diff --git a/doc/Hero.py b/doc/Hero.py
index b02f24e..84861ac 100644
--- a/doc/Hero.py
+++ b/doc/Hero.py
@@ -18,7 +18,32 @@ class Hero(object):
                     _common.RspHead(),
                     ['!hero_list', _common.Hero, '英雄列表']
                 ]
-            }
+            },
+            {
+                'desc': 'buyHero',
+                'group': 'Hero',
+                'url': 'webapp/index.php?c=Hero&a=buyHero',
+                'params': [
+                    _common.ReqHead(),
+                    ['hero_id', '', '英雄id'],
+                    ['buy_type', '', '购买类型0：指购买英雄 1：购买英雄和皮肤'],
+                ],
+                'response': [
+                    _common.RspHead(),
+                    ['award', _common.Award, '奖励信息'],
+                ]
+            },
+            {
+                'desc': 'buySkin',
+                'group': 'Hero',
+                'url': 'webapp/index.php?c=Hero&a=buySkin',
+                'params': [
+                    _common.ReqHead(),
+                ],
+                'response': [
+                    _common.RspHead(),
+                ]
+            },
         ]
         self.apis_ = [
         {
diff --git a/doc/_common.py b/doc/_common.py
index 1a4212d..2907cfd 100644
--- a/doc/_common.py
+++ b/doc/_common.py
@@ -170,3 +170,9 @@ class RewardItemInfo(object):
             ['item_num', 0, '道具数量'],
             ['time', 0, '时间'],
         ]
+
+class Award(object):
+
+    def __init__(self):
+        self.fields = [
+        ]
diff --git a/webapp/bootstrap/init.php b/webapp/bootstrap/init.php
index 665b0e6..906f400 100644
--- a/webapp/bootstrap/init.php
+++ b/webapp/bootstrap/init.php
@@ -2,6 +2,7 @@
 
 ini_set('date.timezone','Asia/Shanghai');
 require 'phpcommon/common.php';
+require_once('phpcommon/sqlhelper.php');
 require_once('models/BaseModel.php');
 
 define('TEAMID_KEY', 'team_uuid:');
@@ -108,11 +109,30 @@ function getResBaseDir()
     return '../res/';
 }
 
+function getXVal($arr, $name, $defVal = null)
+{
+    $val = array_key_exists($name, $arr) ? $arr[$name] : $defVal;
+    return $val;
+}
+
+function getReqVal($name, $defVal)
+{
+    return getXVal($_REQUEST, $name, $defVal);
+}
+
 function emptyReplace($val, $defVal)
 {
     return !empty($val) ? $val :$defVal;
 }
 
+$_myself = null;
+
+function myself()
+{
+    global $_myself;
+    return $_myself;
+}
+
 require 'config_loader.php';
 
 function new_sendError($errcode, $errmsg_tid, $errmsg)
diff --git a/webapp/controller/BaseAuthedController.class.php b/webapp/controller/BaseAuthedController.class.php
index 89be93f..f0cc3b2 100644
--- a/webapp/controller/BaseAuthedController.class.php
+++ b/webapp/controller/BaseAuthedController.class.php
@@ -27,28 +27,29 @@ class BaseAuthedController extends BaseController {
            die();
         }
     }
-    protected function getAccountId()
+
+    public function getAccountId()
     {
         return $this->accountId;
     }
 
-    protected function getChannel()
+    public function getChannel()
     {
         return phpcommon\extractChannel($this->getAccountId());
     }
 
-    protected function getSessionId()
+    public function getSessionId()
     {
         return $this->sessionId;
     }
 
-    protected function getRegisterTime()
+    public function getRegisterTime()
     {
         $registertime = phpcommon\extractRegisterTimeFromSessionId($this->sessionId);
         return $registertime;
     }
 
