<?php

/*
MicroShop
=========
A shopping cart system that can be embedded and integrated into WordPress.

*/

define('MICROSHOP_VERSION', '2.0');

if(!class_exists('microconfig')) include "microlib.php";

// Extend microconfig to provide config variables
class microshopconfig extends microconfig
{
	/* BEGIN CONFIG VARS */
	var $shopname = "My Shop"; // The name of the shop
	var $UseWordPressDB = false; // Use the WordPress database settings (* items not used in WordPress mode):false,true
	var $minuserlevel = "1"; // The minimum WordPress user level required (on WP1.5 or 1.6) or the capability name required (on WP1.6) to change config options and add products.
	var $adminpassword = "password"; // The password used to change options and add products *
	var $db_server = "localhost"; // The database server domain or IP address *
	var $db_user = "root"; // The username for logging into the database *
	var $db_password = ""; // The password for logging into the database *
	var $db_name = "shop"; // The name of the database on the server to connect to *
	var $displayaspage = true; // Include HTML page wrapper (&lt;html&gt;, &lt;head&gt;, &lt;body&gt;):false,true
	var $table_prefix = "ms_"; // The prefix to use on microshop database tables
	var $linkstruct = "Crufty"; // The sturcture of links used in output:Crufty,Friendly
	var $baselocation = "http://localhost/shop"; // The base location of the shop
	var $image_url = "images"; // The URL of the directory that contains the product images
	var $shop_css = "microshop.css"; // The URL of the shopping cart CSS file (only valid when using the HTML page wrapper, above)
	var $itemsperpage = "5"; // The number of products to show per page in each product category
	var $addshowcart = false; // Show the shopping cart after adding an item:true,false
	var $paypal_account = "user@domain.com"; // The PayPal email account to which payments are sent
	var $sandbox = "sandbox."; // Make this empty to use actual PayPal, or 'sandbox.' for testing using PayPal's Sandbox
	var $shipfrom = "90210"; // The zipcode of the shipping origin for computing shipping charges
	var $currency = "USD"; // The three-letter curency code (must match payment processor requirements) to use throughout the shop:USD,GBP,EUR
	var $checkoutmessage = "Thanks for shopping at my store!

If you need credit card processing for your order, choose PayPal as your pament method."; // Message to display on checkout page:TEXTAREA
	var $payment_location = "My Shop of Stuff
9700 Pennsylvania Ave.
Washington, DC
10101"; // The location to which payments (check, money order) should be mailed:TEXTAREA
	var $ccinvoice = true; // Send a copy of each invoice to the PayPal address:false,true
	/* END CONFIG VARS */
}

// Extend microdb to define database table structure
class microshopdb extends microdb
{
	function upgrade()
	{
		$queries="CREATE TABLE {$this->config->table_prefix}products (
			item_ID int(4) NOT NULL auto_increment,
			item_SKU varchar(20) NOT NULL default '',
			item_name varchar(255) NOT NULL default '',
			item_description text NOT NULL,
			item_price float NOT NULL default 0.0,
			item_shipping float NOT NULL default 0.0,
			item_category varchar(255) NOT NULL default '',
			item_stock int(4) NOT NULL default 1,
			item_image varchar(255) NOT NULL default 'noimage.gif',
			PRIMARY KEY  (item_ID),
			UNIQUE KEY item_SKU (item_SKU),
			KEY item_name (item_name)
		);
		CREATE TABLE {$this->config->table_prefix}orders (
			order_ID int(4) NOT NULL auto_increment,
			order_name varchar(255) NOT NULL default '',
			order_address text NOT NULL,
			order_date datetime NOT NULL,
			order_phone varchar(255) NOT NULL default '',
			order_email varchar(255) NOT NULL default '',
			order_IP varchar(15) NOT NULL default '',
			order_order text NOT NULL,
			order_cost float NOT NULL default 0.0,
			order_shipping float NOT NULL default 0.0,
			order_shipby varchar(255) NOT NULL default '',
			order_payby varchar(255) NOT NULL default '',
			order_trans_ID varchar(255) NOT NULL default '',
			order_status int(4) NOT NULL default 0,
			order_shipdate date,
			PRIMARY KEY  (order_ID),
			KEY order_name (order_name),
			KEY order_trans_ID (order_trans_ID)
		);
		";

		return parent::upgrade($queries, true, false);
	}
}

// Extend microsession to enable non-WordPress authentication
class microshopsession extends microsession
{
	function do_auth($user, $pass)
	{
		if($this->config->UseWordPressDB)
		{
			return parent::do_auth($user, $pass, $this->config->minuserlevel);
		}
		else
		{
			return $pass == md5(md5($this->config->adminpassword));
		}
	}
}

class microshoprewrite extends microrewrite
{
	function init_rules()
	{
		global $config, $tableexists;
		$this->rules['actions'] = array('/^\/([^\/]+)\/?$/', 'action');
		$this->rules['categories'] = array('/^\/(category)\/([^\/]+)\/?$/', 'action,category');
		$this->rules['prodids'] = array('/^\/(edititem|stocktoggle)\/([0-9]+)\/?$/', 'action,prodid');
		$this->rules['itemsku'] = array('/^\/(add2cart)\/([^\/]+)\/?$/', 'action,itemsku');
		$this->rules['delete'] = array('/^\/(deleteitem)\/([^\/]+)\/?$/', 'action,delete');
		$this->rules['vieworders'] = array('/^\/(vieworders)\/(all|unpaid|paid|shipped|caution)\/?$/', 'action,orders');
		/* // Sub-pages...  Future?
		$this->rules['pages'] = array('/^\/([a-z:0-9_\\-\/\\s.!]+)\/?/i', 'page');
		$this->rules['pageactions'] = array('/^\/([a-z:0-9_\\-\/\\s.!]+)\/(view|edit|move|delete|image|media|upload|logout|rebuild|history|rss)(?:\/([0-9]+))?\/?$/i', 'page,action,tag');
		*/
		
		$this->links['action'] = '/%action%';
		$this->links['action_category'] = '/%action%/%category%';
		$this->links['action_prodid'] = '/%action%/%prodid%';
		$this->links['action_itemsku'] = '/%action%/%itemsku%';
		$this->links['action_delete'] = '/%action%/%delete%';
		$this->links['action_vieworders'] = '/%action%/%orders%';
	}
}

class microshop {

	var $us_states;
	var $shipping_methods;
	var $payment_methods;
	var $config;
	var $db;
	var $session;
	var $enable_logging = false;
	var $specialmessage = '';
	var $templates = array();
	var $verified_callback;
	
	function microshop() {
		$this->us_states = array( 'AK'=>'Alaska', 'AL'=>'Alabama', 'AR'=>'Arkansas', 'AZ'=>'Arizona', 'CA'=>'California', 'CO'=>'Colorada', 'CT'=>'Conneticut', 'DC'=>'District of Colombia', 'DE'=>'Delaware', 'FL'=>'Florida', 'GA'=>'Georgia', 'HI'=>'Hawaii', 'IA'=>'Iowa', 'ID'=>'Idaho', 'IL'=>'Illinois', 'IN'=>'Indiana', 'KS'=>'Kansas', 'KY'=>'Kentucky', 'LA'=>'Louisiana', 'MA'=>'Massachusetts', 'MD'=>'Maryland', 'ME'=>'Maine', 'MI'=>'Michigan', 'MN'=>'Minnesota', 'MO'=>'Missouri', 'MS'=>'Mississippi', 'MT'=>'Montana', 'NC'=>'North Carolina', 'ND'=>'North Dakota', 'NE'=>'Nebraska', 'NH'=>'New Hampshire', 'NJ'=>'New Jersey', 'NM'=>'New Mexico', 'NV'=>'Nevada', 'NY'=>'New York', 'OH'=>'Ohio', 'OK'=>'Oklahoma', 'OR'=>'Oregon', 'PA'=>'Pennsylvania', 'RI'=>'Rhode Island', 'SC'=>'South Carolina', 'SD'=>'South Dakota', 'TN'=>'Tennessee', 'TX'=>'Texas', 'UT'=>'Utah', 'VI'=>'Virgin Islands', 'VT'=>'Vermont', 'VA'=>'Virginia', 'WA'=>'Washington', 'WI'=>'Wisconsin', 'WV'=>'West Virginia', 'WY'=>'Wyoming', );

