<!--#include virtual="/inc-freehost-function/FreeHostFunctionMain.asp"-->
<!--#include file="md5.inc"-->
<%
If not ef Then
If Application("NP_BJ_ShopID")="123" Or Application("NP_BJ_ShopID")="" Then
		ef=True
		ec="商号尚未设置！"
End if
end If

     ' 提取表单参数
	 ' 
	 ' v_oid
	 '      商户发送的v_oid定单编号     
	 ' v_pmode
	 '      支付方式（字符串）     
	 ' v_pstatus 
	 '      支付状态
     '      20（支付成功，对使用实时银行卡进行扣款的订单）
     '      30（支付失败，对使用实时银行卡进行扣款的订单）       
	 ' v_pstring
	 '      支付结果信息 
     '      支付完成（当v_pstatus=20时）；
     '      失败原因（当v_pstatus=30时,字符串）；
     ' v_md5str
     '      Md5校验串
	 ' v_amount
	 '      订单实际支付金额
	 ' v_moneytype 
	 '      订单实际支付币种
	 ' remark1 
	 '      备注字段1
	 ' remark2 
	 '      备注字段2
	 ' key
	 '      私钥值，商户可上chinabank后台自行设定
	 '
	 '/
'v_url?v_oid=19990720-商户号-000001234&v_pstatus=30&v_pstring=无效卡号
'&v_pmode=支付方式(字符串)
'&v_md5info=a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4&v_amount=0.01
'&v_moneytype=0&v_md5money=56b2c3d345f6a1b2c3d4e766a1b2c323
'&v_sign=7e85042c517d4e42f77b0ef967e7a6f20f2ede9ff6558c8309712ec7edddb69dc783a2019a48599cc81ada8397a03b3af0ae42789ac6bc2783a5084419d51b0f54749df0123d51b319cf5f8a3c4a4b886372463dd96f9922a8a1e88a0c663b0065b25f7c9ac29fc98478e665c079d57308c01780d3d8067bbb634c9dd3853c8e


v_oid=request("v_oid")
v_pmode=request("v_pmode")
v_pstatus=request("v_pstatus")
v_pstring=request("v_pstring")
v_amount=request("v_amount")
v_moneytype=request("v_moneytype")
v_md5info=request("v_md5info")'v_md5info校验四个参数，拼接字符串的顺序为：v_oid，v_pstatus，v_pstring和v_pmode
v_md5money=request("v_md5money")'v_md5money效验两个参数，拼接字符串的顺序为：v_amount，v_moneytype
v_sign=request("v_sign")

key=Application("NP_BJ_Key")

if request("v_md5info")="" then
	ef=True
	ec="加密参数为空！"    
elseif request("v_md5money")="" then
	ef=True
	ec="加密参数为空！"    
end if


dim retMAC
retMAC=hex_hmac_md5(cstr(v_oid&v_pstatus&v_pstring&v_pmode),Application("NP_BJ_Key"))'顺序为：v_oid，v_pstatus，v_pstring和v_pmode

if retMAC<>v_md5info then
		ef=True
		ec="非法加密v_md5info！"    
end If

retMAC=hex_hmac_md5(cstr(v_amount&v_moneytype),Application("NP_BJ_Key"))'顺序为：v_amount，v_moneytype