-    protected function getMysql($data)
+    public function getMysql($data)
     {
         $mysql_conf = getMysqlConfig(crc32($data));
         //error_log("Sql01=====".json_encode($mysql_conf)."==".DBNAME_PREFIX . $mysql_conf['instance_id']);
@@ -62,7 +63,7 @@ class BaseAuthedController extends BaseController {
         return $conn;
     }
 
-    protected function getSelfMysql()
+    public function getSelfMysql()
     {
         if (!$this->mysqlConn) {
             $this->mysqlConn = $this->getMysql($this->getAccountId());
@@ -70,7 +71,7 @@ class BaseAuthedController extends BaseController {
         return $this->mysqlConn;
     }
 
-    protected function getRedis($data)
+    public function getRedis($data)
     {
         $redis_conf = getRedisConfig(crc32($data));
         $r = new phpcommon\Redis(array(
@@ -82,12 +83,12 @@ class BaseAuthedController extends BaseController {
         return $r;
     }
 
-    protected function isValidSex($sex)
+    public function isValidSex($sex)
     {
         return in_array($sex, array(0, 1, 2));
     }
 
-    protected function getUserInfo($fields)
+    public function getUserInfo($fields)
     {
         $row = SqlHelper::selectOne
              ($this->getSelfMysql(),
@@ -105,7 +106,7 @@ class BaseAuthedController extends BaseController {
         return $row;
     }
 
-    protected function getOrmUserInfo()
+    public function getOrmUserInfo()
     {
         $row = SqlHelper::ormSelectOne
              ($this->getSelfMysql(),
@@ -122,7 +123,7 @@ class BaseAuthedController extends BaseController {
         return $row;
     }
 
-    protected function safeGetOrmUserInfo()
+    public function safeGetOrmUserInfo()
     {
         $row = SqlHelper::ormSelectOne
              ($this->getSelfMysql(),
@@ -134,7 +135,7 @@ class BaseAuthedController extends BaseController {
         return $row ? $row : null;
     }
 
-    protected function updateUserInfo($fieldsKv)
+    public function updateUserInfo($fieldsKv)
     {
         SqlHelper::update
              ($this->getSelfMysql(),
@@ -146,7 +147,7 @@ class BaseAuthedController extends BaseController {
              );
     }
 
-    protected function sendDataToClient($_code,$_msg,$_data)
+    public function sendDataToClient($_code,$_msg,$_data)
     {
         echo json_encode(array(
             'errcode' => $_code,
@@ -155,7 +156,7 @@ class BaseAuthedController extends BaseController {
         ));
     }
 
-    protected function getItem($itemId)
+    public function getItem($itemId)
     {
         $row = SqlHelper::selectOne
               ($this->getSelfMysql(),
@@ -177,7 +178,7 @@ class BaseAuthedController extends BaseController {
         );
     }
 
-    protected function getItemCount($itemId, $userInfo)
+    public function getItemCount($itemId, $userInfo)
     {
         switch ($itemId) {
         case V_ITEM_GOLD:
@@ -214,7 +215,7 @@ class BaseAuthedController extends BaseController {
         }
     }
 
-    protected function isVirtualItem($itemId)
+    public function isVirtualItem($itemId)
     {
         $isVirtualItem = false;
         if($itemId == $this->goldID)
@@ -228,7 +229,7 @@ class BaseAuthedController extends BaseController {
         return $isVirtualItem;
     }
 
-    protected function addItem($items)
+    public function addItem($items)
     {
         foreach ($items as $item) {
             if ($this->isVirtualItem($item['item_id'])) {
@@ -265,7 +266,12 @@ class BaseAuthedController extends BaseController {
         }
     }
 