		/** Shipping Methods **/
		
		// Add a new line for each shipping method:
		//$this->add_shipping_calc( NAME_OF_METHOD, CALLBACK_FUNCTION );
		$this->add_shipping_calc('Total Up Shipping', array(&$this, 'calc_shipping_total'));
		//$this->add_shipping_calc('ODS Airborne', array(&$this, 'calc_shipping_one_max'));
		//$this->add_shipping_calc('UPS Ground', array(&$this, 'calc_shipping_upsground'));
		$this->add_shipping_calc('Pick up at store', array(&$this, 'calc_shipping_pickup'));
		
		// Add a new line for each payment method:
		//$this->add_payment_method( NAME_OF_METHOD, CALLBACK_FUNCTION );
		$this->add_payment_method('Paypal', array(&$this, 'payment_paypal'));
		$this->add_payment_method('Check or Money Order', array(&$this, 'payment_check'));
		

		$this->config = new microshopconfig(__FILE__);
		$this->db = new microshopdb(&$this->config);
		$this->session = new microshopsession('microshop' . md5($this->config->shopname));
		$this->rewrite = new microshoprewrite($this->config->baselocation, $this->config->baselocation_ssl, $this->config->linkstruct=='Friendly');
		$this->session->config = &$this->config;
		$this->get_templates();
	}
	
	function currency_to_symbol() {
		switch($this->config->currency) {
		case 'USD': return '$';
		case 'GBP': return '&pound;';
		case 'EUR': return '&euro;';
		}
	}
	
	function add_shipping_calc($description, $callback) {
		$this->shipping_methods[$description] = $callback;
	}

	function add_payment_method($description, $callback) {
		$this->payment_methods[$description] = $callback;
	}

	// This function displays a product table row
	function product_row($item, $quantity=false)
	{
		$template = $this->templates['item_row'];
		$t = new microtemplate($template);
		$t->set_field('SKU', $item->item_SKU);
		$t->set_field('category_URL', $this->rewrite->get_link(array('category'=>$item->item_category, 'action'=>'category')));
		$t->set_field('category', $item->item_category);
		$t->set_field('name', $item->item_name);
		if(substr($item->item_image, 0, 7) == 'http://') {
			$t->set_field('image_URL', $item->item_image);
			$t->set_field('has_image', true);
		}	
		else if($item->item_image == '') {
			$t->set_field('image_URL', "{$this->config->image_url}/noimage.gif");
		}	
		else {
			$t->set_field('image_URL', "{$this->config->image_url}/{$item->item_image}");
			$t->set_field('has_image', true);
		}
		$t->set_field('description', $item->item_description);
		if($item->item_stock > 0) $t->set_field('in_stock', $item->item_stock);
		if($this->session->is_auth()) $t->set_field('is_auth', true);
		$t->set_field('edit_URL', $this->rewrite->get_link(array('action'=>'edititem', 'prodid'=>$item->item_ID)));
		$t->set_field('stocktoggle_URL', $this->rewrite->get_link(array('action'=>'stocktoggle', 'prodid'=>$item->item_ID)));
		$t->set_field('price', number_format($item->item_price, 2));
		if($quantity) $t->set_field('set_quantity', true);
		$t->set_field('quantity', @$this->session->cart[$item->item_SKU]);
		if(@$this->session->cart[$item->item_SKU] > 0) $t->set_field('in_cart', true);
		$t->set_field('cart_URL', $this->rewrite->get_link(array('action'=>'showcart')));
		$t->set_field('add_item_URL', $this->rewrite->get_link(array('action'=>'add2cart', 'itemsku'=>$item->item_SKU)));
		$t->set_field('delete_URL', $this->rewrite->get_link(array('action'=>'deleteitem', 'delete'=>$item->item_SKU)));
		$t->set_field('currency', $this->currency_to_symbol());
		echo $t->render();
	}
	
		
	// Add one function for each shipping method to calculate shipping cost:
	function calc_shipping_total($shippingfees, &$message)
	{
		/*
		   This function sums the item_shipping value of each product
		   and returns it as the shipping cost.
		   You can convert this function to use the item_shipping
		   field as a weight, then compare the weight to a table
		   for your shipping method to calculate the total cost.
		*/
		
		$message = $this->currency_to_symbol() . number_format(array_sum($shippingfees), 2);
		return array_sum($shippingfees);
	}
	
	function calc_shipping_one_max($shippingfees, &$message)
	{
		$count = count($shippingfees) - 1;
		$max = array_reduce($shippingfees, create_function('$a,$b', 'return (($a > $b) ? $a : $b);'));
		$shipping = $max + $count;
		$message = $this->currency_to_symbol() . number_format($shipping, 2);
		return $shipping;
	}
		
	function calc_shipping_upsground($shippingfees, &$message)
	{
		global $config;
		require_once("ups.php");
		$rate = new Ups;
		$rate->upsProduct("GND");   // See upsProduct() function for codes
		$rate->origin($this->config->shipfrom, "US"); // Use ISO country codes!
		$rate->dest($_REQUEST['zipcode'], "US");   // Use ISO country codes!
		$rate->rate("CC");     // See the rate() function for codes
		$rate->container("CP"); // See the container() function for codes
		$rate->weight(round(array_sum($shippingfees)));
		$rate->rescom("RES");   // See the rescom() function for codes
		$quote = $rate->getQuote();
		if(is_numeric($quote))
		{
			$message = $this->currency_to_symbol() . number_format($quote, 2);
			return $quote;
		}
		else
		{
			$message = "Need zip code";
			return 0;
		}
	}
	
	function calc_shipping_pickup($shippingfees, &$message)
	{
		$message = 'Free!';
		return 0;
	}
	
	function page_header() {
		echo '
			<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
			<html>
			<head>
			<title>' . $this->config->shopname . '</title>
			<meta name="generator" content="MicroShop 1.0">
			<meta name="generator_url" content="http://www.asymptomatic.net">
			<link rel="stylesheet" type="text/css" media="screen" href="' . $this->config->baselocation . '/' . $this->config->shop_css . '" />
			</head>
			
			<body>
		';
	}
	
	function page_footer() {
		echo '
			</body>
			</html>
		';
	}
	
	function show_panel() {
		if($this->session->auth_form())
		{
			$userlogin = $this->config->UseWordPressDB
				? "You are logged in as the WordPress user '{$this->session->session_username}'."
				: "You are logged in using the password stored in the shop config.";
			echo "<h2>{$this->config->shopname} Control Panel</h2>
				<p>{$userlogin}</p>
				<p>MicroShop version:" . MICROSHOP_VERSION . "</p>
				<ul>
				<li><a href=\"". $this->rewrite->get_link(array('action'=>'install')) . "\">Change Configuration</a></li>
				<li><a href=\"". $this->rewrite->get_link(array('action'=>'additem')) . "\">Add Product</a></li>
				<li><a href=\"". $this->rewrite->get_link(array('action'=>'vieworders')) . "\">View Orders</a></li>
				<li><a href=\"". $this->rewrite->get_link(array()) . "\">View the Shop</a></li>
				</ul>
			";
		}
	}
	
	function show_install() {
		if(!$this->db->table_exists($this->config->table_prefix . 'products') || $this->session->auth_form())
		{
			if($this->config->write_post())
			{
				$this->db = new microshopdb(&$this->config);
				echo "<h2>Database Upgrades</h2>\n";
				$upgrades = $this->db->upgrade();
				echo "<hr>\n";
			}
			echo "<p>Return to the <a href=\"". $this->rewrite->get_link(array('action'=>'panel')) . "\">Control Panel</a>.</p>\n";
			echo "<h2>Shop Configuration</h2>\n";
			$this->config->editform(true);
			echo '<p><a href="' . $this->rewrite->get_link() . '">Return to the shop</a></p>';
		}
	}
	
	function show_default() {
		$categories = $this->db->get_results("select * from {$this->config->table_prefix}products group by item_category order by item_category;");
		if(count($categories) > 1) {
			echo "<h2>Product Categories</h2>\n";
			echo "<table id=\"#categories\" class=\"microshop\">\n";
			foreach($categories as $category)
			{
				echo "<tr>\n";
				echo "<td colspan=\"6\" class=\"category_title\"><strong>Category:</strong> <a href=\"" . $this->rewrite->get_link(array('category'=>$category->item_category, 'action'=>'category')) . "\">{$category->item_category}</a></td>\n";
				echo "</tr>\n";
				$this->product_row($category);
				echo "<tr>\n";
				echo "<td colspan=\"6\" class=\"category_more\">See more in <a href=\"" . $this->rewrite->get_link(array('category'=>$category->item_category, 'action'=>'category')) . "\">{$category->item_category}</a></td>\n";
				echo "</tr>\n";
			}
			echo "</table>\n";
			echo "<div id=\"viewcart\">" . $this->linkasbutton($this->rewrite->get_link(array('action'=>'viewcart')), 'View Shopping Cart');
			if($this->session->is_auth()) echo $this->linkasbutton($this->rewrite->get_link(array('action'=>'panel')), 'Control Panel');
			echo "</div>";
			return true;
		}
		else
		{
			return false;
		}
	}
	
