1

I use this code added into success.phtml when ever I run this code the webpage crashes. The success page just never loads and stays white. I'm sure its a simple mistake that I am making but I haven't been able to figure it out yet. So I figured i'd give it a shot on here.

This code is near the beginning of the file and works fine

$grayson_order_id = $this->getOrderId();
$order2 = Mage::getModel('sales/order')->loadByIncrementId($grayson_order_id);
$custname = $order2->getBillingAddress()->getName();

This code however does not work.

<?php
echo "a";
$lastOrderId = Mage::getSingleton('checkout/session')->getLastOrderId();
echo "b";
echo "<br />";
$order = Mage::getSingleton('sales/order'); 
echo "c";
echo "<br />";
$order->load($lastOrderId);
echo "c";
echo "<br />";
$totalAmount = $order->getData('base_grand_total');
echo "d";
echo "<br />";
echo "total amount ". $totalAmount;
echo "<br />";
$sellerId = Mage::getModel('core/cookie')->get('smashingmagazine_affiliate_source');
echo "e";
echo "<br />";
echo "aff id ". $sellerId;
echo "<br />";
$w = Mage::getSingleton('core/resource')->getConnection('core_write');
echo "f";
echo "<br />";
$result = $w->query('INSERT INTO grayson_custom (refer, time, amount, name, order_id) VALUES ('$sellerId', 'date('Y-m-d H:i:s')','$totalAmount','$custname','$this->getOrderId()')');
echo "g";
echo "<br />";

?>

I don't think it matters much but I am using Magento Enterprise Edition 1.13

Thanks for all your help!

1

1 Answer 1

1

Error is on this line:

$result = $w->query('INSERT INTO grayson_custom (refer, time, amount, name, order_id) VALUES ('$sellerId', 'date('Y-m-d H:i:s')','$totalAmount','$custname','$this->getOrderId()')');

Can be fixed by changing to:

$result = $w->query('INSERT INTO grayson_custom (refer, time, amount, name, order_id) VALUES ('.$sellerId.', '.date('Y-m-d H:i:s').','.$totalAmount.','.$custname.','.$this->getOrderId().')');

What ever you are trying to do STOP, this is not how you should be developing on Magento, this sort of action should be handled with a custom module and a making use of Magento Observer Event triggers, checkout_onepage_controller_success_action if possible.

Also I think you might have a SQL injection on the above line, because you get the Cookie smashingmagazine_affiliate_source, if the user maliciously malforms the cookie it could potentially cause a security breach!

http://magentotherightway.com/ | http://www.phptherightway.com/ | Hire a developer

4
  • I am aware of the SQL injection security issue but I haven't gotten that far yet. This code used to be ran on the onepage checkout success event but I moved it directly into success.phtml when debugging. Thanks for all your help! And the links! Aug 19, 2014 at 16:10
  • Ah ok, you did give a wtf moment. Hope this fixes your issue. I would look at creating a resource model so you can use the Magento ORM pixafy.com/blog/2013/04/creating-a-magento-custom-model instead of pure SQL.
    – jzahedieh
    Aug 19, 2014 at 16:16
  • I get the magento error page and it says the error message is hidden by default for security reasons. How can i view the error? i looked in the log files and didn't find anything Aug 19, 2014 at 17:15
  • As input mentioned, this approach would open up you to exploitation. I'd follow the tutorial and code closer your following: github.com/josephmcdermott/…
    – B00MER
    Jan 9, 2015 at 2:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.