Ghost order problem or devious behavior?

[jgarvas]

Last week we rolled a new ZenCart site into production running 1.3.7. We're using the Authorize.net AIM module for payments and it has migrated from Osc seamlessly.

The site replaces an old OScommerce install.

In an effort to not have overlapping orders with those of the past, using the instructions in the FAQ or a sticky post here, I modified an existing order to number 6000 and it successfully made the next real order 6001.

Today around 8:00am this morning we had two new customers create accounts and place orders within minutes of each other. Here is what concerns me:

Authorize.NET sent me two emails six minutes apart from each other confirming a receipt for a transaction. The first was for order #6002 for three items totaling $104.36. The second email was for order #6002 for one item totaling $3.23.

In essence, Authorize.NET thinks both orders are #6002. So I went into the store and looked up the customer from the first order. There is no record of him ever purchasing anything, let alone three items for $100+

Order 6002 does exist for customer #2 for the $3.23 item.

We're using the purchase order mod, which puts an order into a queue to be dispatched to a supplier. Looking in the queue I see order #6001 (purchased over the weekend before all of this) and #6002 for the $3.23 item.

There is literally no record of the three items being purchased, but the fact that Authorize.NET appears to have charged this individual's credit card and there is no order concerns me. Is it a bug? Is it a fluke with an order six minutes apart? Is it someone trying to exploit something and get free merchandise? (If so, it didn't work well, there is no record of the $100 order, so we'd never send it off to the supplier to drop ship)

Has anyone seen this type of behavior? What should I do to determine what happened? Why is it even possible that these two individuals received the same exact order number?

[jgarvas]

Ok. It looks like the buyer saw this:

1064 You have an error in your SQL syntax; check the manual that
corresponds to your MySQL server version for the right syntax to use near
's(qty: 1) + Denim Shirt, Women's(qty: 1) + Sport Shirt(qty: 1) [Date] =>
Fe' at line 1

Is it the comma or the single quotes that are breaking these items?

[Kim]

Is it the comma or the single quotes that are breaking these items?

Yes, there is a patch posted elsewhere on the forum.

[DrByte]

Last week we rolled a new ZenCart site into production running 1.3.7. We're using the Authorize.net AIM module for payments

The "apostrophe" bug and duplicate-order-number issue were fixed in v1.3.8.
As Kim mentioned, there is a partial backport for 1.3.7 compatibility available here: http://www.zen-cart.com/forum/showth...023#post441023

As an aside, you should plan an upgrade ... there's a years' worth of fixes and improvements in 1.3.8a that aren't in 1.3.7.