	function show_category($catname = '', $isdefault = false) {
		$qpage = isset($_REQUEST['catpage']) ? $_REQUEST['catpage'] - 1 : 0;
		$page = $qpage * $this->config->itemsperpage;
		$displaycat = ($catname == '' ) ? 'All Products' : "{$catname} - Product Listing";
		$catname = ($catname == '' ) ? '1' : "item_category = '{$catname}'";
		$products = $this->db->get_results("select * from {$this->config->table_prefix}products WHERE {$catname} order by item_name LIMIT {$page}, {$this->config->itemsperpage};");
		$productcount =  $this->db->get_var("select count(item_ID) as ttl from {$this->config->table_prefix}products WHERE {$catname};");
		$pages = ceil($productcount / $this->config->itemsperpage);
		for($z=1;$z<=$pages;$z++)
		{
			if($z != $qpage + 1)
			{
				$pagebar .= "<a href=\"" . $this->rewrite->get_link('catpage', $z) . "\">[{$z}]</a> ";
			}
			else
			{
				$pagebar .= "[{$z}] ";
			}
		}
		$pagebar = $pagebar == '' ? "Page: [1]" : "Page: {$pagebar}";
		echo "<h2 id=\"productlisting\">{$displaycat}</h2>\n";
		echo "<div class=\"pagebar\">{$pagebar}</div>\n";
		echo "<table id=\"#categories\" class=\"microshop\">\n";
		foreach($products as $product)
		{
			$this->product_row($product);
		}
		echo "</table>\n";
		echo "<div class=\"pagebar\">{$pagebar}</div>\n";
		echo '<div id="viewcart">' . $this->linkasbutton($this->rewrite->get_link(array('action'=>'showcart')), 'View Shopping Cart');
		if(!$isdefault) echo $this->linkasbutton($this->rewrite->get_link(array()), 'Show Categories');
		if($this->session->is_auth()) echo $this->linkasbutton($this->rewrite->get_link(array('action'=>'panel')), 'Control Panel');
		echo "</div>";
	}
	
	function handle_cart() {
		switch(@$_POST['cartaction']) {
		case 'Check Out':
			$this->show_checkout();
			break;
		case 'Update Cart':
			$this->update_cart();
		default:
			$this->show_cart();		
		}
	}
	
	function show_cart() {
		echo "<h2>Your Shopping Cart</h2>\n";
		if($this->specialmessage != '') echo "<div id=\"specialmessage\">{$this->specialmessage}</div>";
		echo "<form method=\"post\" action=\"" . $this->rewrite->get_link(array('action'=>'showcart')) . "\">";
		if(is_array($this->session->cart) && count($this->session->cart) > 0)
		{
			echo "<table id=\"#categories\" class=\"microshop\">\n";
			foreach($this->session->cart as $item_SKU => $quantity)
			{
				$dbitem = $this->db->get_row("SELECT * FROM {$this->config->table_prefix}products WHERE item_SKU = '{$item_SKU}'");
				$total += $dbitem->item_price * $quantity;
				$shipping += $dbitem->item_shipping * $quantity;
				$this->product_row($dbitem, true);
			}
			echo "<tr><td id=\"cart_subtotal\" colspan=\"4\"><strong>Subtotal: </strong>" . $this->currency_to_symbol() . number_format($total, 2) . "</td></tr>\n";
			echo "<tr><td id=\"cart_shipping\" colspan=\"4\"><strong>Shipping & handling: </strong>to be determined</td></tr>\n";
			echo "<tr><td id=\"cart_total\" colspan=\"4\"><strong>Total: </strong>" . $this->currency_to_symbol() . number_format($total, 2) . " + shipping</td></tr>\n";
			echo "</table>\n";
			echo '<input type="submit" id="update_cart" name="cartaction" value="Update Cart" />';
			echo '<input type="submit" id="checkout" name="cartaction" value="Check Out" />';
		}
		else
		{
			echo "<p>Your cart is empty.</p>";
		}
		echo "</form>";
		echo $this->linkasbutton($this->rewrite->get_link(array()), 'Continue Shopping');
	}
	
	function show_add2cart() {
		if(isset($_REQUEST['itemsku']))
		{
			$this->session->cart[$_REQUEST['itemsku']] += 1;
		}
		$this->session->save();
		if(!$this->config->addshowcart)
		{
			header("Location: {$_SERVER['HTTP_REFERER']}#product_{$_REQUEST['itemsku']}");
			echo "<p><a href=\"{$_SERVER['HTTP_REFERER']}#product_{$_REQUEST['itemsku']}\">Return to shop</a></p>";
			return true;
		}
		$this->specialmessage = "Item Added to Cart";
		return false;
	}
	
	function update_cart() {
		if(isset($_POST['quantity']))
		{
			foreach($_POST['quantity'] as $key => $value)
			{
				$this->session->cart[$key] = $value;
				if($value <= 0)
				{
					unset($this->session->cart[$key]);
				}
			}
			$this->specialmessage = "Shopping Cart Updated";
		}
		$this->session->save();
	}

	function show_deleteitem($sku) {
		if($this->session->auth_form())
		{
			if(isset($_REQUEST['confirmdelete'])) {
				$this->db->query("DELETE FROM {$this->config->table_prefix}products WHERE item_SKU = '{$sku}' LIMIT 1;");
				echo "<div id=\"specialmessage\">Item Deleted</div>";
			}
			else {
				$item = $this->db->get_row("SELECT * FROM {$this->config->table_prefix}products WHERE item_SKU = '{$sku}' LIMIT 1;");
				echo "
					<form class=\"microshop\" method=\"post\" action=\"" . $this->rewrite->get_link(array('action'=>'deleteitem','delete'=>$sku)) . "\">
					<p>Are you sure that you want to delete this item from the shop:</p>
					<dl>
					<dt>Item Name:</dt>
					<dd>{$item->item_name}</dd>
					<dt>Item SKU:</dt>
					<dd>{$sku}</dd>
					</dl>
					<input type=\"submit\" name=\"confirmdelete\" value=\"Confirm\" />
					</form>
				";
			}
			echo $this->linkasbutton($this->rewrite->get_link(array('action'=>'panel')), 'Control Panel');
		}
	}
	
