Credit Cards, Localization




CS174

Chris Pollett

Nov 28, 2016

Outline

Credit Card Transactions

Stripe

Stripe Example

<!DOCTYPE html>
<html>
<head><title>Credit Card Test</title></head>
<body>
<?php
define("SECRET_KEY", "sk_test_get_this_at_stripe_com");
define("PUBLISHABLE_KEY", "pk_test_get_this_at_stripe_com");
define("CHARGE_URL", "https://api.stripe.com/v1/charges");
define("CHARGE_CURRENCY", "usd");
define("CHARGE_DESCRIPTION", "Buyer sees this on their statement");
define("CHARGE_USERAGENT", "CreditCardTester");
define("TIMEOUT", 20);
?>
<h1>Credit Card Test</h1>
<div>
<?php
if (empty($_REQUEST["credit_token"])) {
    ?>

    <form id="purchase-stuff-form" method="post" >
    <input type="hidden" id="credit-token"  name="credit_token" value="" />
    <p><label for="amount">Amount:</label><input type="text" id="amount"
        size="2" name="amount" /></p>
    <p><label for="card-number">Card Number:</label><input type="text"
        id="card-number" size="20" data-stripe='number'
        name="card-number" /></p>
    <p><label for="cvc">CVC:</label><input type="text" id="cvc" size="4"
        data-stripe='cvc' name="cvc" /></p>
    <p><label for="exp-month">Expiration Month:</label><input type="text"
        id="exp-month" size="2" data-stripe='exp-month' name="exp-month" /></p>
    <p><label for="exp-year">Expiration Year:</label><input type="text"
        id="exp-year" size="2" data-stripe='exp-year' name="exp-year" /></p>
    <p><input type="submit" id="purchase" name="Purchase" value="Purchase"></p>
    </form>
    <script>
    function elt(id)
    {
        return document.getElementById(id);
    }
    elt('purchase').onclick =
        function(event) {
            var purchase_form = elt('purchase-stuff-form');
            elt('purchase').disabled = true; // prevent additional clicks
            Stripe.card.createToken(purchase_form, tokenResponseHandler);
            event.preventDefault(); //prevent form submitting till get all clear
        }
    function tokenResponseHandler(status, response) 
    {
        var purchase_form = elt('purchase-stuff-form');
        if (response.error) {
            alert(response.error.message);
            elt('purchase').disabled = false;
        } else {
            elt('credit-token').value = response.id;
            purchase_form.submit();
        }
    }
    </script>
    <script src="https://js.stripe.com/v2/"  ></script>
    <script>
    Stripe.setPublishableKey('<?=PUBLISHABLE_KEY ?>');
    </script>
    <?php
} else {
    $message = "";
    if (empty($_REQUEST['amount']) || intval($_REQUEST['amount']) <= 0) {
        echo "No charge amount given";
        exit();
    }
    $amount = intval($_REQUEST['amount']);
    $token = $_REQUEST['credit_token'];
    $success = charge($amount, $token, $message);
    unset($_REQUEST['credit_token']);
    if ($success) {
        echo "$amount charged!";
    } else {
        echo "$amount charge did not do through!";
        if (!empty($message)) {
            echo "<br />$message";
        }
    }
}
function charge($amount, $token, &$message)
{
    $charge = [
        //swipe charges in cents * 100 to convert to dollars
        "amount" => $amount * 100,
        "currency" => CHARGE_CURRENCY,
        "source" => $token,
        "description" => CHARGE_DESCRIPTION
    ];
    $response = getPage(CHARGE_URL, http_build_query($charge),
        SECRET_KEY . ":");
    $credit_info = json_decode($response, true);
    if (!empty($credit_info['message'])) {
        $message = $credit_info['message'];
    }
    return isset($credit_info['status']) &&
        $credit_info['status'] == 'succeeded';
}

function getPage($site, $post_data = null, $user_password = null)
{
    $agent = curl_init();
    curl_setopt($agent, CURLOPT_USERAGENT, CHARGE_USERAGENT);
    curl_setopt($agent, CURLOPT_URL, $site);
    curl_setopt($agent, CURLOPT_AUTOREFERER, true);
    curl_setopt($agent, CURLOPT_FOLLOWLOCATION, true);
    curl_setopt($agent, CURLOPT_NOSIGNAL, true);
    curl_setopt($agent, CURLOPT_RETURNTRANSFER, true);
    curl_setopt($agent, CURLOPT_FAILONERROR, true);
    curl_setopt($agent, CURLOPT_TIMEOUT, TIMEOUT);
    curl_setopt($agent, CURLOPT_CONNECTTIMEOUT, TIMEOUT);
    //make lighttpd happier
    curl_setopt($agent, CURLOPT_HTTPHEADER, ['Expect:']);
    if ($post_data != null) {
        curl_setopt($agent, CURLOPT_POST, true);
        curl_setopt($agent, CURLOPT_POSTFIELDS, $post_data);
    } else {
        curl_setopt($agent, CURLOPT_HTTPGET, true);
    }
    if($user_password != null) {
        curl_setopt($agent, CURLOPT_FAILONERROR, false);
        curl_setopt($agent, CURLOPT_USERPWD, $user_password);
        curl_setopt($agent, CURLOPT_SSL_VERIFYHOST, 2);
        curl_setopt($agent, CURLOPT_SSLVERSION, CURL_SSLVERSION_TLSv1_2);
    }
    $response = curl_exec($agent);
    curl_close($agent);
    return $response;
}
?>
</div>
</body>
</html>

Notes on Stripe Example

Introduction to Localization

Buzz-words: i18n and L10n

Unicode

Glyphs, Character Sets, Encodings

More on Code Points, Characters, Glyphs, and Graphemes

Quiz

Which of the following statements is true?

  1. XSS (Cross-site Security) is a technique used to log in with credentials from a third party.
  2. SQL Injection attacks are prevented using the X-Frame-Options header.
  3. Target blank attacks can be prevented by adding rel="noopener noreferrer" as an anchor tag attribute.

Quiz

Which of the following statements is true?

  1. Clickjacking can be prevented using the X-Frame-Options header.
  2. CSRF (Cross-site Request Forms) is a technique used to log in with credentials from a third party.
  3. A site is only vulnerable to an inclusion attack if it has a web form on it somewhere.

Byte-order Mark

UTF-8 Encoding

Specifying and Handling UTF-8

Text Direction

Text-direction: HTML and CSS

gettext

How do we create .mo files? .po files

From .po files to .mo files, more on msgid's.