SagePay error affecting US customers

Hi Guys,
I hope you are all well it seems a long time ago since I had to post anything here but I am up against the clock on this one, I have a live site which I used ECart5 it was built at the beginning of last year, We have started getting problems relating to US sales, I believe it is to do with the Sage Pay Protx_VSPForm.php

Sage Pay error: Status: MALFORMED 3147 : The BillingState field is required,

I have examined the error and found that several other shopping cart vendors have encountered the same issues and have released fixes,
I have purchased ECart6 but I am currently working full time as a front-end developer for a digital agency based in London and as the cart is quite heavily customised I do not really have the time to run through the whole process again.

I have inspected the Protx_VSPForm.php form and believe the best solution would be to add the BillingState field and associate it with the value from the confirmation page for Billing address State/ County (state_province) and pass this across to Sage Pay, (at the moment I believe we are storing that value in the dB and retrieving it when we get the call back from Sage Pay.)

As the site is live I need to apply a fix quickly and efficiently I have attached the files for your attention please could you take a look and advise me of the best fix for this.

Thanks in advance

Steve,

Please provide a Skype username or a US phone number and a good time to contact you when you will be in front of your computer and we will have an engineer contact you to resolve this issue over the phone.

We are available Monday - Friday from 9am - 4pm EST (except major U.S. holidays).

Thanks for getting back in touch, I will post back to this thread when we have resolved the issue. Please see my private message

I have sent a skype contact request. Please send a skype message when you see me online and we can look into the issue.

Hi Jason
I have added you to my contacts I see you are away at the moment, I will Skype you when I see your online again.

Best

Steve

This is the diagnosis and solution to the error message(s)

Sage Pay error: Status: MALFORMED 3147 : The BillingState field is required
or
Sage Pay error: Status: MALFORMED 3147 : The DeliveryState field is required

As per the Sage Pay protocol 2.23 specification the’ BillingState’ and ‘DeliveryState’ values must be the 2 letters state codes only not a value in the address. Check the Protocol 2.23 documentation for more details.
I created a dB table and added it to my ecommerce database to store the state codes;

I had to create parallel pages to introduce a separate U.S. Checkout pathway which meant creating U.S. versions of the following forms

User registration
Update user profile
Checkout
Confirm

and edit

to Protox-VSPF.php

The reason for this is the US 2 digit codes are required for US purchases from US card holders or from non US customers having the product shipped to a US address. These codes mean nothing nor are there are any compatible codes for the rest of the planet so you still need to either capture these separately or omit the county/state field completely which is no good when printing address labels later.


You need to add the following to Protox-VSPF.php
(In my case around line 28)

, $tBillingState,$tShippingState
ALSO add this
(In my case around line 100)
if ($tBillingState) {
$retStr .= "BillingState=" . $tBillingState . "&";
}
if ($tShippingState) {
$retStr .= "DeliveryState=" . $tShippingState . "&";
}


You need to add this code to the bottom of your confirm.php

Look for the function WA_Protx_VSPFormHash (around line 580 in my script)

Within the value pairs crypt input array at the end after the last values before the closing /> input tags and above the modify button.
"".((isset($_POST["state_province"]))?$_POST["state_province"]:"") ."", "".((isset($_POST["shipping_state_province"]))?$_POST["shipping_state_province"]:"") ."");


Simply upload the scripts and replace the existing ones; Please back up your existing files first so you can roll back if it goes wrong.

This will work in the case of a US registered user shipping to a US address however will still generate a error if a non US citizen is shipping to the US this can be fixed by amending the following input value on the checkout.php page.
STATE_PROVINCE
<input type="text" name="state_province" id="state_province" value="<?php if($row_UserRS1['UserCountry'] == "United States" || $row_UserRS1['UserCountry']=="United States Minor Outlying Islands" || $row_UserRS1['UserCountry']=="Virgin Islands, US") {echo $row_UserRS1['UserState'];} else {echo '';} ?>" placeholder="LEAVE BLANK"/>
That solves both instances however you will not be logging the County/state address field for non US customers unless you do as I and create a parallel system and you will need to ensure they are still using the original forms.

I hope this helps if you remember Back up everything you can always go back and are risking nothing.

Thanks very much to Jason and all at Webassist for the prompt response and fantastic support.

All the best

Steve

Just a further note that I also needed to edit the WA_Protx_VSPFormHash() function definition to add the $tBillingState and $tShippingState to the variables list:

function WA_Protx_VSPFormHash($theCart, $tPassword, $tVendorTxCode, $tAmount, $tCurrency, $tDescription, $tSuccessURL, $tFailureURL, $tCustomerEmail, $tVendorEmail, $tDeliverySurname, $tDeliveryFirstnames, $tDeliveryAddress1, $tDeliveryPostCode, $tDeliveryCity, $tDeliveryCountry, $tBillingSurname, $tBillingFirstnames, $tBillingAddress1, $tBillingPostCode, $tBillingCity, $tBillingCountry, $tContactNumber, $tContactFax, $tAllowGiftAid, $tApplyAVSCV2, $tApply3DSecure, $tEMailMessage, $tBillingState, $tShippingState) {

Private message