then change line 20 from

header (“Location: http://www.blabla.com/blabla.php“);
to
header ('Location: http://www.blabla.com/blabla.php&#39 ;

its symple syntax error

i also got rid of

exit;

on line 21 and changed to to

else
header ('Location: http://www.blabla.com/blabla.php&#39 ;

here is the full code

<?php // thankyou.php
function cbValid($rcpt, $time, $item, $cbpop){
$key=’key’;
$xxpop=sha1($key|$rcpt|$time|$item);
$xxpop=strtoupper(substr($xxpop,0,8));
if ($cbpop==$xxpop){
return 1;
} else {
return 0;
}
}
// ===== Sanitize the input (only allow GET for security) =====
$rcpt = trim(addslashes($_GET['cbreceipt']));
$time = trim(addslashes($_GET['time']));
$item = trim(addslashes($_GET['item']));
$cbpop = trim(addslashes($_GET['cbpop']));
// ===== Redirect if invalid and exit =====
if (!cbValid($rcpt, $time, $item, $cbpop)) {
// redirect
header ('Location: http://www.blabla.com/blabla.php&#39 ;
else
header ('Location: http://www.blablacom/blabla.php&#39 ;
}
// no need to do an ELSE because the exit will terminate further processing
// if a valid transaction is not confirmed
// now have the thank you page html
?>

This is the exact error I’ve encountered.

Parse error: syntax error, unexpected T_VARIABLE in /home/****/public_html/**********/*******443isdbxksncyromwgdx/index.php on line 4

(I replaced my domain folders to asterisk for security purposes)

Thanks!

I would never say never, I guess anything is possible, but it’s not as easy as you might think… and it’s certainly more secure than using nothing at all.

PHP is server-side.
HTML is client-side.

This code is PHP, which means – it is -not- displayed to the user.

When a sale is made, the clickbank system notifies a url on the seller’s site with details of the purchase. You can then setup a script to validate the incoming data (see clickbank documentation for php example), and perform any actions needed – in my case, the creation of a new upgraded user on the site, and sending an email with their login details.

With this approach, because all validation and actions are done at the notification url stage, when the user gets to the thank you page you don’t need to expose your product or any other sensitive data on that page.

You can still show the user any data you want on the thank you page however, by saving the receipt string during the notification process, and then using the $_GET value given in the thank you url to select the information from your database again.