Payflow Pro workable, mostly complete module

I am trying to make a module that handles verisign's payflowpro gateway. I've got it working, but I think it's pretty ugly and I'm curious if anyone has any thoughts on security. I got initial code from http://ca.php.net/pfpro and used the ccard.module as my base. We have a few sites on the server but no one has access besides myself (aside from limited FTP and normal http access). I am also in the process of setting up an SSL connection for this process.

If you are going to try it, you have to change the info in the _payflowpro_process function on lines 163-166 and lines 179, 180 and 186

<?php
/*
 * $Id: payflowpro.module,v 1 2006/06/29 by alynner copied from ccard by gordon
 */

function payflowpro_help($section = '') {
  switch ($section) {
    case 'admin/modules#description':
      return t('payflowpro payment processing.<br />Dependency: payment.module');
      break;
    case 'admin/settings/payflowpro':
      return t('Enter the required parameters that have been supplied during the signup process with payflowpro.');
      break;
  }
}

function payflowpro_menu($maycache) {
  if ($maycache) {
    $items[] = array(
      'path' => 'store/payment/payflowpro',
      'title' => t('Enter Credit Card Details'),
      'callback' => 'payflowpro_enter_payment',
      'access' => 1,
      'type' => MENU_CALLBACK
    );
  }
  return $items;
}

function payflowpro_ec_settings() {
  $form = array();
  $form['payflowpro_url'] = array(
    '#type' => 'textfield', 
    '#title' => t('Credit Card Payment Page'), 
    '#default_value' => variable_get('payflowpro_url', url('store/payment/payflowpro', null, null, true)), 
    '#size' => 70, 
    '#maxlength' => 180, 
    '#desciption' => t('URL to be directed to so that the payment can be received.'),
    '#required' => true
   );
  $form['payflowpro_thanks_url'] = array(
    '#type' => 'textfield', 
    '#title' => t('Thank you Page'), 
    '#default_value' => variable_get('payflowpro_thanks_url', url('node', null, null, true)), 
    '#size' => 70, 
    '#maxlength' => 180, 
    '#desciption' => t('URL to be directed once the payment has been entered.'),
    '#required' => true
   );
  return $form;
}

function payflowpro_paymentapi(&$edit, $op, $arg = '') {
  switch ($op) {
    case 'display name':
      return t('Credit Card');
      break;
    case 'payment page':
      if ($edit->gross > 0) {
        return payment_cc_goto($edit, variable_get('payflowpro_url', url('store/payment/payflowpro', null, null, true)));
      }
      break;
  }
}

function payflowpro_ec_transactionapi(&$txn, $op, $a3 = NULL, $a4 = NULL) {
  if ($txn->payment_method != 'payflowpro') return NULL;
  
  switch($op) {
    case 'delete':
      return payment_cc_delete($edit);
      break;
    case 'insert':
    case 'update':
      return payment_cc_save($edit);
      break;
  }
}

/*
 * Internal Functions
 */

function payflowpro_enter_payment() {
  global $user;

  $txnid = $_GET['txnid'];
  $t = store_transaction_load($txnid);
  if (($user->uid != $t->uid && !user_access('administer store')) || $t->payment_status != 1) {
    drupal_access_denied();
    exit();
  }
  return payflowpro_payment_form($t);
}

function payflowpro_payment_form($t) {
  $form['billing'] = array(
    '#type' => 'credit_card',
    '#required' => TRUE,
    '#name' => $t->address['billing']->firstname . ' ' . $t->address['billing']->lastname,
    '#cvnshow' => TRUE
  );
  $form[] = array(
    '#type' => 'submit',
    '#value' => t('submit payment'),
  );
  $form['t'] = array(
    '#type' => 'value',
    '#value' => $t
  );
  return drupal_get_form('payflowpro_payment_form', $form);
}

function payflowpro_payment_form_validate($form_id, &$values) {
  global $form_values; // use global value here so data from processing is available later
  $t =& $form_values['t'];
  if (!valid_credit_card($form_values) || !_payflowpro_process($form_values)) {
	return payment_cc_goto($t, variable_get('payflowpro_url', url('store/payment/payflowpro', null, null, true)));
  }
}

function payflowpro_payment_form_submit($form_id, &$form_values) {
  if (!valid_credit_card($form_values) || !_payflowpro_process($form_values)) {
	$url = url('store/history', null, null, true);
	  drupal_set_message(t('Sorry, your payment has not been accepted'));
	  return $url;
  }
  else {
	  $t =& $form_values['t'];
	  $t->payment_status = payment_get_status_id('completed');
	  $form_values['txnid'] = $t->txnid;
	
