security - check script for defeating "Price-Jacking" -

here fourth part of ipn-security-ckeck. need check whether it´s secure:

// check number4 --------------------------------------------------------- $product_id_string = $_post['custom']; $product_id_string = rtrim($product_id_string, ","); // remove last comma // explode string, make array; check payment ! $id_values = array(); $id_str_array = explode(",", $product_id_string); $fullamount = 0; foreach ($id_str_array $key => $value) {      $id_quantity_pair = explode("-", $value);     $product_id = $id_quantity_pair[0]; // product id     $product_quantity = $id_quantity_pair[1]; // quantity      if (1 != intval($product_quantity)) {     // manipulating item´s quantity     $message = "somebody manipulating item´s quantity";     mail("me@myemail.de", "quantity hack", $message, "from: me@myemail.de" );     exit()       }      // remember item´s id     $id_values[$key] = intval($product_id); }     $sql = 'select price products id in ('.implode(',', $id_values).')';     while($row = mysql_fetch_array($sql)) {         $fullamount += $row["price"];     } $fullamount = number_format($fullamount, 2); if (isset($_post['mc_gross'])) {     $grossamount = $_post['mc_gross']; } else     $grossamount = 0;     $message = "grossamount wurde = 0 gesetzt";     mail("me@myemail.de", "grossamout hack", $message, "from: my@myemail.de" );     exit(); if ( intval($fullamount * 100) != intval($grossamount *100) ) {     $message = "possible price jack: " . $_post['payment_gross'] . " != $fullamount \n\n\n$req";     mail("me@myemail.de", "price jack or bad programming", $message, "from: me@myemail.de" );     exit(); // exit script } 

is script defeating price-jacking? should change anything? if yes, what? greetings , thanks

the price should calculated on server. why allowing client submit price @ all? allowing client submit price allows them try changing price on you. secondly, if doesn't agree calculate on server throw away anyway. calculate on server , not accept price submissions client.

it looks quantity, other 1 considered hacking attempt, why?

you convert product ids strings using

$id_values[$key] = intval($product_id); 

if client submits non-integer value think return 0. if have product id of 0 cause issues.