View file sdark.mobi/fs/pay.php

<?php
if (isset($_GET['money']) && isset($_SESSION['fs_id']) && isset($_SESSION['fs_key'])) {
require_once '../core/system.php';
require_once('resources/fotostrana.config.php');
require_once('resources/fotostrana.sdk.php');

$id = iconv('windows-1251','utf-8',$_GET['viewerId']); 
$su = floatval ($_GET['money']);
if($su==0.16){
	$kol = 10;
}
if($su==0.64){
	$kol = 40;
}
if($su==3.20){
	$kol = 200 + 35;
}
if($su==16){
	$kol = 1000 + 250;
}
if($su==64){
	$kol = 2000 + 1200;
}
if($su==190){
	$kol = 10000 + 3500;
}
if($su >= 16) {
mysql_query("INSERT INTO `chests_user` set `user_id`='".$_SESSION['fs_id']."', `chest_id`='3', `time`='".time()."'");
}
$sumx = $kol*100;
$aprel = floor($kol*0.30);
$apr = floor($sumx*0.30);

$reqj = mysql_query("SELECT * FROM `user` WHERE `fs_id` = '".$_SESSION['fs_id']."' LIMIT 1");
$user = mysql_fetch_array($reqj);

$av = mysql_num_rows(mysql_query("SELECT * FROM `task` WHERE `usr`='".$user['id']."' and `status`='2' and `task`='12'"));
if($av > 0){
mysql_query("UPDATE `task` SET `min` = `min`+'$kol'  WHERE `usr`='".$user['id']."' and `status`='2' and `task`='12'");
}


$time = time();
$timer = time() + 2592000;
//$text = "Поздравляем, Вы успешно приобрели <img src=/images/icon/gold.png>$kol золота!";
$text = "Поздравляем, Вы успешно приобрели $kol золота! </br> По акции Вам начислено дополнительно $aprel золота!";
 

mysql_query("INSERT INTO `logi` set `user_id` = '".$user['id']."', `text` = 'Куплено золото', `time` = '".$time."', `kol`='$sumx', `kto`='+'");
//mysql_query("INSERT INTO `logi` set `user_id` = '".$user['id']."', `text` = 'Куплено золото', `time` = '".$tm."', `kol`='$apr', `kto`='+'");

if (mysql_query(
		"UPDATE `user` SET `gold`=`gold`+'".($sumx+$apr)."' WHERE `id`='".$user['id']."'"
	) ) {//+$apr  в 165 строке
//, `snow`=`snow`+'".floor($kol/100)."'
} else {
	$f = fopen($_SERVER['DOCUMENT_ROOT'] . '/donate.txt', 'w+');
	fwrite($f, 'Игрок '.$user['id'].' с фотостраны купил золото, но оно не дошло, ошибка : '.mysql_error());
	fclose($f);
}

mysql_query("INSERT INTO `mail` SET `id_user` = '2', `id_kont` = '$user[id]', `time` = '$time', `timer` = '$timer',`read` = '1', `msg` = '$text'");
$req = mysql_query("SELECT * FROM `users_konts` WHERE `id_user`='$user[id]' and `id_kont` = '2'");
$avto = mysql_num_rows($req);
if($avto==0){
mysql_query("INSERT INTO `users_konts` SET `id_user` = '$user[id]', `id_kont` = '2', `time` = '$time', `timer` = '$timer', `new_msg` = '1'");
} else {
mysql_query("UPDATE `users_konts` SET  `time` = '$time', `timer` = '$timer', `new_msg` = '1'  WHERE`id_user` = '$user[id]' and `id_kont` = '2'");
}
		$ans = '<status>OK</status>';
		echo $ans;
		header('location: /');

    $amount = round($_GET['money'], 2);

    $request = new fotostranaRequest();
    $request->setMethod('Billing.withDrawMoneySafe');
    $request->setParam('userId', $_SESSION['fs_id']);
    $request->setParam('money', $amount);
    $request->disallowCache();
    $apiresult = $request->get();

    if (!isset($apiresult['response']['transferred']) || $apiresult['response']['transferred']<>$amount) {
        throw new Exception("Billing problem: ".serialize($apiresult));
    } else {
        echo (serialize($apiresult));
    }

		header('location: /');
} 
?>