-    protected function decItem($items)
+    public function decItems($items)
+    {
+        $this->decItem($items);
+    }
+
+    public function decItem($items)
     {
         foreach ($items as $item) {
             if ($this->isVirtualItem($item['item_id'])) {
@@ -290,7 +296,7 @@ class BaseAuthedController extends BaseController {
             }
         }
     }
-    protected function deleteItem($item)
+    public function deleteItem($item)
     {
         $tmpItemID = $item["item_id"];
         $beDeleteNum = $item['item_num'];
@@ -314,7 +320,7 @@ class BaseAuthedController extends BaseController {
        
         return $code;
     }
-    protected function decGold($decGold)
+    public function decGold($decGold)
     {
         SqlHelper::update
             (
@@ -331,7 +337,7 @@ class BaseAuthedController extends BaseController {
         // $this->incV(TN_CONSUME_GOLD, $this->getNowDaySeconds(), $decGold);
     }
 
-    protected function addGold($addGold)
+    public function addGold($addGold)
     {
         SqlHelper::update
             (
@@ -345,7 +351,7 @@ class BaseAuthedController extends BaseController {
                 )
             );
     }
-    protected function addLottery($addLottery)
+    public function addLottery($addLottery)
     {
         SqlHelper::update
             (
@@ -359,7 +365,7 @@ class BaseAuthedController extends BaseController {
                 )
             );
     }
-    protected function checkPriceEnough($_priceID,$_priceNum)
+    public function checkPriceEnough($_priceID,$_priceNum)
     {
         //$priceStrArr = explode(":",$price);
         $tmpID = $_priceID;
@@ -415,7 +421,7 @@ class BaseAuthedController extends BaseController {
         return $code;
     }
 
-    protected function getTalentLv($skillId, $skillTypeId)
+    public function getTalentLv($skillId, $skillTypeId)
     {
         $row = SqlHelper::selectOne
              (
@@ -435,7 +441,7 @@ class BaseAuthedController extends BaseController {
         return $row ? $row['skill_iv'] : 0;
     }
 
-    protected function hasEnoughItemsEx($items, &$lackItem)
+    public function hasEnoughItemsEx($items, &$lackItem)
     {
         $userInfo = $this->getUserInfo(array(
             'coin_num',
@@ -456,7 +462,7 @@ class BaseAuthedController extends BaseController {
         return true;
     }
 
-    protected function getDtoUserInfo($userInfo)
+    public function getDtoUserInfo($userInfo)
     {
         return array(
             'game_times' => $userInfo['game_times'],
@@ -531,68 +537,7 @@ class BaseAuthedController extends BaseController {
         );
     }
 
-    protected function addHero($heroMeta)
-    {
-        if (!$heroMeta) {
-            return;
-        }
-        SqlHelper::upsert
-            ($this->getSelfMysql(),
-             't_hero',
-             array(
-                 'accountid' => $this->getAccountId(),
-                 'hero_id' => $heroMeta['id']
-             ),
-             array(
-             ),
-             array(
-                 'accountid' => $this->getAccountId(),
-                 'hero_id' => $heroMeta['id'],
-                 'hero_lv' => 1,
-                 'skin_id' => mt\Player::getDefaultSkin($heroMeta),
-                 'skill1_lv1' => 1,
-                 'skill1_lv2' => 1,
-                 'yoke_exp' => 0,
-                 'yoke_total_exp' => 0,
-                 'createtime' => $this->getNowTime(),
-                 'modifytime' => $this->getNowTime()
-             )
-            );
-        $defSkin = mt\Player::getDefaultSkin($heroMeta);
-        if ($defSkin) {
-            $this->addHeroSkinXX($heroMeta['id'], $defSkin);
-        }
-    }
-
-    protected function addHeroSkinXX($heroId, $skinId)
-    {
-        SqlHelper::upsert
-        ($this->getSelfMysql(),
-            't_hero_skin',
-            array(
-                'accountid' => $this->getAccountId(),
-                'hero_id' => $heroId,
-                'skin_id' => $skinId
-            ),
-            array(
-                'skin_state' => 3,
-                'modifytime' => $this->getNowTime()
-            ),
-            array(
-                'accountid' => $this->getAccountId(),
-                'hero_id' => $heroId,
-                'skin_id' => $skinId,
-                'skin_state' => 0,
-                'get_from' => 0,
-                'consume_num' => 0,
-                'trytime' => 0,
-                'createtime' => $this->getNowTime(),
-                'modifytime' => $this->getNowTime()
-            )
-        );
-    }
-
-    protected function getUsingEquipId()
+    public function getUsingEquipId()
     {
         $row = SqlHelper::selectOne
              ($this->getSelfMysql(),
@@ -607,14 +552,14 @@ class BaseAuthedController extends BaseController {
         return $row ? $row['using_id'] : 0;
     }
 
