Connect a secure vote postback

PHP receiver example

The complete example below uses an InnoDB transaction and a unique reward key. Configure secrets and database credentials in your receiver's environment. The rewards and player balance must use the same database transaction. Adapt table and player names to your application; never use this production handler for TEST callbacks.

CREATE TABLE callback_rewards (
  listing VARCHAR(64) CHARACTER SET ascii COLLATE ascii_bin NOT NULL,
  player VARBINARY(255) NOT NULL,
  reset BIGINT NOT NULL,
  PRIMARY KEY (listing, player, reset)
) ENGINE=InnoDB;
-- Existing players table must also use InnoDB and have a unique player ID.

<?php
$expected = getenv('TOPLIST_CALLBACK_SECRET');
$listing = getenv('TOPLIST_LISTING'); // server-controlled identity of this integration
$secret = $_POST['secret'] ?? null;
if ($_SERVER['REQUEST_METHOD'] !== 'POST' || !is_string($expected) || $expected === ''
    || $expected === 'TEST' || !is_string($listing) || !preg_match('/^[a-zA-Z0-9_-]{1,64}$/D', $listing)
    || !is_string($secret) || $secret === 'TEST' || !hash_equals($expected, $secret)) {
    http_response_code(403); exit;
}
$id = $_POST['userid'] ?? null;
$voted = $_POST['voted'] ?? null;
$resetText = $_POST['reset'] ?? null;
$reset = is_string($resetText) ? filter_var($resetText, FILTER_VALIDATE_INT) : false;
if (!is_string($id) || $id === '' || strlen($id) > 255
    || !in_array($voted, ['0','1'], true) || $reset === false || $reset <= 0) {
    http_response_code(400); exit;
}
if ($voted === '0') { http_response_code(200); exit('ok'); }
$pdo = new PDO(getenv('DB_DSN'), getenv('DB_USER'), getenv('DB_PASSWORD'), [
    PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION,
    PDO::ATTR_EMULATE_PREPARES => false
]);
try {
    $pdo->beginTransaction();
    try {
        $insert = $pdo->prepare('INSERT INTO callback_rewards (listing,player,reset) VALUES (?,?,?)');
        $insert->execute([$listing,$id,$reset]);
    } catch (PDOException $e) {
        // MySQL 1062 only: an existing reward is a successful idempotent response.
        if (($e->errorInfo[1] ?? null) !== 1062) { throw $e; }
        $pdo->rollBack(); http_response_code(200); exit('ok');
    }
    $reward = $pdo->prepare('UPDATE players SET points=points+1 WHERE player_id=?');
    $reward->execute([$id]);
    if ($reward->rowCount() !== 1) { throw new RuntimeException('Unknown player'); }
    $pdo->commit(); http_response_code(200); echo 'ok';
} catch (Throwable $e) {
    if ($pdo->inTransaction()) { $pdo->rollBack(); }
    // Log a generic internal error without tokens or request contents.
    http_response_code(500);
}