PHP - Only Allow Members Who Have Paid W/ Tokens To Download

I have  mysql table titled fee_payment. details of the table:   fee_payment Table payment_id    student_id          name            class        term                       year             date                  amount 1                             6                john              JHS2        2nd_term              2013           23-04-2013 56        67 2                             6                john              JHS2        2nd_term              2013           23-04-2013 56        34 3                             5                peter            JHS3        3rd_term               2014           23-04-2014 56        85 4                             6                john              JHS2        2nd_term              2014           23-04-2014 56        76 5                             6                john              JHS2        3rd_term               2014           23-04-2014 56        34 6                             6                john              JHS2        2nd_term              2014           23-04-2014 56        23 7                             5                peter             JHS2        3rd_term               2014           23-04-2014 56        43   what i need to do now is to sum total amount paid by each student so that i can view payment records based on term and year. what i have tried:     Controller: /******MANAGE FEE PAYMENTS / INVOICES WITH STATUS*****/
    function payfees($param1 = '', $param2 = '', $param3 = '')
    {
        if ($this->session->userdata('admin_login') != 1)
            redirect(base_url(), 'refresh');
        
        if ($param1 == 'create') {
            $data['student_id']         = $this->input->post('student_id');
            $data['name']         = $this->input->post('name');
            $data['class_id']              = $this->input->post('class');
            $data['term']        = $this->input->post('term');
            $data['year']             = $this->input->post('year');
            $data['amount']             = $this->input->post('amount');
            $data['creation_timestamp'] = strtotime($this->input->post('date'));
            
            $this->db->insert('fee_payment', $data);
           redirect(base_url() . 'index.php?admin/payfees', 'refresh');
        }
        if ($param1 == 'do_update') {
            $data['student_id']         = $this->input->post('student_id');
            $data['class_id']              = $this->input->post('class');
            $data['term']        = $this->input->post('term');
            $data['year']             = $this->input->post('year');
            $data['amount']             = $this->input->post('amount');
            $data['creation_timestamp'] = strtotime($this->input->post('date'));
            
            $this->db->where('payment_id', $param2);
            $this->db->update('fee_payment', $data);
            redirect(base_url() . 'index.php?admin/payfees', 'refresh');
        } else if ($param1 == 'edit') {
            $page_data['edit_data'] = $this->db->get_where('fee_payment', array(
                'payment_id' => $param2
            ))->result_array();
        }
        if ($param1 == 'delete') {
            $this->db->where('payment_id', $param2);
            $this->db->delete('fee_payment');
            redirect(base_url() . 'index.php?admin/payfees', 'refresh');
        }
        $page_data['page_name']  = 'payfees';
        $page_data['page_title'] = get_phrase('fee_payment');
        $this->db->order_by('creation_timestamp', 'term');
        $page_data['payments'] = $this->db->get('fee_payment')->result_array();
        $this->load->view('index', $page_data);
    }
         The Invoice:     <div class="box-content">
        <?php foreach($edit_data as $row):?>
        
        
        <div class="pull-left">
        
            <span style="font-size:20px;font-weight:100;">
            
            <?php echo get_phrase('payment_to');?>
            <img width="50" height="30" src="<?php echo base_url();?>uploads/logo.png" style="max-height:100px;margin:20px 0px;" />
            </span>
            <br />
            <?php echo $system_name;?>
            <br />
            <?php echo $this->db->get_where('settings' , array('type'=>'address'))->row()->description;?>
        </div>
        <div class="pull-right">
            <span style="font-size:20px;font-weight:100;">
                <?php echo get_phrase('credited_account:');?>
            </span>
            <br />
                <?php echo $this->db->get_where('student' , array('student_id'=>$row['student_id']))->row()->name;?>
            <br />
                <?php echo get_phrase('student_id');?> :
                <?php echo "FAVECSID0000", $this->db->get_where('student' , array('student_id'=>$row['student_id']))->row()->student_id;?>
            <br />
                <?php echo get_phrase('class');?> :
                <?php
                $class_id    =    $this->db->get_where('student' , array('student_id'=>$row['student_id']))->row()->class_id;
                echo $this->db->get_where('class' , array('class_id'=>$class_id))->row()->name;
                ?>
        </div>
        <div style="clear:both;"></div>
        <hr />
        <table width="100%" background="http://localhost/sch...backlogos.png">
            <tr style="background-color:#7087A3; color:#fff; padding:5px;">
                <td style="padding:5px;"><?php echo get_phrase('payment_details');?></td>
                <td width="30%" style="padding:5px;">
                    <div class="pull-right">
                        <?php echo get_phrase('amount');?>
                    </div>
                </td>
            </tr>
            <tr>
                <td>
                    <span style="font-size:20px;font-weight:100;">
                        <?php echo get_phrase('payment_made');?>
                    </span>
                    <br />
                    
                </td>
                <td width="30%" style="padding:5px;">
                    <div class="pull-right">
                        <span style="font-size:20px;font-weight:100;">
                        <?php echo "Gh", $row['amount'];?>    
                        </span>
                    </div>
                </td>
            </tr>
            