-    protected function redisSetAndExpire($pk, $key, $val, $time)
+    public function redisSetAndExpire($pk, $key, $val, $time)
     {
         $r = $this->getRedis($pk);
         $r->set($key, $val);
         $r->pexpire($key, $time);
     }
 
-    protected function redisGetJson($pk, $key)
+    public function redisGetJson($pk, $key)
     {
         $r = $this->getRedis($pk);
         $dataStr = $r->get($key);
diff --git a/webapp/controller/BaseController.class.php b/webapp/controller/BaseController.class.php
index 78ceb72..63375c6 100644
--- a/webapp/controller/BaseController.class.php
+++ b/webapp/controller/BaseController.class.php
@@ -1,7 +1,5 @@
 <?php
 
-require 'phpcommon/sqlhelper.php';
-
 use phpcommon\SqlHelper;
 
 class BaseController {
@@ -10,6 +8,8 @@ class BaseController {
 
     function __construct()
     {
+        global $_myself;
+        $_myself = $this;
         $this->nowtime = phpcommon\getNowTime();
     }
 
@@ -21,22 +21,22 @@ class BaseController {
     {
     }
 
-    protected function getNowTime()
+    public function getNowTime()
     {
         return $this->nowtime;
     }
 
-    protected function getNowDaySeconds()
+    public function getNowDaySeconds()
     {
         return phpcommon\getDaySeconds($this->nowtime);
     }
 
-    protected function getTodayRemainSeconds()
+    public function getTodayRemainSeconds()
     {
         return max(0, $this->getNowDaySeconds() + 3600 * 24 - $this->getNowTime());
     }
 
-    protected function rspErr($errcode, $errmsg)
+    public function rspErr($errcode, $errmsg)
     {
         echo json_encode(array(
             'errcode' => $errcode,
@@ -44,7 +44,7 @@ class BaseController {
         ));
     }
 
-    protected function rspOk()
+    public function rspOk()
     {
         echo json_encode(array(
             'errcode' => 0,
@@ -52,7 +52,7 @@ class BaseController {
         ));
     }
 
-    protected function rspDataOld($data)
+    public function rspDataOld($data)
     {
         echo json_encode(array(
             'errcode' => 0,
@@ -61,7 +61,7 @@ class BaseController {
         ));
     }
 
-    protected function rspData($data)
+    public function rspData($data)
     {
         $rawData = array(
             'errcode' => 0,
@@ -73,12 +73,12 @@ class BaseController {
         echo json_encode($rawData);
     }
 
-    protected function rspRawData($rawData)
+    public function rspRawData($rawData)
     {
         echo json_encode($rawData);
     }
 
-    protected function getExplode($string)
+    public function getExplode($string)
     {
         $delim = "|";
         $drop_multiply = explode($delim, $string);
diff --git a/webapp/controller/HeroController.class.php b/webapp/controller/HeroController.class.php
index 40e3801..0a5f116 100644
--- a/webapp/controller/HeroController.class.php
+++ b/webapp/controller/HeroController.class.php
@@ -1,6 +1,7 @@
 <?php
 
-require_once('mt/NewShop.php');
+require_once('mt/Shop.php');
+require_once('mt/Hero.php');
 
 require_once('models/Hero.php');
 
@@ -27,6 +28,51 @@ class HeroController extends BaseAuthedController {
         ));
     }
 
