Online PHP editor | output for iJqut

<?php error_reporting(E_ALL); // Отклоняем запросы с IP-адресов, которые не принадлежат Payeer //if (!in_array($_SERVER['REMOTE_ADDR'], array('185.71.65.92', '185.71.65.189','149.202.17.210'))) return; header("Content-type: text/html; charset=windows-1251"); require("".$_SERVER['DOCUMENT_ROOT']."/config.php"); require("".$_SERVER['DOCUMENT_ROOT']."/merchant/func_mysql.php"); require("".$_SERVER['DOCUMENT_ROOT']."/merchant/payeer/payeer_config.php"); require("".$_SERVER['DOCUMENT_ROOT']."/config.php"); define('PATH_TO_LOG', dirname(__FILE__).'/'); $m_operation_id = (isset($_REQUEST["m_operation_id"])) ? htmlspecialchars(trim($_REQUEST["m_operation_id"])) : false; $m_operation_ps = (isset($_REQUEST["m_operation_ps"])) ? htmlspecialchars(trim($_REQUEST["m_operation_ps"])) : false; $m_operation_date = (isset($_REQUEST["m_operation_date"])) ? htmlspecialchars(trim($_REQUEST["m_operation_date"])) : false; $m_operation_pay_date = (isset($_REQUEST["m_operation_pay_date"])) ? htmlspecialchars(trim($_REQUEST["m_operation_pay_date"])) : false; $m_shop = (isset($_REQUEST["m_shop"])) ? htmlspecialchars(trim($_REQUEST["m_shop"])) : false; $m_orderid = (isset($_REQUEST["m_orderid"])) ? htmlspecialchars(trim($_REQUEST["m_orderid"])) : false; $merch_amount = (isset($_REQUEST["m_amount"])) ? htmlspecialchars(trim($_REQUEST["m_amount"])) : false; $m_curr = (isset($_REQUEST["m_curr"])) ? htmlspecialchars(trim($_REQUEST["m_curr"])) : false; $m_desc = (isset($_REQUEST["m_desc"])) ? htmlspecialchars(trim($_REQUEST["m_desc"])) : false; $m_status = (isset($_REQUEST["m_status"])) ? htmlspecialchars(trim($_REQUEST["m_status"])) : false; $m_sign = (isset($_REQUEST["m_sign"])) ? strtoupper(htmlspecialchars(trim($_REQUEST["m_sign"]))) : false; $arHash = [$m_operation_id,$m_operation_ps,$m_operation_date,$m_operation_pay_date,$m_shop,$m_orderid,$merch_amount,$m_curr,$m_desc,$m_status,$m_key]; $sign = strtoupper(hash('sha256', implode(":", $arHash))); if($m_orderid!=false) { $exp = explode(":", $m_orderid); $shp_item = $exp[0]; $merch_tran_id = $exp[1]; }else{ $merch_tran_id = 0; $shp_item = 0; } $shp_item = (isset($shp_item) && preg_match("|^[\d]{1,11}$|", htmlspecialchars(trim($shp_item))) ) ? intval(htmlspecialchars(trim($shp_item))) : false; $merch_tran_id = (isset($merch_tran_id) && preg_match("|^[\d]{1,11}$|", htmlspecialchars(trim($merch_tran_id))) ) ? intval(htmlspecialchars(trim($merch_tran_id))) : false; $TABLE_ARR = [ 1 => "tb_add_pay", 2 => "tb_ads_dlink", 3 => "tb_ads_psevdo", 4 => "tb_ads_bs", 5 => "tb_ads_auto", 6 => "tb_ads_slink", 7 => "tb_ads_kontext", 8 => "tb_ads_banner", 9 => "tb_ads_txt", 10 => "tb_ads_frm", 11 => "tb_ads_mails", 12 => "tb_ads_rc", 13 => "tb_ads_downloads", 14 => "tb_ads_questions", 15 => "tb_ads_emails", 16 => "tb_ads_packet", 20 => "tb_ads_beg_stroka", 21 => "tb_ads_tests", 22 => "tb_ads_catalog", 23 => "tb_ads_youtube" ]; $STAT_PAY_ARR = [ 1 => "money_in", 2 => "dlink", 3 => "psevdo", 4 => "bserf", 5 => "autoserf", 6 => "statlink", 7 => "kontext", 8 => "banners", 9 => "txtob", 10 => "frmlink", 11 => "mails", 12 => "rekcep", 13 => "files", 14 => "quest", 15 => "sent_mails", 16 => "packet", 20 => "bstroka", 21 => "tests", 22 => "catalog", 23 => "youtube" ]; if($sign==$m_sign && $m_status=="success") { if($shp_item!= 0 && array_key_exists($shp_item, $TABLE_ARR)) { $sql = mysql_query("SELECT `id`,`username`,`money` FROM `".