<p><strong>SOLUTION:</strong></p>

<p>It started to work, after removing .htaccess file from /public_html on my webpage..  so simple solution..</p>

<p>i think it can be done with some reconfiguration too, but i am not using .htaccess, so it was the simpliest solution for me :)</p>

CC BY-SA 3.0
2017-03-10T13:58:27.613Z
2017-03-10T13:58:27.613Z
Fero
<p>I am trying to create automated receive Bitcoin payments via Blockchain API.
I have my API key, xpub, everything. I'm using PHP.</p>

<p>Here is the part of my code for generating wallet address:</p>

<pre><code>$scrt = my_super_secret_code_60_chars_long;
$my_callback_url = "http://mysite.com/lib/payment.php?secret={$scrt}";
$my_xpub = "my_xpub_key";
$my_api_key = "my_secret_api_key";

$root_url = "https://api.blockchain.info/v2/receive";
$parameters = "xpub=" .$my_xpub. "&amp;callback=" .urlencode($my_callback_url). "&amp;key=" .$my_api_key;


$qry= "SELECT ID,RECEIVE_ADDR FROM MY_TABLE WHERE WALLET = '{$_GET['wallet']}' ";
$result = mysqli_query($conn,$qry);
$row = mysqli_fetch_row($result);
$reci = $row[1];
$uid = $row[0];
if ($reci=='none') {
//if the user does not have generated receive address, triggering this
$response = file_get_contents($root_url . '?' . $parameters);
$object = json_decode($response);

echo 'Send Payment To : ' . $object-&gt;address;

$qry= "UPDATE MY_TABLE SET RECEIVE_ADDR='". $object-&gt;address ."' WHERE WALLET = '{$_GET['wallet']}' ";
mysqli_query($conn,$qry);   
 } 
</code></pre>

<p>This code works, but I have a problem with the callback to <code>payment.php</code>.
It's not triggering when the payment is received, however manually, I can simulate the received payment by calling PHP with correct parameters.</p>

<p>Here is the relevant part of <code>payment.php</code>:</p>

<pre><code>&lt;?php
$scrtt = $_GET['secret']; //password is passed back to the callback URL
$transaction_hash = $_GET['transaction_hash'];
$value_in_satoshi = $_GET['value'];
$value_in_btc = $value_in_satoshi / 100000000;

$gt='CALLBACK CALLED - TXID:'.$transaction_hash.' VALUE '.$value_in_satoshi.' SCRT:'.$scrtt.' CONFIRMS:'.$_GET['confirmations'];
$qry= "INSERT INTO DEBUG (TE) VALUES ('{$gt}')";
mysqli_query($conn,$qry);
//code above is for debugging - but not triggered however payment is received
if ($scrtt== my_super_secret_code) {
if ($_GET['confirmations'] &gt;= 2) {
$confirms=$_GET['confirmations'];   
$qry= "SELECT ID FROM MY_TABLE WHERE RECEIVE_ADDR = '{$_GET['address']}'";

$result = mysqli_query($conn,$qry);
$row = mysqli_fetch_row($result);
$uid = $row[0];

$qry= "SELECT TXHASH FROM PAYMENTS WHERE TXHASH = '{$_GET['transaction_hash']}' ";

$result = mysqli_query($conn,$qry);
$row = mysqli_fetch_row($result);
$tx = $row[0];

if ($tx &lt;&gt; $transaction_hash) {

    $qry="INSERT INTO PAYMENTS (TXHASH,USER_ID,SATS,CONFIRMS) VALUES ('{$transaction_hash}',{$uid},{$value_in_satoshi},{$confirms})";
mysqli_query($conn,$qry);       

//new tx - insert   
}

//Insert into confirmed payments

} 
}
echo '*ok*';
?&gt;
</code></pre>

<p>My problem is, the callback is never called— can anyone check my code and tell me where I the problem is?</p>

<p>thanks</p>

<p><strong>UPDATE:</strong></p>

<p>I investigated a little and here is my result (however it's still not working)</p>

<p>I found the url to check a callback log directly on the blockchain:
<a href="https://api.blockchain.info/v2/receive/callback_log?callback=http-urlencoded_my_website/callback.php?parameters&amp;key=my-api-key" rel="nofollow noreferrer">https://api.blockchain.info/v2/receive/callback_log?callback=http-urlencoded_my_website/callback.php?parameters&amp;key=my-api-key</a></p>

<p>The log shows me something like that:</p>

<pre><code>callback":"http://mysite.com/callback.php?param=myparam","called_at":"2017-03-10T13:05:39Z","response_code":403,"raw_response":"&lt;!DOCTYPE HTML PUBLIC \"-//IETF//DTD HTML 2.0//EN\"&gt;\n&lt;html&gt;&lt;head&gt;\n&lt;title&gt;403 Forbidden&lt;/title&gt;\n&lt;/head&gt;&lt;body&gt;\n&lt;h1&gt;Forbidden&lt;/h1&gt;\n&lt;p&gt;You don't have permission to access /callback.php\non this server.&lt;br /&gt;\n&lt;/p&gt;\n&lt;p&gt;Additionally, a 403 Forbidden\nerror was encountered while trying to use an ErrorDocument to handle the request.&lt;/p&gt;\n&lt;/body&gt;&lt;/html&gt;\n"}]
</code></pre>

<p>Can someone help me with that?
I am an owner of this domain and I can access this page with all of my browsers.</p>

CC BY-SA 3.0
2017-03-09T18:21:59.740Z
I would just like to point out that your code is vulnerable to SQL injection. Are you definitely sure that the code inside `if ($reci=='none') {` actually gets executed?
Adam Lindsay
CC BY-SA 3.0
2017-03-09T18:48:38.530Z
$reci is a variable that is assigned from user's actual receive address from mysql database..  and the default value for that field is 'none' ..  I tested it many times and yes, it works..  this if clause is avoiding double generate BTC address for single user
Fero
<blockchain.info><api><php>
Callback not working in program using the blockchain api
Fero
# Callback not working in program using the blockchain api

(Asked by: username_0 on 2017-03-09)

I am trying to create automated receive Bitcoin payments via Blockchain API.
I have my API key, xpub, everything. I'm using PHP.

