BannerConnect

Partners place an HTML banner on their website. When a visitor clicks, a 30-day tracking cookie is set. If that visitor later completes a purchase — via Stripe, Square, or a manually entered sale — commission is calculated at the partner's rate and queued for payout.

Partner Onboarding

Click & Cookie Flow

When a visitor clicks the banner, banner.php does exactly three things:

Sale Recording — Three Paths

All three paths insert a sales row with sale_status='confirmed' and commission_status='pending'.

Payout Flow

Reading the cookie on your checkout page

$ref  = json_decode(base64_decode($_COOKIE['bc_ref'] ?? ''), true);
$p_id = (int)($ref['p'] ?? 0);   // partner_id
$b_id = (int)($ref['b'] ?? 0);   // banner_id

Passing to Stripe (session metadata)

$session = \Stripe\Checkout\Session::create([
    // ... line_items, mode, urls ...
    'metadata' => [
        'bc_partner_id' => $p_id,
        'bc_banner_id'  => $b_id,
    ],
]);

Passing to Square (payment note)

// In your Square CreatePayment call:
'note' => "bc_partner:{$p_id},bc_banner:{$b_id}"

Pages

Partner Statuses

Session Keys Set on Partner Login

Pages

Managing Banners

Create via the Add Banner modal — select an active partner, enter a title, upload an image (JPG/PNG/GIF/WebP, max 5MB). Status defaults to active. The embed code URL format:

https://a1appbuilders.com/addons/bannerconnect/banner.php?b={banner_id}

Toggle pauses/activates. Delete removes the DB record and the uploaded image file.

Managing Partners

Filter by status tab. Commission rate is an inline editable number field — save with the ✓ button. The Approve action sets status to active and sends an approval email. Delete is permanent and removes all partner data (requires confirmation).

Recording a Manual Sale

Use admin/record-sale.php for Stripe/Square payments that missed the webhook, or for invoiced/Zelle payments. Commission is calculated live as a preview. Required: partner + sale amount. If the partner has notify_on_sale = 1, they receive an email automatically.

Processing Payouts

The left panel shows all partners with pending commissions. Click Pay Out to pre-fill the form, set the date, add optional notes (e.g. "Paid via Zelle #123"), then submit. All pending commissions for that partner are marked paid in one atomic operation and the partner is emailed a summary.

Stripe

Square

All settings are stored in the settings table as key/value pairs and managed from admin/settings.php.

General

Branding

Stripe Keys

stripe_public_key  ·  stripe_secret_key  ·  stripe_webhook_secret

Square Keys

square_access_token  ·  square_location_id  ·  square_application_id  ·  square_webhook_secret

All email goes through bc_email() in admin/includes/config.php, which wraps send_mail() (PHPMailer over SMTP). SMTP credentials are defined as constants — not stored in the database.

Emails Sent Automatically

Session Timeout — Two-Layer Enforcement

Timeout is 30 minutes (SESSION_TIMEOUT = 1800). Two layers prevent stale sessions:

if (isset($_SESSION['bc_last_activity'])
    && (time() - $_SESSION['bc_last_activity']) > SESSION_TIMEOUT) {
    session_unset();
    session_destroy();
    session_start();
    session_regenerate_id(true);
}
$_SESSION['bc_last_activity'] = time();

CSRF Protection

Every POST form includes a hidden csrf_token field. Generated by csrf_token(), verified by verify_csrf(). Token stored in $_SESSION['bc_csrf'].

Auth Guards

require_bc_admin();    // redirects to /admin/login.php if not admin
require_bc_partner();  // redirects to /partners/login.php if not partner
                        // returns partner array on success

Security Headers

Set after session_start() in every request:

X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block

Engine: SQLite3 only. Path: admin/database/bannerconnect.db. WAL mode + foreign keys enabled on every connection.

$db = new Database();
$stmt = $db->conn->prepare("SELECT ...");
$stmt->bindValue(':key', $val, SQLITE3_TEXT);
$row = $stmt->execute()->fetchArray(SQLITE3_ASSOC);

Core Tables

Key Sales Columns

All DB operations and mail sends are wrapped in try/catch. A logging or email failure will never cause a 500 error.

File: admin/includes/config.php — included by every PHP file in the system.

Path Constants

Web Path Constants

Shared Functions

Rates are set per-partner by admin from the Partners page — there is no automatic tier progression. When a rate is updated, the embed code stays the same; only the commission calculation changes.