diff --git a/sql/gamedb.sql b/sql/gamedb.sql
index 55628e6..ff2a4ee 100644
--- a/sql/gamedb.sql
+++ b/sql/gamedb.sql
@@ -311,6 +311,7 @@ CREATE TABLE `orderinfo` (
   `itemid` int(11) NOT NULL DEFAULT '0' COMMENT 'itemid',
   `coin` double NOT NULL DEFAULT '0' COMMENT '充值金额',
   `status` int(11) NOT NULL DEFAULT '0' COMMENT '0: 新添加订单 1:已经完成订单',
+  `item_list` mediumblob COMMENT 'item_list',
   `confirmtime` int(11) NOT NULL DEFAULT '0' COMMENT 'GameServer订单确认时间',
   `create_time`   int(11) NOT NULL DEFAULT '0' COMMENT '创建时间',
   `modify_time`   int(11) NOT NULL DEFAULT '0' COMMENT '修改时间',
diff --git a/third_party/phpcommon b/third_party/phpcommon
index 1e3bb4d..7ecf558 160000
--- a/third_party/phpcommon
+++ b/third_party/phpcommon
@@ -1 +1 @@
-Subproject commit 1e3bb4df855f6d11df75545d10b0c2aacea34a06
+Subproject commit 7ecf558df93a2656631782e76c6d35697da72808
diff --git a/webapp/controller/PayNotifyController.class.php b/webapp/controller/PayNotifyController.class.php
new file mode 100644
index 0000000..74d350e
--- /dev/null
+++ b/webapp/controller/PayNotifyController.class.php
@@ -0,0 +1,116 @@
+<?php
+
+require 'classes/AddReward.php';
+
+class PayNotifyController{
+
+    protected function getMysql($account_id)
+    {
+        $mysql_conf = getMysqlConfig(crc32($account_id));
+        $conn = new phpcommon\Mysql(array(
+            'host' => $mysql_conf['host'],
+            'port' => $mysql_conf['port'],
+            'user' => $mysql_conf['user'],
+            'passwd' => $mysql_conf['passwd'],
+            'dbname' => 'gamedb2001_' . $mysql_conf['instance_id']
+        ));
+        return $conn;
+    }
+
+    public function payNotify()
+    {
+        $params = array(
+            'account_id' => $_REQUEST['account_id'],
+            'orderid' => $_REQUEST['orderid'],
+            'itemid' => $_REQUEST['itemid'],
+            'itemnum' => $_REQUEST['itemnum'],
+            'amount' => $_REQUEST['amount']
+        );
+        $sign = phpcommon\md5Sign($params, 'fc38349c5d084e920925e614c420be9f', $_REQUEST['timestamp']);
+        if ($sign != $_REQUEST['sign']) {
+            error_log('game2001api payNotify sign error:' + json_encode($_REQUEST));
+            echo json_encode(array(
+                'errcode' => 1,
+                'errmsg'=> '签名校验失败'
+            ));
+            die();
+        }
+        $addreward = new classes\AddReward();
+        $item_list = $addreward->addReward($_REQUEST['itemid'], $_REQUEST['itemnum'], $_REQUEST['account_id']);
+        foreach ($item_list as &$value) {
+            $value['itemnum'] = (float)$value['itemnum'];
+        }
+        error_log(json_encode($item_list));
+        $nowtime = time();
+        $conn = $this->getMysql($_REQUEST['account_id']);
+        $row = $conn->execQueryOne('SELECT orderid, status FROM orderinfo WHERE orderid=:orderid;',
+                                   array(
+                                       ':orderid' => $_REQUEST['orderid']
+                                   ));
+        if (!$row) {
+            $ret = $conn->execScript('INSERT INTO orderinfo(accountid, orderid, itemid, coin, status, '.
+                                     '                      confirmtime, create_time, modify_time, item_list)' .
+                                     'VALUES(:accountid, :orderid, :itemid, :coin, :status,' .
+                                     '       :confirmtime, :create_time, :modify_time, :item_list);',
+                                     array(
+                                         ':accountid' => $_REQUEST['account_id'],
+                                         ':orderid' => $_REQUEST['orderid'],
+                                         ':coin' => $_REQUEST['amount'],
+                                         ':itemid' => $_REQUEST['itemid'],
+                                         ':status' => 1,
+                                         ':confirmtime' => $nowtime,
+                                         ':create_time' => $nowtime,
+                                         ':modify_time' => $nowtime,
+                                         ':item_list' => json_encode($item_list)
+                                     ));
+            if (!$ret) {
+                echo json_encode(array(
+                    'errcode' => 2,
+                    'errmsg'=> '服务器内部错误'
+                ));
+                die();
+            }
+        } else {
+            if ($row['status'] == 1) {
+                echo json_encode(array(
+                    'errcode' => 0,
+                    'errmsg'=> ''
+                ));
+                die();
+            }
+            $ret = $conn->execScript('UPDATE orderinfo SET status=1, item_list=:item_list WHERE orderid=:orderid'.
+                                     array(
+                                         ':orderid' => $_REQUEST['orderid'],
+                                         ':item_list' => json_encode($item_list)
+                                     ));
+            if (!$ret) {
+                echo json_encode(array(
+                    'errcode' => 2,
+                    'errmsg'=> '服务器内部错误'
+                ));
+                die();
+            }
+        }
+        $dayseconds = phpcommon\getdayseconds($nowtime);
+        $conn->execScript('INSERT INTO buy_his(accountid, itemid, sum_times, today_times, ' .
+                          '                    last_buy_time, create_time, modify_time)' .
+                          'VALUES(:accountid, :itemid, 1, 1, ' .
+                          '       :last_buy_time, :create_time, :modify_time)' .
+                          'ON DUPLICATE KEY UPDATE sum_times=sum_times + 1, ' .
+                          '       modify_time=:modify_time, last_buy_time=:last_buy_time,' .
+                          '       today_times=' .
+                          "       CASE WHEN last_buy_time < $dayseconds THEN 1 ELSE today_times + 1 END;",
+                          array(
+                              ':accountid' => $_REQUEST['account_id'],
+                              ':itemid' => $_REQUEST['itemid'],
+                              ':last_buy_time' => $nowtime,
+                              ':create_time' => $nowtime,
+                              ':modify_time' => $nowtime,
+                          ));
+        echo json_encode(array(
+            'errcode' => 0,
+            'errmsg'=> ''
+        ));
+    }
+
+}