Here is the part of my code for generating wallet address:

```
$scrt = my_super_secret_code_60_chars_long;
$my_callback_url = "http://mysite.com/lib/payment.php?secret={$scrt}";
$my_xpub = "my_xpub_key";
$my_api_key = "my_secret_api_key";

$root_url = "https://api.blockchain.info/v2/receive";
$parameters = "xpub=" .$my_xpub. "&callback=" .urlencode($my_callback_url). "&key=" .$my_api_key;

$qry= "SELECT ID,RECEIVE_ADDR FROM MY_TABLE WHERE WALLET = '{$_GET['wallet']}' ";
$result = mysqli_query($conn,$qry);
$row = mysqli_fetch_row($result);
$reci = $row[1];
$uid = $row[0];
if ($reci=='none') {
//if the user does not have generated receive address, triggering this
$response = file_get_contents($root_url . '?' . $parameters);
$object = json_decode($response);

echo 'Send Payment To : ' . $object->address;

$qry= "UPDATE MY_TABLE SET RECEIVE_ADDR='". $object->address ."' WHERE WALLET = '{$_GET['wallet']}' ";
mysqli_query($conn,$qry);   
 } 

```

This code works, but I have a problem with the callback to `payment.php`.
It's not triggering when the payment is received, however manually, I can simulate the received payment by calling PHP with correct parameters.

Here is the relevant part of `payment.php`:

```
<?php
$scrtt = $_GET['secret']; //password is passed back to the callback URL
$transaction_hash = $_GET['transaction_hash'];
$value_in_satoshi = $_GET['value'];
$value_in_btc = $value_in_satoshi / 100000000;

$gt='CALLBACK CALLED - TXID:'.$transaction_hash.' VALUE '.$value_in_satoshi.' SCRT:'.$scrtt.' CONFIRMS:'.$_GET['confirmations'];
$qry= "INSERT INTO DEBUG (TE) VALUES ('{$gt}')";
mysqli_query($conn,$qry);
//code above is for debugging - but not triggered however payment is received
if ($scrtt== my_super_secret_code) {
if ($_GET['confirmations'] >= 2) {
$confirms=$_GET['confirmations'];   
$qry= "SELECT ID FROM MY_TABLE WHERE RECEIVE_ADDR = '{$_GET['address']}'";

$result = mysqli_query($conn,$qry);
$row = mysqli_fetch_row($result);
$uid = $row[0];

$qry= "SELECT TXHASH FROM PAYMENTS WHERE TXHASH = '{$_GET['transaction_hash']}' ";

$result = mysqli_query($conn,$qry);
$row = mysqli_fetch_row($result);
$tx = $row[0];

if ($tx <> $transaction_hash) {

    $qry="INSERT INTO PAYMENTS (TXHASH,USER_ID,SATS,CONFIRMS) VALUES ('{$transaction_hash}',{$uid},{$value_in_satoshi},{$confirms})";
mysqli_query($conn,$qry);       

//new tx - insert   
}

//Insert into confirmed payments

} 
}
echo '*ok*';
?>

```

My problem is, the callback is never called— can anyone check my code and tell me where I the problem is?

thanks

**UPDATE:**

I investigated a little and here is my result (however it's still not working)

I found the url to check a callback log directly on the blockchain:
<https://api.blockchain.info/v2/receive/callback_log?callback=http-urlencoded_my_website/callback.php?parameters&key=my-api-key>

The log shows me something like that:

```
callback":"http://mysite.com/callback.php?param=myparam","called_at":"2017-03-10T13:05:39Z","response_code":403,"raw_response":"<!DOCTYPE HTML PUBLIC \"-//IETF//DTD HTML 2.0//EN\">\n<html><head>\n<title>403 Forbidden</title>\n</head><body>\n<h1>Forbidden</h1>\n<p>You don't have permission to access /callback.php\non this server.<br />\n</p>\n<p>Additionally, a 403 Forbidden\nerror was encountered while trying to use an ErrorDocument to handle the request.</p>\n</body></html>\n"}]

```

Can someone help me with that?
I am an owner of this domain and I can access this page with all of my browsers.

**Tags:** blockchain.info, api, php

> **Comments:**
> **username_1**: I would just like to point out that your code is vulnerable to SQL injection. Are you definitely sure that the code inside `if ($reci=='none') {` actually gets executed?  
> **username_0**: $reci is a variable that is assigned from user's actual receive address from mysql database..  and the default value for that field is 'none' ..  I tested it many times and yes, it works..  this if clause is avoiding double generate BTC address for single user  

---

## 1 answers

### Answer by username_0 on 2017-03-10. Score: 0 | Accepted answer

**SOLUTION:**

It started to work, after removing .htaccess file from /public\_html on my webpage.. so simple solution..

i think it can be done with some reconfiguration too, but i am not using .htaccess, so it was the simpliest solution for me :)


---