	function show_edititem($doadd = false) {
		if($this->session->auth_form())
		{
			if(isset($_POST['act']))
			{
				if($_POST['prodid'] == -1)
				{
					if($_POST['generateSKU'] == 'true')
					{
						$wrds = explode(' ', $_POST['item_name']);
						$wrds = strtolower(implode(array_map(create_function('$a', 'return substr($a, 0, 3);'), $wrds)));
						$sku = dechex(rand(1048576, 16777215));
						$skuid = 0;							
						do
						{
							$sku = $wrds . (++$skuid);
						} while ($this->db->get_row("SELECT * FROM {$this->config->table_prefix}products WHERE item_SKU = '{$sku}';"));
					}
					else
					{
						$sku = $_POST['item_SKU'];
					}			
					$qry = "INSERT INTO {$this->config->table_prefix}products (item_name, item_SKU, item_category, item_description, item_price, item_shipping, item_stock, item_image) VALUES (";
					$qry .= "'{$_POST['item_name']}', ";
					$qry .= "'{$sku}', ";
					$qry .= "'{$_POST['item_category']}', ";
					$qry .= "'{$_POST['item_description']}', ";
					$qry .= "{$_POST['item_price']}, ";
					$qry .= "{$_POST['item_shipping']}, ";
					if(isset($_POST['item_stock']) && ($_POST['item_stock'] == 1))
					{
						$qry .= "1, ";
					}
					else
					{
						$qry .= "0, ";
					}
					$qry .= "'{$_POST['item_image']}');";
					if(!$this->db->query($qry))
					{
						$this->db->get_error(true);
					}
					else
					{
						$action = 'edititem';
						$_REQUEST['prodid'] = $this->db->insert_id;
						$this->specialmessage = 'Product added to database.';
					}
				}
				else
				{
					$qry = "UPDATE {$this->config->table_prefix}products SET ";
					$qry .= "item_name = '{$_POST['item_name']}', ";
					$qry .= "item_SKU = '{$_POST['item_SKU']}', ";
					$qry .= "item_category = '{$_POST['item_category']}', ";
					$qry .= "item_description = '{$_POST['item_description']}', ";
					$qry .= "item_price = {$_POST['item_price']}, ";
					$qry .= "item_shipping = {$_POST['item_shipping']}, ";
					if(isset($_POST['item_stock']) && ($_POST['item_stock'] == 1))
					{
						$qry .= "item_stock = 1, ";
					}
					else
					{
						$qry .= "item_stock = 0, ";
					}
					$qry .= "item_image = '{$_POST['item_image']}'";
					$qry .= "WHERE item_ID = {$_POST['prodid']} LIMIT 1;";
					if(!$this->db->query($qry))
					{
						$this->db->get_error(true);
					}
					else
					{
						$this->specialmessage = 'Product definition updated.';
					}
				}
			}
			if($doadd)
			{
				echo "<h2>Add Item</h2>
					<p>Enter values for all fields and click Submit to add a new product to the shop.</p>
				";
				$act = "Add";
				$prodid = '-1';
			}
			else
			{
				echo "<h2>Edit Item</h2>
					<p>Modify the values for any fields and click Submit to update the product in the shop.</p>
				";
				$act = "Update";
				$prodid = $_REQUEST['prodid'];
				$item = $this->db->get_row("SELECT * FROM {$this->config->table_prefix}products WHERE item_ID = {$prodid}");
			}
			if($this->specialmessage != '') echo "<div id=\"specialmessage\">{$this->specialmessage}</div>";
			echo "
				<form class=\"microshop\" method=\"post\" action=\"" . $this->rewrite->get_link(array('action'=>'additem')) . "\">
				<script type=\"text/javascript\"><!--
				function newtest(obj)
				{
					len = obj.length;
					for(i = 0; i < len; i++)
					{
						if(obj.options[i].text == \"--New--\" && obj.options[i].selected == true)
						{
							var text = prompt(\"Enter the new category\", \"\");
							obj.options[len]= new Option(text);
							obj.options[len].selected = true;
							return true;
						}
					}
				}
				//--></script>
				<div>
				<dl>
				<dt>Item Name:</dt>
				<dd><input type=\"text\" name=\"item_name\" value=\"{$item->item_name}\" /></dd>
				<dt>Item SKU (must be unique):</dt>
				<dd>
			";
			if($doadd)
			{
				echo "<input type=\"radio\" name=\"generateSKU\" value=\"false\" onClick=\"getElementById('item_SKU').enabled = true;\" /> <input type=\"text\" name=\"item_SKU\" id=\"item_SKU\" value=\"{$item->item_SKU}\" />
					<br/><label><input type=\"radio\" name=\"generateSKU\" value=\"true\" onClick=\"getElementById('item_SKU').value = '---';\" /> Auto-Generate</label>";
			}
			else
			{
				echo "<input type=\"text\" name=\"item_SKU\" id=\"item_SKU\" value=\"{$item->item_SKU}\" />";
			}
			echo "</dd>
				<dt>Category:</dt>
				<dd><select name=\"item_category\" onChange=\"newtest(this);\">
			";
			$categories = $this->db->get_col("SELECT DISTINCT item_category FROM {$this->config->table_prefix}products ORDER BY item_category");
			foreach($categories as $category)
			{
				echo "<option value=\"{$category}\"";
				if($category == $item->item_category) echo ' selected="selected"';
				echo ">{$category}</option>\n";
			}
			echo "
				<option>--Choose One--</option>
				<option>--New--</option>
				</select>
				<dt>Description:</dt>
				<dd><textarea name=\"item_description\">{$item->item_description}</textarea></dd>
				<dt>Price:</dt>
				<dd><input type=\"text\" name=\"item_price\" value=\"{$item->item_price}\" /></dd>
				<dt>Shipping:</dt>
				<dd><input type=\"text\" name=\"item_shipping\" value=\"{$item->item_shipping}\" /></dd>
				<dt>In Stock:</dt>
				<dd><input type=\"checkbox\" name=\"item_stock\" value=\"1\"" . ($item->item_stock == 1?' checked="checked"':'') . " /></dd>
				<dt>Product Image URL:</dt>
				<dd><input type=\"text\" name=\"item_image\" value=\"{$item->item_image}\" /></dd>
				</dl>
				</div>
				<div id=\"form_submit\">
				<input type=\"hidden\" name=\"prodid\" value=\"{$prodid}\" />
				<input type=\"submit\" name=\"act\" value=\"{$act} Item\" />
				</div>
				</form>
			";
			echo "<div id=\"viewcart\">" . $this->linkasbutton($this->rewrite->get_link(array('action'=>'viewcart')), 'View Shopping Cart');
			echo $this->linkasbutton($this->rewrite->get_link(array('action'=>'panel')), 'Control Panel');
			echo "</div>";
		}
	}
	
	function toggle_stock($prodid) {
		if($this->session->auth_form())
		{
			if($this->db->query("UPDATE {$this->config->table_prefix}products SET item_stock = 1 - item_stock WHERE item_ID = {$prodid} LIMIT 1;"))
				header("location: {$_SERVER['HTTP_REFERER']}");
			else
				$this->db->get_error(true);
		}
	}
	
	function show_order() {
		if($this->session->auth_form())
		{
			if(isset($_REQUEST['order']))
			{
				if(isset($_REQUEST['newstatus']))
				{
					$this->db->query("UPDATE {$this->config->table_prefix}orders SET order_status = {$_REQUEST['newstatus']} WHERE order_trans_ID = '{$_REQUEST['order']}';");
					$this->specialmessage = "<div id=\"specialmessage\">Status Updated.</div>";
					if($_POST['newstatus'] == 4)
					{
						$this->db->query("UPDATE {$this->config->table_prefix}orders SET order_shipdate = now() WHERE order_trans_ID = '{$_REQUEST['order']}';");
						$this->specialmessage = "<div id=\"specialmessage\">Status and Ship Date Updated.</div>";
					}
				}
				echo "<h2>View Order</h2>
					{$this->specialmessage}
					<div id=\"ordermenu\">
					<a href=\"" . $this->rewrite->get_link(array('action'=>'vieworders', 'orders'=>'all')) . "\">All</a>
					<a href=\"" . $this->rewrite->get_link(array('action'=>'vieworders', 'orders'=>'unpaid')) . "\">Unpaid</a>
					<a href=\"" . $this->rewrite->get_link(array('action'=>'vieworders', 'orders'=>'paid')) . "\">Paid</a>
					<a href=\"" . $this->rewrite->get_link(array('action'=>'vieworders', 'orders'=>'shipped')) . "\">Shipped</a>
					<a href=\"" . $this->rewrite->get_link(array('action'=>'vieworders', 'orders'=>'caution')) . "\">Caution</a>
					</div>
				";
				if($order = $this->db->get_row("SELECT * FROM {$this->config->table_prefix}orders WHERE order_trans_ID = '{$_REQUEST['order']}';"))
				{
					$address = implode("<br/>", explode("\n", $order->order_address));
					$order_order = implode("<br/>", explode("\n", $order->order_order));
					$options[] = '<option value="0"' . ($order->order_status == 0? ' selected="selected"' : '') .'>Incomplete</option>';
					$options[] = '<option value="1"' . ($order->order_status == 1? ' selected="selected"' : '') .'>Waiting for PayPal</option>';
					$options[] = '<option value="2"' . ($order->order_status == 2? ' selected="selected"' : '') .'>Waiting for Check</option>';
					$options[] = '<option value="3"' . ($order->order_status == 3? ' selected="selected"' : '') .'>Payment Received</option>';
					$options[] = '<option value="4"' . ($order->order_status == 4? ' selected="selected"' : '') .'>Shipped</option>';
					$options[] = '<option value="5"' . ($order->order_status == 5? ' selected="selected"' : '') .'>PayPal Pending</option>';
					$options[] = '<option value="6"' . ($order->order_status == 6? ' selected="selected"' : '') .'>PayPal Failed</option>';
					$options = implode("\n", $options);
					echo "
						<dl>
							<dt>Trans #:</dt><dd>{$order->order_trans_ID}</dd>
							<dt>Order Date:</dt><dd>{$order->order_date}</dd>
							<dt>Name:</dt><dd>{$order->order_name}</dd>
							<dt>Address:</dt><dd>{$address}</dd>
							<dt>Email:</dt><dd>{$order->order_email}</dd>
							<dt>IP Address:</dt><dd>{$order->order_IP}</dd>
							<dt>Phone:</dt><dd>{$order->order_phone}</dd>
							<dt>Items Ordered:</dt><dd>{$order_order}</dd>
							<dt>Subtotal:</dt><dd>" . $this->currency_to_symbol() . number_format($order->order_cost, 2) . "</dd>
							<dt>Shipping:</dt><dd>" . $this->currency_to_symbol() . number_format($order->order_shipping, 2) . "</dd>
							<dt>Total:</dt><dd>" . $this->currency_to_symbol() . number_format($order->order_cost + $order->order_shipping, 2) . "</dd>
							<dt>Ship Via:</dt><dd>{$order->order_shipby}</dd>
							<dt>Pay By:</dt><dd>{$order->order_payby}</dd>
							<dt>Ship Date:</dt><dd>{$order->order_shipdate}</dd>
						</dl>
						<div class=\"form_submit\">
						<form method=\"post\">
						<select name=\"newstatus\">
						{$options}
						</select>
						<input type=\"submit\" name=\"submit\" value=\"Update Status\" /> 
						</div>
						</form>
					";
				}
				else
				{
					echo "<p>No order exists with that transaction ID.</p>";
				}
			}
		}
	}
	