if retMAC<>v_md5money then
		ef=True
		ec="非法加密v_md5money！"    
end If

if not ef then
SHOPID = Application("NP_BJ_ShopID")
ORDERID = v_oid
SucceedFlag = v_pstatus
ORDERMONEY = v_amount
Set conn=Server.CreateObject("ADODB.Connection")
	conn.Open Application("FreeHostDBlink")
Set dsNP = Server.CreateObject("ADODB.Recordset")	
	Sql="Select * from FreeHost.FreeHost_Netpay where ORDERID='"&ORDERID&"' and SHOPID='"&SHOPID&"' "
if RegExpTest("[^A-Za-z0-9--]",ORDERID) Or RegExpTest("[^A-Za-z0-9--]",SHOPID) then
	ef=True
	ec="ORDERID或SHOPID不正确！用户试图SQL注入被拦截,内容:"&ORDERID&SHOPID
FreeHost_oplog "error","信息","实时返回支付出错"&ec
response.write "fail"&ec
response.end
end If
'	Application("NPS_test")=sql&"   "&FD_NPSId
'	response.write sql
'	response.end
		dsNP.Open Sql,conn,1,3
if dsNP.eof then
		ef=True
		ec="不存在的订单！"
else
  if dsNP("SucceedFlag") <>0 then
		ef=True
		ec="状态已更新过了，不能重复操作！"
  end if
'  if dsNP("ORDERMONEY") <>ORDERMONEY then
'		ef=True
'		ec="金额不正确！"
'  end if
end if
end if
  


if not ef then
if SucceedFlag<>"20" then
dsNP("SucceedFlag")=SucceedFlag
dsNP.update
con="error"
con=v_pstring
		ef=True
		ec="支付不成功！返回状态是："&con
end if
end if

if not ef then
if v_amount<dsNP("OrderMoney") then
		ef=True
		ec="支付不成功！实际支付金额小于订单金额！"
end if
end if



if not ef then
UserName=dsNP("UserName")
OrderMoney=dsNP("OrderMoney")
Set dsreg = Server.CreateObject("ADODB.Recordset")	
	Sql="Select * from FreeHost.FreeHost_AGENT where username='"&UserName&"' and agenttype<>'n'"
		dsreg.Open Sql,conn,1,3
If dsreg.Eof Then
Set dsreg = Server.CreateObject("ADODB.Recordset")	
	Sql="Select * from FreeHost.FreeHost_USER where username='"&UserName&"'"
		dsreg.Open Sql,conn,1,3
If dsreg.Eof Then
		ef=True
		ec="会员名不存在！"
end if
end if
end if


if not ef then
dsNP("SucceedFlag")=SucceedFlag
dsNP.update
olduser_money=dsreg("usermoney")
If Application("NetPaypercent")>0 Then OrderMoney=OrderMoney/(1+Application("NetPaypercent"))
OrderMoney=Round(OrderMoney,2)
moneych=OrderMoney
dsreg("usermoney")=dsreg("usermoney")+OrderMoney
newuser_money=dsreg("usermoney")
dsreg.update

if not isnull(dsreg("kefunow")) then
Set dskefu = Server.CreateObject("ADODB.Recordset")	
	Sql="Select finishmoney from FreeHost.FreeHost_KeFu where kefumd5='"&md5(trim(dsreg("kefunow")))&"'"
	dskefu.Open Sql,conn,1,3
if not dskefu.Eof then
dskefu("finishmoney")=dskefu("finishmoney")+OrderMoney
dim kefu
kefu=dsreg("kefunow")
dskefu.update
end if
dskefu.close
end if

FreeHost_moneyNewlog conn,"y","n","n","n","y",isAgnHostSer,moneych,UserName,UserName,UserName,olduser_money,newuser_money,agnusername,agnStmoney,agnEndmoney,supusername,"网上支付首信接口订单"&ORDERID&",网站："&Request.ServerVariables("SERVER_NAME"),"网上支付首信接口订单"&ORDERID&",网站："&Request.ServerVariables("SERVER_NAME"),whichProduct,pdid,pingzheng,type1,"在线支付",haveget,havecheck
%>
<!--#include virtual="/inc-freehost-function/htmlwrite.asp"--><%=htmlwrite("html2")%>　返回结果
<%=htmlwrite("html3")%>
支付完成。
用户的原金额：<%=olduser_money%>元<br>
用户的金额变化：<font color=red><%=moneych%>元</font><br>
用户的新金额：<%=newuser_money%>元<br>
<%dsreg.close
set dsreg=nothing
conn.close
set conn=nothing
%>
<%=htmlwrite("html4")%>
<%
end if

if ef then
Response.Redirect "e.asp?e="&ec
end if%>
