It looks like you are using the wrong quotes. You should be using ASCII single quotes and double quotes. Oh, and you need to indent your code, e.g.,
<?php // thankyou.php
function cbValid($rcpt, $time, $item, $cbpop) {
$key = 'ABCDE';
$xxpop = sha1("$key|$rcpt|$time|$item");
$xxpop = strtoupper(substr($xxpop, 0, 8));
if ($cbpop == $xxpop) {
return 1;
} else {
return 0;
}
}
// ===== Sanitize the input (only allow GET for security) =====
$rcpt = trim(addslashes($_GET['cbreceipt']));
$time = trim(addslashes($_GET['time']));
$item = trim(addslashes($_GET['item']));
$cbpop = trim(addslashes($_GET['cbpop']));
// ===== Redirect if invalid and exit =====
if (!cbValid($rcpt, $time, $item, $cbpop)) {
// redirect
header('Location: http://www.SendThemSomewhere.com/');
exit;
}
// no need to do an ELSE because the exit will terminate further processing
// if a valid transaction is not confirmed
// now have the thank you page html
?>
Personally, I would write this:
if ($cbpop == $xxpop) {
return 1;
} else {
return 0;
}
as:
return ($cbpop == $xxpop) ? 1 : 0;
or even just use boolean values:
return $cbpop == $xxpop;
Incidentally, the use of addslashes() is probably the wrong approach to sanitise input. If you are santising input for entry to a database, then you should use the appropriate escaping function (or prepared statements, if possible).