	function show_orders($orders) {
		if($this->session->auth_form())
		{
			if(isset($_POST['trans']))
			{
				$deleted = 0;			
				foreach($_POST['trans'] as $transid)
				{
					$this->db->query("DELETE FROM {$this->config->table_prefix}orders WHERE order_trans_ID = '{$transid}'");
					$deleted++;
				}
				$this->specialmessage = "<div id=\"specialmessage\">Deleted {$deleted} orders</div>";
			}
			if($orders)
			{
				$qtype = $orders;
			}
			else
			{
				$qtype = 'paid';
			}
			$newstatus = -1;
			$link_status = array('all'=>'', 'unpaid'=>'', 'paid'=>'', 'shipped'=>'', 'caution'=>'');
			$link_status[$qtype] = ' class="selected" ';
			switch($qtype)
			{
			case 'all': $qry = "SELECT * FROM {$this->config->table_prefix}orders;"; break;
			case 'unpaid': $qry = "SELECT * FROM {$this->config->table_prefix}orders WHERE order_status = 1 OR order_status = 2 ORDER BY order_date;"; $newstatus = 3; $newstatustext = 'paid'; break;
			case 'paid': $qry = "SELECT * FROM {$this->config->table_prefix}orders WHERE order_status = 3 ORDER BY order_date;"; $newstatus = 4; $newstatustext = 'shipped'; break;
			case 'shipped': $qry = "SELECT * FROM {$this->config->table_prefix}orders WHERE order_status = 4 ORDER BY order_date;"; break;
			case 'caution': $qry = "SELECT * FROM {$this->config->table_prefix}orders WHERE order_status IN (0, 5, 6) ORDER BY order_date;"; $newstatus = 3; $newstatustext = 'paid'; break;
			}
	
			echo "<h2>View {$qtype} Orders</h2>
				{$this->specialmessage}
				<div id=\"ordermenu\">
				<a href=\"" . $this->rewrite->get_link(array('action'=>'vieworders', 'orders'=>'all')) . "\" {$link_status['all']}>All</a>
				<a href=\"" . $this->rewrite->get_link(array('action'=>'vieworders', 'orders'=>'unpaid')) . "\" {$link_status['unpaid']}>Unpaid</a>
				<a href=\"" . $this->rewrite->get_link(array('action'=>'vieworders', 'orders'=>'paid')) . "\" {$link_status['paid']}>Paid</a>
				<a href=\"" . $this->rewrite->get_link(array('action'=>'vieworders', 'orders'=>'shipped')) . "\" {$link_status['shipped']}>Shipped</a>
				<a href=\"" . $this->rewrite->get_link(array('action'=>'vieworders', 'orders'=>'caution')) . "\" {$link_status['caution']}>Caution</a>
				</div>
			";
	
			$orders = $this->db->get_results($qry);
	
			if($orders)
			{
				echo "<form method=\"post\">
				<table id=\"orders\"><thead></thead><tbody>";
				foreach($orders as $order)
				{
					$alternate = $alternate == 'even_row' ? 'even_row' : 'odd_row';
					switch($order->order_status)
					{
					case 0: $status = 'Incomplete'; break;
					case 1: $status = 'Waiting for PayPal'; break;
					case 2: $status = 'Waiting for Check'; break;
					case 3: $status = 'Payment Received'; break;
					case 4: $status = 'Shipped'; break;
					case 5: $status = 'PayPal Pending'; break;
					case 6: $status = 'PayPal Failed'; break;
					}
					echo "<tr class=\"{$alternate}\"><td class=\"order_trans\" colspan=\"4\">
							<input type=\"checkbox\" name=\"trans[]\" value=\"{$order->order_trans_ID}\" />
							<strong>Trans #:</strong> <a href=\"".$this->rewrite->get_link(array('action'=>'vieworder', 'order'=>$order->order_trans_ID))."\">{$order->order_trans_ID}</a>
					";
					if($newstatus != -1) echo "<a href=\"".$this->rewrite->get_link(array('action'=>'vieworder', 'order'=>$order->order_trans_ID, 'newstatus'=>$newstatus))."\">[make {$newstatustext}]</a>";
					echo "
						</td></tr>
						<tr class=\"{$alternate}\">
							<td class=\"order_date\">{$order->order_date}</td>
							<td class=\"order_name\"><a href=\"mailto:{$order->order_email}?subject=Order from {$this->config->shopname}: {$order->order_trans_ID}&body=Regarding the order placed {$order->order_date}:\">{$order->order_name}</a></td>
							<td class=\"order_order\">{$order->order_order}</td>
							<td class=\"order_status\">{$status}</td>
						</tr>
					";
				}
				echo "</tbody></table>
				<div id=\"form_submit\"><input type=\"submit\" name=\"submit\" value=\"Delete Checked Orders\" onClick=\"return confirm('Are you sure you want to delete the selected orders?');\"></div>
				</form>";
				echo "<form id=\"trans_search\" method=\"get\">
				<label>Transaction ID Search: <input type=\"text\" name=\"order\" value=\"\" /></label>
				<input type=\"submit\" name=\"submit\" value=\"Search\" />
				<input type=\"hidden\" name=\"action\" value=\"vieworder\" />
				</form>
				";
			}
			else
			{
				echo "<p>No orders qualify under this criteria ('{$qtype}').</p>\n";
			}
			echo $this->linkasbutton($this->rewrite->get_link(array('action'=>'panel')), 'Control Panel');
		}
	}
	
	function show_checkout2() {
		if(!(
			$_POST['cust_name'] == ''
			|| $_POST['address'] == ''
			|| $_POST['city'] == ''
			|| $_POST['state'] == ''
			|| !preg_match('/^[0-9]{5}(-[0-9]{4})?$/', $_POST['zipcode'])
			|| !preg_match('/[A-Z0-9._%-]+@[A-Z0-9._%-]+\.[A-Z]{2,4}/i', $_POST['email'])
			|| !preg_match('/\\(?[0-9]{3}\\)?[-. ]*[0-9]{3}[-. ]*[0-9]{4}/', $_POST['phone'])
		))
		{
			//Form submission success
			echo "<h2>Verify Order</h2>
				<p>Please verify your order below.  If something is incorrect, click the Back button in your browser to make changes.</p>";
	
			echo "
				<h3>Shipping and Payment Details:</h3>
				<dl class=\"microshop\">
					<dt>Pay by:</dt>
					<dd>{$_REQUEST['payby']}</dd>
					<dt>Ship by:</dt>
					<dd>{$_REQUEST['shipby']}</dd>
					<dt>Name:</dt>
					<dd>{$_REQUEST['cust_name']}</dd>
					<dt>Address:</dt>
					<dd>{$_REQUEST['address']}</dd>
					<dt>City:</dt>
					<dd>{$_REQUEST['city']}</dd>
					<dt>State:</dt>
					<dd>{$this->us_states[$_REQUEST['state']]}</dd>
					<dt>Zip Code:</dt>
					<dd>{$_REQUEST['zipcode']}</dd>
					<dt>Phone Number:</dt>
					<dd>{$_REQUEST['phone']}</dd>
					<dt>Email:</dt>
					<dd>{$_REQUEST['email']}</dd>
				</dl>
			";
	