	  // check to see if there are any shippable items
	  $has_shippable = false;
	  foreach ($t->items as $p) {
		if (product_is_shippable($p->nid)) {
		  $has_shippable = true;
		  break;
		}
	  }
	  if (!$has_shippable) {
		$form_values['workflow'] = 6;
	  }
	
	  store_transaction_save($t);
	  store_send_invoice_email($t);
	
	  $url = variable_get('payflowpro_thanks_url', url('node', null, null, true));
	  drupal_set_message(t('your payment has been accepted, thank you'));
	 
	  return $url;
	}
}

/*
 * Private functions
 */

function _payflowpro_process(&$edit) {
     
     //enter your payflow account info here
     
     $user          = "USER";
     $vendor        = "VENDOR";
     $partner        = "PARTNER";
     $pwd            = "PASSWORD";

     $host        = "test-payflow.verisign.com";
     $port        = "443";
	 
	 $amt = $edit[t]->gross;
	 $acct = $edit['cardnumber'];
	 $expdate = $edit['expiry']['expmonth'].$edit['expiry']['expyear'];



     // Adjust these next two paths appropriately; i.e. where did
     // you actually put these two files?
       $binary        = '/path/to/pfpro';
       $library        = '/path/to/libpfpro.so';
       $newld          = dirname($library);
       
       // this is necessary to prevent RESULT=-31 errors; make sure
     // it's a *directory* that contains the cert file that came
     // with the SDK, and *don't* put a trailing slash on it
       putenv("PFPRO_CERT_PATH=/path/to/cert");
       
 
       // This next chunk of stuff assumes you're having linker issues, and
       // attempts to fix or work around them.
       // Now, let's fix the linker path:
       $original_ld_path = getenv("LD_LIBRARY_PATH");
       $newld .= ":$original_path";
       putenv("LD_LIBRARY_PATH=$newld");

       // having set the linker to find the library, now call the binary:
       $cmd = "\"TRXTYPE=S&TENDER=C&PWD=$pwd&USER=$user&VENDOR=$vendor";
       $cmd .= "&PARTNER=$partner&ACCT=$acct&EXPDATE=$expdate&AMT=$amt";
       $cmd .= "\" 30";
       $result = exec("$binary $host $port $cmd", $result_array, $exit_value);

       $valArray = explode('&', $result);

       foreach($valArray as $val) {
               $valArray2 = explode('=', $val);
               $pfpro[$valArray2[0]] = $valArray2[1];
       }

       // To look at the array structure
       //print_r($pfpro);
	   //echo "<br />".$cmd."<br />";
	   //print_r($edit);

       // This should be equal to the RESULT that came back. If you
     // get no result string back, but the exit_value here is 126 or 127,
     // you've got linker or permission problems.
      // echo "the exit value of the system call to pfpro was $exit_value";

  if ($pfpro[RESULT] === '0') {
    
	return  true;
  }
  else { 
	return false;
  }

}

/*
 * Remove dependancy on PHP5
 */

if(!function_exists('http_build_query')) {
  function http_build_query( $formdata, $numeric_prefix = null, $key = null ) {
    $res = array();
    foreach ((array)$formdata as $k=>$v) {
      $tmp_key = urlencode(is_int($k) ? $numeric_prefix.$k : $k);
      if ($key) {
        $tmp_key = $key.'['.$tmp_key.']';
      }
      if ( is_array($v) || is_object($v) ) {
        $res[] = http_build_query($v, null, $tmp_key);
      } else {
        $res[] = $tmp_key."=".urlencode($v);
      }
    }
    return implode("&", $res);
  }
}

I wasn't quite sure where the function payflowpro_payment_form_validate came into play because it always said payment was accepted, even if the _payflowpro_process function returned false. That's when I stuck the if statement into the payflowpro_payment_form_submit function and now it seems to do what it needs to do.

please let me know any of your thoughts, concerns, etc.

thanks
alynner

PS I wasn't sure exactly where to post this, so I put in feature requests, hope thats ok