND trx_num = $TRXnum");
  // pp_query("COMMIT");

  adjustUserAccountDetails($p_user_num,$p_school_num);

  echo("Payment processed ok\n\n\n");
?>