			echo "<h3 style=\"clear:left;\">Order Information</h3>\n<ul>\n";
			foreach($this->session->cart as $item_SKU => $quantity)
			{
				$dbitem = $this->db->get_row("SELECT * FROM {$this->config->table_prefix}products WHERE item_SKU = '{$item_SKU}'");
				$total += $dbitem->item_price * $quantity;
				//$shipping_items[] = $dbitem->item_shipping;
				for($z=1;$z<=$quantity;$z++) $shipping_items[] = $dbitem->item_shipping;
				echo "<li>{$quantity} &times; <em>{$dbitem->item_name}</em> @ " . $this->currency_to_symbol() . number_format($dbitem->item_price,2) . " each</li>\n";
			}
			echo "</ul>\n";
			echo "<div id=\"checkout_totals\"><p id=\"cart_subtotal\">Subtotal: " . $this->currency_to_symbol() . number_format($total, 2) . "</p>\n";
			$scost = call_user_func_array($this->shipping_methods[$_REQUEST['shipby']], array($shipping_items, &$message));
	
			echo "<p id=\"cart_shipping\">Shipping & Handling: " . $this->currency_to_symbol() . number_format($scost, 2) . "</p>\n";
			echo "<p id=\"cart_total\">Order Total: " . $this->currency_to_symbol() . number_format($total + $scost, 2) . "</p></div>\n";
	
			echo "<form method=\"post\" id=\"checkout\" class=\"microshop\" action=\"" . $this->rewrite->get_link(array('action'=> 'pay')) . "\">\n";
			foreach($_POST as $key=>$value)
			{
				echo "<input type=\"hidden\" name=\"{$key}\" value=\"{$value}\" />\n";
			}
			echo "<input type=\"submit\" name=\"buy\" value=\"Complete Order\" />\n</form>\n";
	
			return true;
		}
		$this->specialmessage = 'Please fill out all fields completely.';
		if($_POST['cust_name'] == '') $this->specialmessage .= '<br/>Please include your name.';
		if($_POST['address'] == '')  $this->specialmessage .= '<br/>Please include your address.';
		if($_POST['city'] == '')  $this->specialmessage .= '<br/>Please include your city.';
		if($_POST['state'] == '') $this->specialmessage .= '<br/>Please include your state.';
		if(!preg_match('/^[0-9]{5}(-[0-9]{4})?$/', $_POST['zipcode']))  $this->specialmessage .= '<br/>Please include a valid zip code.';
		if(!preg_match('/[A-Z0-9._%-]+@[A-Z0-9._%-]+\.[A-Z]{2,4}/i', $_POST['email']))  $this->specialmessage .= '<br/>Please include a valid email.';
		if(!preg_match('/\\(?[0-9]{3}\\)?[-. ]*[0-9]{3}[-. ]*[0-9]{4}/', $_POST['phone']))  $this->specialmessage .= '<br/>Please include a valid phone number.';		
		return false;
	}
	
	function show_checkout() {
		echo "<h2>Checkout - Payment and Shipping Info</h2>";
	
		if($this->specialmessage != '') echo "<div id=\"specialmessage\">{$this->specialmessage}</div>";
	
		echo "
			<p>" . str_replace("\n", '<br/>', $this->config->checkoutmessage) . "</p>
			<form method=\"post\" id=\"checkout\" class=\"microshop\" action=\"" . $this->rewrite->get_link(array('action'=>'checkout2')) . "\">
			<p>Please select your payment method:</p>
			<ul class=\"radiolist\">";
		$default = ' checked="checked"';
		foreach($this->payment_methods as $methodname => $methodfunction)
		{
			echo "<li><label><input type=\"radio\" name=\"payby\" value=\"{$methodname}\"{$default} /> {$methodname} </label></li>";
			$default = '';
		}
		echo "
			</ul>
			<p>Please select your shipping method:</p>
			<ul class=\"radiolist\">";
		foreach($this->session->cart as $item_SKU => $quantity)
		{
			$dbitem = $this->db->get_row("SELECT * FROM {$this->config->table_prefix}products WHERE item_SKU = '{$item_SKU}'");
			for($z=1;$z<=$quantity;$z++) $shipping_items[] = $dbitem->item_shipping;
		}
		$default = ' checked="checked"';
		foreach($this->shipping_methods as $methodname => $methodfunction)
		{
			echo "<li><label><input type=\"radio\" name=\"shipby\" value=\"{$methodname}\"{$default} /> {$methodname} (";
			$scost = call_user_func_array($methodfunction, array($shipping_items, &$message));
			echo $message;
			echo ")</label></li>";
			$default = '';
		}
		echo "
			</ul>
			<p>Please provide your shipping information:</p>
			<dl class=\"microshop\">
				<dt>Name:</dt>
				<dd><input type=\"text\" name=\"cust_name\" value=\"{$_REQUEST['name']}\" /></dd>
				<dt>Address:</dt>
				<dd><input type=\"text\" name=\"address\" value=\"{$_REQUEST['address']}\" /></dd>
				<dt>City:</dt>
				<dd><input type=\"text\" name=\"city\" value=\"{$_REQUEST['city']}\" /></dd>
				<dt>State:</dt>
				<dd><select name=\"state\">
					<option selected=\"selected\">Choose One</option>";
		foreach($this->us_states as $abbrev => $state)
		{
			echo "<option value=\"{$abbrev}\">{$state}</option>\n";
		}
		echo "
				</select></dd>
				<dt>Zip Code:</dt>
				<dd><input type=\"text\" name=\"zipcode\" size=\"10\" value=\"{$_REQUEST['zipcode']}\"/></dd>
				<dt>Phone Number:</dt>
				<dd><input type=\"text\" name=\"phone\" value=\"{$_REQUEST['phone']}\" /></dd>
				<dt>Email:</dt>
				<dd><input type=\"text\" name=\"email\" value=\"{$_REQUEST['email']}\" /></dd>
			</dl>
			<div id=\"form_submit\"><input type=\"submit\" name=\"submit\" value=\"Continue Checkout\" /></div>
			</form>
		";
	}
	
	function pay() {
		if(!(is_array($this->session->cart) && count($this->session->cart)))
		{
			die('fail');header('location: ' . $this->rewrite->get_link(array('action'=>'showcart')));
		}
		// Insert a record into the purchase table.
		$address = "{$_REQUEST['address']}\n{$_REQUEST['city']}, {$_REQUEST['state']}\n{$_REQUEST['zipcode']}";
		$order = '';
		foreach($this->session->cart as $item_SKU => $quantity)
		{
			$dbitem = $this->db->get_row("SELECT * FROM {$this->config->table_prefix}products WHERE item_SKU = '{$item_SKU}'");
			$cost += $dbitem->item_price * $quantity;
			for($z=1;$z<=$quantity;$z++) $shipping_items[] = $dbitem->item_shipping;
			$order .= "{$quantity} x {$dbitem->item_name} ({$item_SKU}) @ " . $this->currency_to_symbol() . number_format($dbitem->item_price, 2) . "\n";
		}
		$shipping = call_user_func_array($this->shipping_methods[$_REQUEST['shipby']], array($shipping_items, $message));
		$txnumber = date('Y') . sprintf('%02s%02s', dechex(intval(date('z'))), dechex($this->db->get_var("SELECT count(order_ID) FROM {$this->config->table_prefix}orders WHERE date(order_date) = date(now())")));
	
		$qry = "INSERT INTO {$this->config->table_prefix}orders (order_name, order_address, order_phone, order_email, order_IP, order_date, order_order, order_cost, order_shipping, order_shipby, order_payby, order_trans_ID, order_status) values (";
		$qry .= "'{$_REQUEST['cust_name']}', ";
		$qry .= "'{$address}', ";
		$qry .= "'{$_REQUEST['phone']}', ";
		$qry .= "'{$_REQUEST['email']}', ";
		$qry .= "'{$_SERVER['REMOTE_ADDR']}', ";
		$qry .= "now(), ";
		$qry .= "'". $order ."', ";
		$qry .= "{$cost}, ";
		$qry .= "{$shipping}, ";
		$qry .= "'{$_REQUEST['shipby']}', ";
		$qry .= "'{$_REQUEST['payby']}', ";
		$qry .= "'" . $txnumber . "', ";
		$qry .= "0);";
	
		if(!$this->db->query($qry))
		{
			die($this->db->get_error());
		}
		
		$insertid = $this->db->insert_id();
		/*
		$txnumber = base_convert($insertid * 7 + 531309907, 10, 16); //Unique alphanumeric trans IDs that are not sequential
		if(!$this->db->query("UPDATE {$this->config->table_prefix}orders set order_trans_ID = '{$txnumber}' WHERE order_ID = {$insertid};"))
		{
			die($this->db->get_error());
		}
		*/
	
		call_user_func_array($this->payment_methods[$_REQUEST['payby']], array($cost, $shipping, $txnumber));
	}
	
	function payment_paypal($cost, $shipping, $txnumber) {
		$completed = str_replace('&', '%26', str_replace('?', '%3F', $this->rewrite->get_link(array('action'=>'completed', 'trans'=>$txnumber))));
		$cancelled = str_replace('&', '%26', str_replace('?', '%3F', $this->rewrite->get_link(array('action'=>'cancelled', 'trans'=>$txnumber))));
		$notify_url = str_replace('&', '%26', str_replace('?', '%3F', $this->config->notify_url));
		if($notify_url == '') $notify_url = 'http://' . $_SERVER['HTTP_HOST'] . str_replace('&', '%26', str_replace('?', '%3F', $this->rewrite->get_link(array('action'=>'paypalverify', 'trans'=>$txnumber))));

