JezK

Edit File: zoho-validate-coupon.php

<?php
error_reporting(E_ALL);
ini_set('display_errors', 1);

// Start session with secure parameters
if (!session_id() && !headers_sent()) {
    ini_set('session.cookie_httponly', 1);
    if (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] === 'on') {
        ini_set('session.cookie_secure', 1);
    }
    ini_set('session.use_only_cookies', 1);
    ini_set('session.cookie_samesite', 'Strict');
    session_start();
}

// Set response headers
header('Content-Type: application/json');
header('X-Content-Type-Options: nosniff');

// Only allow POST requests
if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
    http_response_code(405);
    echo json_encode(['error' => 'Method not allowed', 'http_code' => 405]);
    exit;
}

// Sanitization helper
function sanitizeInput($input) {
    if (is_array($input)) {
        $out = [];
        foreach ($input as $k => $v) {
            $key = preg_replace('/[^a-zA-Z0-9_]/', '', (string)$k);
            if (is_array($v)) {
                $out[$key] = sanitizeInput($v);
            } else {
                $val = trim(strip_tags((string)$v));
                $out[$key] = $val;
            }
        }
        return $out;
    }
    return trim(strip_tags((string)$input));
}

// Read JSON input
$request_body = file_get_contents("php://input");
$decoded_input = json_decode($request_body, true);

if (is_array($decoded_input)) {
    $decoded_input = sanitizeInput($decoded_input);
}

// CSRF validation
if (!isset($decoded_input['csrf_token'])) {
    http_response_code(403);
    echo json_encode(['error' => 'Missing CSRF token', 'http_code' => 403]);
    exit;
}

if (!isset($_SESSION['csrf_token']) ||
    !isset($_SESSION['csrf_token_hash']) ||
    $decoded_input['csrf_token'] !== $_SESSION['csrf_token'] ||
    $_SESSION['csrf_token_hash'] !== hash('sha256', $decoded_input['csrf_token'] . ($_SERVER['HTTP_USER_AGENT'] ?? '') . ($_SERVER['REMOTE_ADDR'] ?? ''))
) {
    http_response_code(403);
    echo json_encode(['error' => 'Invalid CSRF token', 'http_code' => 403]);
    exit;
}

if (!isset($_SESSION['csrf_token_time']) || (time() - $_SESSION['csrf_token_time'] > 1800)) {
    http_response_code(403);
    echo json_encode(['error' => 'Expired CSRF token', 'http_code' => 403]);
    exit;
}

// Check if coupon code is provided
if (!isset($decoded_input['coupon_code']) || empty($decoded_input['coupon_code'])) {
    http_response_code(400);
    echo json_encode([
        'valid' => false,
        'error' => 'Coupon code is required',
        'http_code' => 400
    ]);
    exit;
}

$coupon_code = strtoupper(trim($decoded_input['coupon_code']));

// Valid coupons list (5 sample coupons - replace with actual coupons later)
// You can also move this to a database or external config file
$valid_coupons = [
    'NYECC26' => [
        'discount' => 150,
        'description' => '$150 tuition credit will be applied to the final payment of the program.',
        'expires' => '2026-02-10'
    ]
];

// Check if coupon exists
if (array_key_exists($coupon_code, $valid_coupons)) {
    $coupon = $valid_coupons[$coupon_code];
    
    // Check if coupon has expired
    $expiry_date = strtotime($coupon['expires']);
    $today = strtotime(date('Y-m-d'));
    
    if ($today > $expiry_date) {
        echo json_encode([
            'valid' => false,
            'error' => 'This coupon has expired',
            'http_code' => 200
        ]);
        exit;
    }
    
    // Coupon is valid
    echo json_encode([
        'valid' => true,
        'coupon_code' => $coupon_code,
        'discount' => $coupon['discount'],
        'description' => $coupon['description'],
        'expires' => $coupon['expires'],
        'http_code' => 200
    ]);
} else {
    // Invalid coupon
    echo json_encode([
        'valid' => false,
        'error' => 'Invalid coupon code',
        'http_code' => 200
    ]);
}
exit;

JezK

Edit File: zoho-validate-coupon.php

Log In

Powered by WordPress