3D İle Ödeme Güvenlik Açığı Mevcut. Sizce Ne Yapabilirim?

//hash kontrol
$storekey = 'storekeydeğeriniz'

$hashparams = $_POST["HASHPARAMS"];
$hashparamsval = $_POST["HASHPARAMSVAL"];
$hashparam = $_POST["HASH"];
$paramsval="";
$index1=0;
$index2=0;

while($index1 < strlen($hashparams))
{
	$index2 = strpos($hashparams,":",$index1);
	$vl = $_POST[substr($hashparams,$index1,$index2- $index1)];
	if($vl == null)
	$vl = "";
	$paramsval = $paramsval . $vl; 
	$index1 = $index2 + 1;
}

$hashval = $paramsval.$storekey;
$hash = base64_encode(pack('H*',sha1($hashval)));
//

if($paramsval != $hashparamsval || $hashparam != $hash)
{
	echo "Hash Geçerli Değil !";
	exit;
}

if($mdStatus =="1" || $mdStatus == "2" || $mdStatus == "3" || $mdStatus == "4")
{ 	
	echo "<h5>3D Islemi Basarili</h5><br/>";

	// XML request sablonu
	$request= "DATA=<?xml version=\"1.0\" encoding=\"ISO-8859-9\"?>".
	"<CC5Request>".
	"<Name>{NAME}</Name>".
	"<Password>{PASSWORD}</Password>".
	"<ClientId>{CLIENTID}</ClientId>".
	"<IPAddress>{IP}</IPAddress>".
	"<Email>{EMAIL}</Email>".
	"<Mode>P</Mode>".
	"<OrderId>{OID}</OrderId>".
	"<GroupId></GroupId>".
	"<TransId></TransId>".
	"<UserId></UserId>".
	"<Type>{TYPE}</Type>".
	"<Number>{MD}</Number>".
	"<Expires></Expires>".
	"<Cvv2Val></Cvv2Val>".
	"<Total>{TUTAR}</Total>".
	"<Currency>949</Currency>".
	"<Taksit>{TAKSIT}</Taksit>".
	"<PayerTxnId>{XID}</PayerTxnId>".
	"<PayerSecurityLevel>{ECI}</PayerSecurityLevel>".
	"<PayerAuthenticationCode>{CAVV}</PayerAuthenticationCode>".
	"<CardholderPresentCode>13</CardholderPresentCode>".
	"<BillTo>".
	"<Name></Name>".
	"<Street1></Street1>".
	"<Street2></Street2>".
	"<Street3></Street3>".
	"<City></City>".
	"<StateProv></StateProv>".
	"<PostalCode></PostalCode>".
	"<Country></Country>".
	"<Company></Company>".
	"<TelVoice></TelVoice>".
	"</BillTo>".
	"<ShipTo>".
	"<Name></Name>".
	"<Street1></Street1>".
	"<Street2></Street2>".
	"<Street3></Street3>".
	"<City></City>".
	"<StateProv></StateProv>".
	"<PostalCode></PostalCode>".
	"<Country></Country>".
	"</ShipTo>".
	"<Extra></Extra>".
	"</CC5Request>";


      $request=str_replace("{NAME}",$name,$request);


      $request=str_replace("{PASSWORD}",$password,$request);
      $request=str_replace("{CLIENTID}",$clientid,$request);
      $request=str_replace("{IP}",$lip,$request);
      $request=str_replace("{OID}",$oid,$request);
      $request=str_replace("{TYPE}",$type,$request);
      $request=str_replace("{XID}",$xid,$request);
      $request=str_replace("{ECI}",$eci,$request);
      $request=str_replace("{CAVV}",$cavv,$request);
      $request=str_replace("{MD}",$md,$request);
      $request=str_replace("{TUTAR}",$tutar,$request);
      $request=str_replace("{TAKSIT}",$taksit,$request);


     

	// Sanal pos adresine baglanti kurulmasi
	
        $url = "https://<sunucu_adresi>/<apiserver_path>";  //TEST

		$ch = curl_init();    // initialize curl handle
		
		curl_setopt($ch, CURLOPT_URL,$url); // set url to post to
		curl_setopt($ch, CURLOPT_SSL_VERIFYHOST,1);
		curl_setopt($ch, CURLOPT_SSLVERSION, 3);
		
		curl_setopt($ch, CURLOPT_SSL_VERIFYPEER,0);
		
		curl_setopt($ch, CURLOPT_RETURNTRANSFER,1); // return into a variable
		curl_setopt($ch, CURLOPT_TIMEOUT, 90); // times out after 90s
		curl_setopt($ch, CURLOPT_POSTFIELDS, $request); // add POST fields



        // Buraya mdStatusa göre bir kontrol koymalisiniz.
        // 3d Secure işleminin sonucu mdStatus 1,2,3,4 ise başarılı 5,6,7,8,9,0 başarısızdır
        // 3d Decure işleminin sonucu başarısız ise işlemi provizyona göndermeyiniz (XML göndermeyiniz).

		$result = curl_exec($ch); // run the whole process
//echo htmlspecialchars($result);
echo "<br>";

       if (curl_errno($ch)) {
           print curl_error($ch);
       } else {
           curl_close($ch);
       }
}