		$payurl = "https://www.{$this->config->sandbox}paypal.com/xclick/business=";  //Use this one for actual transactions
		$payurl .= $this->config->paypal_account; //PayPal payee email
		$payurl .= "&item_name=Order+at+" . urlencode($this->config->shopname); // Puchased thing shown at PayPal
		$payurl .= "&item_number={$txnumber}"; // Item number, used transaction ID.
		$payurl .= "&amount=" . $cost; //Item price
		$payurl .= "&shipping=" . $shipping; //Item shipping
		$payurl .= "&no_shipping=1";
		$payurl .= "&return=" . "http://{$_SERVER['HTTP_HOST']}{$completed}";
		$payurl .= "&cancel_return=" . "http://{$_SERVER['HTTP_HOST']}{$cancelled}";
		$payurl .= "&notify_url={$notify_url}";
		$payurl .= "&no_note=1";
		$payurl .= "&currency_code=" . $this->config->currency; //Curency Used
		$payurl .= "&lc=US"; //Language Locale
		$payurl .= "&rm=2"; //Return method 1=get, 2=post

		//die($payurl);
		header("Location: {$payurl}");
	}
	
	function payment_check($cost, $shipping, $txnumber) {
		echo "<h2>Pay By Check</h2>";
		echo "<p>Thank you for your order!</p>
			<p>Please print out this invoice and send it with your payment to:</p>
			<blockquote>" . str_replace("\n", '<br/>', $this->config->payment_location) . "</blockquote>
			<p>Please allow time for your payment to arrive and clear before expecting delivery.</p>";

		echo "
			<h3>Shipping and Payment Details:</h3>
			<dl class=\"microshop\">
				<dt>Pay by:</dt>
				<dd>{$_REQUEST['payby']}</dd>
				<dt>Ship by:</dt>
				<dd>{$_REQUEST['shipby']}</dd>
				<dt>Name:</dt>
				<dd>{$_REQUEST['cust_name']}</dd>
				<dt>Address:</dt>
				<dd>{$_REQUEST['address']}</dd>
				<dt>City:</dt>
				<dd>{$_REQUEST['city']}</dd>
				<dt>State:</dt>
				<dd>{$this->us_states[$_REQUEST['state']]}</dd>
				<dt>Zip Code:</dt>
				<dd>{$_REQUEST['zipcode']}</dd>
				<dt>Phone Number:</dt>
				<dd>{$_REQUEST['phone']}</dd>
				<dt>Email:</dt>
				<dd>{$_REQUEST['email']}</dd>
			</dl>
		";

		echo "<h3 style=\"clear:left;\">Order Information</h3>\n<ul>\n";
		foreach($this->session->cart as $item_SKU => $quantity)
		{
			$dbitem = $this->db->get_row("SELECT * FROM {$this->config->table_prefix}products WHERE item_SKU = '{$item_SKU}'");
			echo "<li>{$quantity} &times; <em>{$dbitem->item_name}</em> @ " . $this->currency_to_symbol() . number_format($dbitem->item_price,2) . " each</li>\n";
		}
		echo "</ul>\n";
		echo "<div id=\"checkout_totals\"><p id=\"cart_subtotal\">Subtotal: " . $this->currency_to_symbol() . number_format($cost, 2) . "</p>\n";
		echo "<p id=\"cart_shipping\">Shipping & Handling: " . $this->currency_to_symbol() . number_format($shipping, 2) . "</p>\n";
		echo "<p id=\"cart_total\">Order Total: " . $this->currency_to_symbol() . number_format($cost + $shipping, 2) . "</p></div>\n";


		$this->db->query("UPDATE {$this->config->table_prefix}orders SET order_status = 2 WHERE order_trans_ID = '{$txnumber}'");
		$this->sendinvoice($txnumber, 0);
		$this->session->cart = array();
		$this->session->save();
	}
	
	function show_completed() {
		echo "<h2>Order Complete!</h2>
			<p>Thank you for your order!  You should receive a receipt for this order by email shortly.</p>";
		$this->db->query("UPDATE {$this->config->table_prefix}orders SET order_status = 1 WHERE order_status = 0 AND order_trans_ID = '{$_REQUEST['trans']}'");
		$this->sendinvoice($_REQUEST['trans'], 1);
		$this->session->cart = array();
		$this->session->save();
	}
	
	function show_cancelled() {
		echo "<h2>Order Cancelled!</h2>
			<p>Your order was not completed.  Please review the items in your <a id=\"viewcart\" href=\"" . $this->rewrite->get_link(array('action'=>'showcart')) . "\">shopping cart</a> and checkout again to place your order.</p>";
		$this->db->query("DELETE FROM {$this->config->table_prefix}orders WHERE order_status = 0 AND order_trans_ID = '{$_REQUEST['trans']}' LIMIT 1");
	}
	
	function verify_paypal() {
		while (@ob_end_clean());
	
		$req = 'cmd=_notify-validate';
		foreach ($_POST as $key => $value) 
		{
			$value = urlencode(stripslashes($value));
			$req .= "&$key=$value";
		}
		
		$header .= "POST /cgi-bin/webscr HTTP/1.0\r\n";
		$header .= "Content-Type: application/x-www-form-urlencoded\r\n";
		$header .= "Content-Length: " . strlen($req) . "\r\n\r\n";
		$fp = fsockopen ("www.{$this->config->sandbox}paypal.com", 80, $errno, $errstr, 30);
		
		$postvars = array('item_name', 'item_number', 'payment_status', 'mc_gross', 'mc_currency', 'txn_id', 'receiver_email', 'payer_email');
		foreach($postvars as $varname)
		{
			$$varname = $_POST[$varname];
		}
	
		if (!$fp) 
		{
			$this->outlog("Could not open route to Paypal");
		} 
		else 
		{
			fputs ($fp, $header . $req);
			while (!feof($fp)) 
			{
				$res = fgets ($fp, 1024);
		
				if (strcmp ($res, "VERIFIED") == 0) 
				{
					
					$good_trans = '';
					
					if($receiver_email != $this->config->paypal_account)
					{
						$good_trans .= "\nReceiver {$receiver_email} != Required: {$this->config->paypal_account}";
					}
		
					if($trans = $this->db->get_row("SELECT * FROM {$this->config->table_prefix}orders WHERE order_trans_ID = '{$item_number}';"))
					{
						if($mc_gross != ($trans->order_cost + $trans->order_shipping))
						{
							$good_trans .= "\nTrans Amount {$mc_gross} != Required: " . ($trans->order_cost + $trans->order_shipping);
						}
		
						if($good_trans == '')
						{
							switch(strtolower($payment_status))
							{
							case 'completed':
								$this->db->query("UPDATE {$this->config->table_prefix}orders SET order_status = 3 WHERE order_trans_ID = '{$item_number}'");
								$this->outlog("Completed: {$item_number}");
								if(isset($this->verified_callback) && is_callable($this->verified_callback)) call_user_func_array($this->verified_callback, array('completed', $item_number));
								else sendinvoice($item_number, 2);
								break;
							case 'pending':
								$this->db->query("UPDATE {$this->config->table_prefix}orders SET order_status = 5 WHERE order_trans_ID = '{$item_number}'");
								$this->outlog("Pending: {$item_number}");
								if(isset($this->verified_callback) && is_callable($this->verified_callback)) call_user_func_array($this->verified_callback, array('pending', $item_number));
								break;
							case 'failed':
								$this->db->query("UPDATE {$this->config->table_prefix}orders SET order_status = 6 WHERE order_trans_ID = '{$item_number}'");
								$this->outlog("Failed: {$item_number}");
								if(isset($this->verified_callback) && is_callable($this->verified_callback)) call_user_func_array($this->verified_callback, array('failed', $item_number));
								break;
							default:
								//Unknown status!
								$this->outlog("Unknown Status: $payment_status");
								break;
							}
						}
						else
						{
							$this->outlog("PayPal transaction details don't match our records.{$good_trans}");
							break;
						}
					}
					else
					{
						$this->outlog('No transaction in database');
					}
				}
				else if (strcmp ($res, "INVALID") == 0) 
				{
					$this->outlog('INVALID');
				}
			}
			fclose ($fp);
		}
		die();
	}
	
