[RESOLVED] Donation Cal, and then process to PayPal

[spiritssight]

Hello All,

Can you please look at this code and tell me what you think, I am trying to make it better and more safer.

I am new so be easy :-) with kidding aside if there is some thing that can be changed to make it better can you explain to me so I may learn it. Also if someone can show me how this should be indented I would also be greatful for that also.

Sincerely,
Christopher
Disability-Info-Seek Project


<?php

$f_name = $_POST["f_name"];
$m_initial = $_POST["m_initial"];
$l_name = $_POST["l_name"];
$donation = $_POST["donation"];
$donation_fee = $_POST["donation_fee"];

function Donation_Cal($donation, $donate_fee)
{
$fee = 0.029;
$flat_fee = .30;

if(isset($_POST["donate_fee"]))
{
$total_donation = $donation * $fee + $flat_fee + $donation + .01;
} // 15.549615 = 15 * .0129 + .3 + 15
else
{
$total_donation = $donation;
}

$total_donation = round($total_donation, 2);
$total_donation = number_format($total_donation, 2);
return $total_donation;

};

echo "<b>Your name is:<b /> ". $f_name ." ". $m_initial . " " . $l_name . "," ;
echo " your total donation is: $" . Donation_Cal($donation, $donate_fee) ;

$donation = Donation_Cal($donation, $donate_fee);

echo '
<form action="https://www.paypal.com/cgi-bin/webscr" method="post">
<input type="hidden" name="cmd" value="_xclick">
<input type="hidden" name="business" value="donations@gmail.com">
<input type="hidden" name="undefined_quantity" value="0">
<input type="hidden" name="item_name" value="Disability-Info-Seek.com Project Donation">
<input type="hidden" name="item_number" value="DIS-2008">
<input type="hidden" name="amount" value="'.$donation.'">
<input type="hidden" name="no_shipping" value="1">
<input type="hidden" name="no_note" value="1">
<input type="hidden" name="return" value="http://success">
<input type="hidden" name="cancel_return" value="http://cancel">
<input name="submit" type="submit" value="click here">
</form>

'
?>

[bubblenut]

At first glance you have a number of XSS vulnerabilities. You need to escape untrusted data being sent to the browser with htmlentities. Also, you need to sanitize the dontation and donation_fee fields, what happens if non-numbers are passed in? Apart from that it looks OK.

[spiritssight]

Can you explain this in more detail and or point me in the right direction of how to do this stuff so that it can be better, thanks alot

Sincerely,
Christopher