<%@LANGUAGE="VBScript"%>
<!--#include file="db_conn_open.asp"-->
<!--#include file="includes.asp"-->
<!--#include file="inc/incfunctions.asp"-->
<%
Dim str, OrderID, Txn_id, Payment_status, stockManage, objHttp
' read post from PayPal system and add 'cmd'
str = Request.Form
OrderID = Request.Form("item_number")
Txn_id = Request.Form("txn_id")
Payment_status = Request.Form("payment_status")

' post back to PayPal system to validate
str = str & "&cmd=_notify-validate"
set objHttp = Server.CreateObject("Msxml2.ServerXMLHTTP")
objHttp.open "POST", "https://www.paypal.com/cgi-bin/webscr", false
objHttp.Send str

' assign posted variables to local variables
Receiver_email = Request.Form("receiver_email")
Item_number = Request.Form("item_number")
Invoice = Request.Form("invoice")
Payment_status = Request.Form("payment_status")
Payment_gross = Request.Form("payment_gross")
Txn_id = Request.Form("txn_id")
Payer_email = Request.Form("payer_email")

' Check notification validation
if (objHttp.status <> 200 ) then
' HTTP error handling
elseif (objHttp.responseText = "VERIFIED") AND (trim(request.form("custom"))<>"") then
	' check that Payment_status=Completed
	' check that Txn_id has not been previously processed
	' check that Receiver_email is an email address in your PayPal account
	' process payment
	if False then
		Set rs = Server.CreateObject("ADODB.RecordSet")
		rs.Open "ppVerify",cnn,1,3,&H0002
		rs.AddNew
		rs.Fields("dateadded")=Date()
		rs.Fields("firstname")=Request.Form("first_name")
		rs.Fields("lastname")=Request.Form("last_name")
		rs.Fields("email")=Payer_email
		rs.Fields("sessionid")=Request.Form("custom")
		rs.Fields("paymentStatus")=Payment_status
		rs.Fields("pendingReason")=Request.Form("pending_reason")
		rs.Fields("verifysign")=Request.Form("verify_sign")
		rs.Fields("txn_id")=Txn_id
		rs.Fields("txn_type")=Request.Form("txn_type")
		rs.Fields("paymentGross")=Payment_gross
		rs.Update
		rs.Close
	end if
	Set rs = Server.CreateObject("ADODB.RecordSet")
	Set cnn=Server.CreateObject("ADODB.Connection")
	cnn.open sDSN
	sSQL="SELECT adminStockManage FROM admin WHERE adminID=1"
	rs.Open sSQL,cnn,0,1
	stockManage=Int(rs("adminStockManage"))
	rs.Close
	do_stock_management(trim(request.form("custom")))
	sSQL="UPDATE cart SET cartCompleted=1 WHERE cartOrderID="&trim(request.form("custom"))
	cnn.Execute(sSQL)
	sSQL="UPDATE orders SET ordAuthNumber='"&Txn_id&"' WHERE ordID="&trim(request.form("custom"))
	cnn.Execute(sSQL)
elseif (objHttp.responseText = "INVALID") then
' log for manual investigation
else 
' error
end if
set objHttp = nothing
%>