+    public function buyHero()
+    {
+        $heroId = getReqVal('hero_id', 0);
+        $buyType = getReqVal('buy_type', 0);
+        $heroMeta = mt\Hero::get($heroId);
+        if ($heroMeta) {
+            $this->rspErr(1, 'hero_id参数错误');
+            return;
+        }
+        if (empty($heroMeta['itemid'])) {
+            $this->rspErr(2, 'hero.item_id配置错误');
+            return;
+        }
+        if (!in_array($buyType, array(0, 1))) {
+            $this->rspErr(1, 'buy_type参数错误');
+            return;
+        }
+        $shopMeta = mt\Shop::get(mt\Shop::HERO_SHOP_ID);
+        if (!$shopMeta) {
+            $this->rspErr(2, '配置表错误');
+            return;
+        }
+        $goodsInfo = mt\Shop::getGoodsInfo($shopMeta, $heroMeta['itemid']);
+        if (empty($goodsInfo)) {
+            $this->rspErr(2, '配置表错误');
+            return;
+        }
+        $costItems = array(
+            'item_id' => $goodsInfo['costItemId'],
+            'item_num' => $goodsInfo['costItemNum'],
+        );
+        $lackItem = null;
+        if (!$this->hasEnoughItemsEx($costItems, $lackItem)) {
+            $this->rspErr(3, '道具不足');
+            return;
+        }
+        $this->decItems($costItems);
+        Hero::addHero($heroMeta);
+    }
+
+    public function buySkin()
+    {
+
+    }
+
     private function addHeroToDB($heroID,$_heroCfg)
     {
         $code = 100;
@@ -91,21 +137,6 @@ class HeroController extends BaseAuthedController {
         return $resultArr;
     }
 
-    public function getAllHero()
-    {
-        $account_id = $_REQUEST['account_id'];
-        $conn = $this->getMysql($account_id);
-        $sqlStr = "SELECT id,lv,skinid,skill1_lv1,skill1_lv2,yokeexp,yoketotalexp FROM hero WHERE accountid=:accountid; ";
-        $row = $conn->execQuery($sqlStr,array(':accountid' => $account_id));
-        if($row) {
-            //error_log("getHero======");
-        }
-        else{
-           // error_log("getHeroFailed=======");
-        }
-        $this->sendDataToClient(0,"getHero",$row);
-    }
-
     public function getHeroInfoByID()
     {
         $account_id = $_REQUEST['account_id'];
@@ -141,7 +172,7 @@ class HeroController extends BaseAuthedController {
       
         $this->sendDataToClient(100,"updateHeroSkin",$skinID);
     }
-    public function buySkin()//购买英雄皮肤
+    public function buySkin1()//购买英雄皮肤
     {
         
         $account_id = $_REQUEST['account_id'];
@@ -199,7 +230,7 @@ class HeroController extends BaseAuthedController {
         $this->sendDataToClient($code,"buyHeroSuccess",$skinData);
 
     }
-    public function buyHero()//购买英雄
+    public function buyHero1()//购买英雄
     {
         
         $playerCfg = require('../res/player@player.php');
diff --git a/webapp/controller/UserController.class.php b/webapp/controller/UserController.class.php
index fb2d75b..d5a3369 100644
--- a/webapp/controller/UserController.class.php
+++ b/webapp/controller/UserController.class.php
@@ -4,6 +4,7 @@ require 'classes/Quest.php';
 require 'classes/AddReward.php';
 
 require_once('models/User.php');
+require_once('models/Hero.php');
 
 require_once('mt/Parameter.php');
 require_once('mt/Drop.php');
@@ -17,6 +18,7 @@ require_once('mt/Robot.php');
 
 use phpcommon\SqlHelper;
 use models\User;
+use models\Hero;
 
 class UserController extends BaseAuthedController {
 
@@ -78,7 +80,7 @@ class UserController extends BaseAuthedController {
             foreach (mt\Parameter::getListValue('creator_hero_id') as $heroId) {
                 $heroMeta = mt\Player::get($heroId);
                 if ($heroMeta) {
-                    $this->addHero($heroMeta);
+                    Hero::addHero($heroMeta);
                 }
             }
         }
diff --git a/webapp/models/Hero.php b/webapp/models/Hero.php
index 39eceb7..1fc73dc 100644
--- a/webapp/models/Hero.php
+++ b/webapp/models/Hero.php
@@ -2,6 +2,11 @@
 
 namespace models;
 