$TABLE_ARR[$shp_item]."` WHERE `status`='0' AND `merch_tran_id`='$merch_tran_id' LIMIT 1"); $row = mysql_fetch_array($sql); $username = $row["username"]; if($shp_item==3 | $shp_item==6 | $shp_item==8 | $shp_item==9 | $shp_item==10) { $DATE_END = ", `date_end`=`plan`*'".(24*60*60)."'+'".time()."'"; }else{ $DATE_END = false; } if(floatval($row["money"])!=floatval($merch_amount)) { exit("$m_orderid|error"); }elseif($shp_item==1) { if($username!=false) { echo "$m_orderid|success"; $bon = mysql_query("SELECT `price` FROM `tb_config` WHERE `item`='bon_popoln' AND `howmany`='1'") or die(mysql_error()); $b = number_format(mysql_result($bon,0), 0, ".", ""); $bonus=($merch_amount/100)*$b; $merch_amount1=$merch_amount+$bonus; mysql_query("UPDATE `tb_users` SET `money_rb`=`money_rb`+'$merch_amount1', `money_in`=`money_in`+'$merch_amount1' WHERE `username`='$username'") or die(mysql_error()); mysql_query("INSERT INTO `tb_history` (`user`, `date`, `amount`, `method`, `status`, `tipo`) VALUES('$username', '".DATE("d.m.Y H:i")."', '$merch_amount1', 'Пополнение рекламного баланса через Payeer','Зачислено', 'popoln')") or die(mysql_error()); mysql_query("UPDATE `tb_add_pay` SET `status`='1', `date`='".time()."' WHERE `merch_tran_id`='$merch_tran_id' AND`username`='$username'") or die(mysql_error()); stat_pay($STAT_PAY_ARR[$shp_item], $merch_amount); }elseif($shp_item==16) { mysql_query("UPDATE `".$TABLE_ARR[$shp_item]."` SET `status`='1', `date`='".time()."' WHERE `status`='0' AND `merch_tran_id`='$merch_tran_id' ORDER BY `id` DESC LIMIT 1") or die(mysql_error()); stat_pay($STAT_PAY_ARR[$shp_item], $merch_amount); $merch_user_wmid = false; konkurs_ads_new($merch_user_wmid, $username, $merch_amount); require_once("".$_SERVER['DOCUMENT_ROOT']."/merchant/add_adv_packet.php"); require_once("".$_SERVER['DOCUMENT_ROOT']."/merchant/func_cache.php"); cache_stat_links(); cache_frm_links(); cache_txt_links(); cache_banners(); }elseif($shp_item==21) { mysql_query("UPDATE `".$TABLE_ARR[$shp_item]."` SET `status`='1', `date`='".time()."',`money`='$merch_amount',`balance`='$merch_amount' WHERE `status`='0' AND `merch_tran_id`='$merch_tran_id' ORDER BY `id` DESC LIMIT 1") or die(mysql_error()); }elseif($shp_item==30) { mysql_query("UPDATE `".$TABLE_ARR[$shp_item]."` SET `status`='2', `date`='".time()."' WHERE `status`='0' AND `merch_tran_id`='$merch_tran_id' ORDER BY `id` DESC LIMIT 1") or die(mysql_error()); }else{ mysql_query("UPDATE `".$TABLE_ARR[$shp_item]."` SET `status`='1', `date`='".time()."' $DATE_END WHERE `status`='0' AND `merch_tran_id`='$merch_tran_id' ORDER BY `id` DESC LIMIT 1") or die(mysql_error()); } mysql_query("UPDATE `tb_users` SET `money_rek`=`money_rek`+'$merch_amount' WHERE `username`='$username'") or die(mysql_error()); echo "$m_orderid|success"; stat_pay($STAT_PAY_ARR[$shp_item], $merch_amount); $merch_user_wmid = false; if($shp_item!=21){ konkurs_rek_ed($merch_user_wmid, $username, $merch_amount); konkurs_rek_ed($merch_user_wmid, $username, $merch_amount); } if($shp_item==6 | $shp_item==7 | $shp_item==8 | $shp_item==9 | $shp_item==10 | $shp_item==12 | $shp_item==20) { require_once($_SERVER['DOCUMENT_ROOT']."/merchant/func_cache.php"); cache_stat_links(); cache_kontext(); cache_frm_links(); cache_txt_links(); cache_rek_cep(); cache_banners(); cache_beg_stroka(); } } }else{ exit("$m_orderid|error"); } }else{ exit("$m_orderid|error"); } ?>

3v4l.org

Abusive script