            <tr>
           
            <tr>
                <td>
                    <span style="font-size:20px;font-weight:100;">
                        <?php echo get_phrase('balance');?>
                    </span>
                    <br />
                    <?php echo $row['description'];?>
                    <?php
                                $exams = $this->db->get_where('fee_payment', array('student_id'=>$row['student_id']))->result_array();
                                foreach($exams as $row):
                                ?>
                                <?php
                                
                                $ttpaid = sum($row['amount']);
                                echo $ttpaid;?>
                                 <?php
                                endforeach;
                                ?>
                </td>
                <td width="30%" style="padding:5px;">
                    <div class="pull-right">
                        <span style="font-size:20px;font-weight:100;">
                <?php
                
                $tuition    =    $this->db->get_where('student' , array('student_id'=>$row['student_id']))->row()->tuition_fee;
                $status    =    $this->db->get_where('student' , array('student_id'=>$row['student_id']))->row()->status_fee;
                $total_fees = $tuition + $status;
                $balance_fee = $total_fees - $row['amount'];
                echo "Gh", $balance_fee;
                ?>            
                        </span>
                    </div>
                </td>
            </tr>
            
            <tr>
       
                <td></td>
                <td width="30%" style="padding:5px;">
                    <div class="pull-right">
                    <hr />
                    <?php echo get_phrase('status');?> : <?php echo $row['status'];?>
                    <br />
                    <?php echo get_phrase('receipt_no:');?> : <?php echo "FAVECSFP0000",$row['payment_id'];?>
                    <br />
                    <?php echo get_phrase('date');?> : <?php echo date('m/d/Y', $row['creation_timestamp']);?>
                    </div>
                </td>
            </tr>
      </table>
<br />
<br />

        
        <?php endforeach;?>
    </div>
</div>     output: ayment To
fffff
P O BOX 126 Credited Account:
john
Student Id : FAVECSID00006
Class : JHS2A

I have noticed that many websites and php software generate a random token and put it in a hidden form field to be sent to the php page that gets the form. I was just wondering, if anyone knows how this makes a php script more secure? And is it worth it to put this in my application?
I have read up a few tutorials on this, but it doesn't specifically say why this is more secure than not having it. The only reason I could find is that it helps making sure you don't make duplicate form submissions, however, I have always gone around this through by redirecting the user to a page saying the form was submitted successfully.
Cheers for your help.

I am using JWT for an API authentication and like them.  Previously, I would query both some GUID and the user's ID (which wasn't their PK but a unique key per GUID), but now I just include both the account and user's DB PK in the token.  Also, including something regarding the user's permissions, however, I still haven't bought into this approach as I don't know how to deal with changing permissions and still having some JWT with different permissions floating around.  I suppose I could save the JWT's timestamp in the DB, but that seems to eliminate the benefit of token expirations...  Sorry, back to the question at hand.

I now have a need to provide emails with a reduced subset of endpoints to either view some resource or update some status.  I don't want to make the user first go to some website and then include the JWT in the header, but instead just a single click action.  Problem is now I have their JWT which is effectively their password in some email which isn't ideal, and their is no way to ensure that the specific user was the individual that viewed the resource or performed some action.  Then I thought maybe I would make some common low access JWT and use the exact same GET routes as I would do so normally and create some new GET routes to emulate main application POST/PUT/PATCH routes.

Before going down that path, I would like to investigate other solutions.  Often single use tokens are used to reset passwords and other actions which should only performed once and this is not my need but maybe close.  I am thinking of creating a token that includes the actual resource path with URL parameters along with the HTTP method.  Since everything is in the token, I wouldn't need a typical REST path to identify the resource but would have a single endpoint to retrieve them.

I searched for related information and didn't find anything which makes me concerned I am going down a rabbit hole.  Any thoughts on how to implement this?  Thanks

Hi

Is it necessary to hash stored access and refresh tokens that are stored in a database.

Both these tokens have limited lifespan (access token - 20 minutes but refresh token is 14 days).

The reason I ask is I have hashed the tokens using the password_hash function but a user can have multiple active sessions if they want (so there is a sessions table with user id (not username), access token, token expiry date/time, refresh token and refresh token expiry date/time.

So in order to refresh the access token I have to do a look up to see which session it relates to, what I have found is that I must retrieve all rows where the refresh token hasn't expired and then run password_verify against the tokens stored with the tokens provided to check each session to see if they match.

What I have found is that it takes a while to run  the password_verify function (by design I think) for each row (could be many if the users has been silly and logged in lots of time) which would cause an unacceptable delay when calling an API with an access token that needs refreshing (my tests resulted in times upwards of 30 seconds for a user who has around 10 active sessions).

If both tokens were not hashed the same action to refresh a token for a user who has 10 active sessions takes less than a second which is much more acceptable.

Edited December 15, 2018 by mds1256

i want to make virtual money (credits, tokens) whatever you want to call it but make no mistake this is not for profit at this point but i like the concept of visitors having something to do with other members of site for example to kill bordom and create a reason to play games, compete in competetions, it will have to conversion to real money at this point but i wish to do this script using php and mysql and have very basic coding skills in these areas anyone please help me make this script...


reply and let me know if you like this idea


please help me as this is achievable as fb has it and more sites are moving toward these same ideas, even tho fb is real money it is more to do with fun at this point until we do this stage another stage canot proceed it.