	function render() {
		if($this->config->displayaspage) $this->page_header();
		$uri = parse_url($_SERVER['REQUEST_URI']);
		$shopurl = (($_SERVER["HTTPS"] == 'on')?$this->config->baselocation_ssl:$this->config->baselocation);
	
		echo '<h1><a href="' . $shopurl . '">' . $this->config->shopname . '</a></h1>';
	
		extract($this->rewrite->compact());
		//owd($this->rewrite);
		$action = strtolower(str_replace(' ', '', $action));
		if(!$this->db->table_exists($this->config->table_prefix . 'products') && $action != 'dbdebug') $action = 'install';
		
		switch($action) {
		case 'panel':
			$this->show_panel();
			break;

		case 'install':
			$this->show_install();
			break;

		case 'additem':
			$this->show_edititem(true);
			break;
			
		case 'edititem':
			$this->show_edititem();
			break;
			
		case 'deleteitem':
			$this->show_deleteitem($delete);
			break;
		
		case 'stocktoggle':
			$this->toggle_stock($prodid);
			break;

		case 'vieworder':
			$this->show_order();
			break;

		case 'unpaidorders':
			$this->show_orders();
			break;
			
		case 'vieworders':
			$this->show_orders($orders);
			break;
	
		case 'add2cart':
			if($this->show_add2cart()) break;
		case 'updatecart':
		case 'viewcart': // I keep using this instead of 'showcart'...  Gah!
		case 'showcart':
			$this->handle_cart();
			break;
		
		default:
			if(!$this->show_default())
				$this->show_category();
			break;
			
		case 'category':
			$this->show_category($category);
			break;
			
		case 'checkout2':
			if(!$this->show_checkout2())
				$this->show_checkout();
			break;
		
		case 'checkout':
			$this->show_checkout();
			break;
		
		case 'pay':
			$this->pay();
			break;
		
		case 'completed':
			$this->show_completed();
			break;
		
		case 'cancelled':
			$this->show_cancelled();
			break;
		
		case 'paypalverify':
			$this->verify_paypal();
			break;
		}
		
		if($this->config->displayaspage) $this->page_footer();

	}
	
	
	
	function outlog($s = '')
	{
		if($this->enable_logging) {
			$log = fopen(dirname(__FILE__) .'/outlog.txt', 'a');
			fwrite($log, "\nTransaction @ ".date('Y-m-d h:i:s A')."\nResult:$s\n");
			foreach($_POST as $key => $value)
			{
				fwrite($log, "$key := $value\n");
			}
			fclose($log);
			//echo "logged $s";
		}
	}
	
	function linkasbutton($url, $text, $echo = false)
	{
		return "<form action=\"{$url}\" method=\"post\"><input type=\"submit\" name=\"submit\" value=\"{$text}\" /></form>";
	}
	
	function sendinvoice($trans, $paymentstate = 0, $emailto = '')
	{
		$qry = "SELECT * FROM {$this->config->table_prefix}orders WHERE order_trans_ID = '{$trans}' LIMIT 1";
		$order = $this->db->get_row($qry);


		$t = new microtemplate($this->templates['order_email']);
		$t->set_field('shop_name', $this->config->shopname);
		$t->set_field('order', $order->order_order);
		$t->set_field('name', $order->order_name);
		$t->set_field('address', implode("\n ", explode("\n", $order->order_address)));
		$t->set_field('email', $order->order_email);
		$t->set_field('IP', $order->order_IP);
		$t->set_field('phone', $order->order_phone);
		$t->set_field('trans_ID', $order->order_trans_ID);
		$t->set_field('subtotal', number_format($order->order_cost,2));
		$t->set_field('shipping', number_format($order->order_shipping,2));
		$t->set_field('total', number_format($order->order_cost + $order->order_shipping, 2));
		$t->set_field('payment_location', implode("\n ", explode("\n", $this->config->payment_location)));
		$t->set_field('currency', $this->currency_to_symbol());
		switch($paymentstate) {
		case 0: 
			$t->set_field('send_payment', true);
			break;
		case 1:
			$t->set_field('verify_payment', true);
			break;
		case 2:
			$t->set_field('order_shipping', true);
			break;
		}
		
		$msg = $t->render();
		$email = $order->order_email;
		if($emailto != '') $email = $emailto;
	
		$headers = "From: {$this->config->shopname}<{$this->config->paypal_account}>";
	
		mail($email, "Your purchase from {$this->config->shopname}", $msg, $headers);
		if($this->config->ccinvoice)
		{
			$msg = "This is a copy of an invoice sent to <{$order->order_email}>.\n\n{$msg}";
			mail($this->config->paypal_account, "Purchase made from {$this->config->shopname}", $msg, $headers);
		}
	}
	
	function get_templates() {
		$this->templates['item_row'] = '
			<tr class="product_1" id="product_<!--SKU-->">
			<td class="itemname" colspan="3" ><div class="itemcategory" >From: <a href="<!--category_URL-->"><!--category--></a></div><!--name--></td>
			</tr>
			<tr class="product_2">
			<td class="itemimage" rowspan="2"><img src="<!--image_URL-->"></td>
			<td class="itemdescription" rowspan="2"><!--description-->
			<!--if:in_stock--><div class="stock instock">In Stock</div><!--/if:in_stock-->
			<!--ifnot:in_stock--><div class="stock outstock">Out of Stock</div><!--/ifnot:in_stock-->
			<!--if:is_auth-->
			<div class="itemedit">[<a href="<!--edit_URL-->">Edit this item</a>]</div><div class="itemedit">[<a href="<!--stocktoggle_URL-->">Toggle stock status</a>]</div><div class="itemedit">[<a href="<!--delete_URL-->">Delete this item</a>]</div></td>
			<!--/if:is_auth-->
			<td class="itemprice"><strong>Price:</strong><br/><!--currency--><!--price--></td>
			</tr>
			<tr>
			<!--if:set_quantity-->
			<td class="itemquantity"><strong>Quantity:</strong><input type="text" name="quantity[<!--SKU-->]" value="<!--quantity-->" size="3" /></td>
			<!--/if:set_quantity-->
			<!--ifnot:set_quantity-->
			<td class="itembuy"><form method="post" action="<!--add_item_URL-->">
			<!--if:in_cart-->You have <!--quantity--> in your <a href="<!--cart_URL-->">shopping cart</a>.<!--/if:in_cart-->
			<!--if:in_stock-->
			<input type="hidden" name="itemsku" value="<!--SKU-->" />
			<input type="submit" name="submit" value="Add 1 to Cart" />
			<!--/if:in_stock-->
			<!--ifnot:in_stock-->
			Sorry, this item is out of stock.
			<!--/ifnot:in_stock-->
			</form></td>
			<!--/ifnot:set_quantity-->
			</tr>
		';
		$this->templates['order_email'] = 'Thank you for placing an order with <!--shop_name-->!

Your order details follow.
---------------------------------

Name:
	<!--name-->
Address:
	<!--address-->
Email:
	<!--email-->
Phone:
	<!--phone-->
Trans#:
	<!--trans_ID-->
---------------------------------
Items Ordered:
		
<!--order-->

---------------------------------
Subtotal: <!--currency--><!--subtotal-->
Shipping: <!--currency--><!--shipping-->
TOTAL: <!--currency--><!--total-->

<!--if:send_payment-->
Please send payment in the amount of $<!--total--> with a copy of this invoice to:
<!--payment_location-->
<!--/if:send_payment-->
<!--if:verify_payment-->
Your order will ship as soon as payment has been verified.
<!--/if:verify_payment-->
<!--if:order_shipping-->
We have received your payment and your order will ship shortly!
<!--/if:order_shipping-->

Thank you for your business!
<!--shop_name-->
';
	}
		
}

if(!defined('ABSPATH')) {
	$shop = new Microshop();
	$shop->render();
}