+require_once('mt/Hero.php');
+
+use mt;
+use phpcommon\SqlHelper;
+
 class Hero extends BaseModel {
 
     public static function toDto($row)
@@ -17,4 +22,57 @@ class Hero extends BaseModel {
         );
     }
 
+    public static function addHero($heroMeta)
+    {
+        $defSkin = mt\Hero::getDefaultSkin($heroMeta);
+        SqlHelper::upsert(
+            myself()->getSelfMysql(),
+            't_hero',
+            array(
+                'accountid' => myself()->getAccountId(),
+                'hero_id' => $heroMeta['id']
+            ),
+            array(
+            ),
+            array(
+                'accountid' => myself()->getAccountId(),
+                'hero_id' => $heroMeta['id'],
+                'hero_lv' => 1,
+                'skin_id' => $defSkin,
+                'skill1_lv1' => 1,
+                'skill1_lv2' => 1,
+                'yoke_exp' => 0,
+                'yoke_total_exp' => 0,
+                'createtime' => myself()->getNowTime(),
+                'modifytime' => myself()->getNowTime()
+            )
+        );
+        if ($defSkin) {
+            SqlHelper::upsert(
+                myself()->getSelfMysql(),
+                't_hero_skin',
+                array(
+                    'accountid' => myself()->getAccountId(),
+                    'hero_id' => $heroMeta['id'],
+                    'skin_id' => $defSkin
+                ),
+                array(
+                    'skin_state' => 3,
+                    'modifytime' => myself()->getNowTime()
+                ),
+                array(
+                    'accountid' => myself()->getAccountId(),
+                    'hero_id' => $heroMeta['id'],
+                    'skin_id' => $defSkin,
+                    'skin_state' => 0,
+                    'get_from' => 0,
+                    'consume_num' => 0,
+                    'trytime' => 0,
+                    'createtime' => myself()->getNowTime(),
+                    'modifytime' => myself()->getNowTime()
+                )
+            );
+        }
+    }
+
 }
diff --git a/webapp/mt/Hero.php b/webapp/mt/Hero.php
new file mode 100644
index 0000000..064e152
--- /dev/null
+++ b/webapp/mt/Hero.php
@@ -0,0 +1,30 @@
+<?php
+
+namespace mt;
+
+use phpcommon;
+
+class Hero {
+
+    public static function get($id)
+    {
+        return self::getMetaList()[$id];
+    }
+
+    public static function getDefaultSkin($meta)
+    {
+        $values = explode('|', $meta["skinlist"]);
+        return count($values) > 0 ? $values[0] : 0;
+    }
+
+    protected static function getMetaList()
+    {
+        if (!self::$metaList) {
+            self::$metaList = getMetaTable('player@player.php');
+        }
+        return self::$metaList;
+    }
+
+    protected static $metaList;
+
+}
diff --git a/webapp/mt/Shop.php b/webapp/mt/Shop.php
new file mode 100644
index 0000000..29fef77
--- /dev/null
+++ b/webapp/mt/Shop.php
@@ -0,0 +1,75 @@
+<?php
+
+namespace mt;
+
+use phpcommon;
+
+class Shop {
+
+    const HERO_SHOP_ID = 1;
+
+    public static function get($id)
+    {
+        getXVal(self::getMetaList(), $id);
+    }
+
+    public static function getGoodsInfo($meta, $goodsId)
+    {
+        $goodsStrArr = explode("|", $meta['goods']);
+        $priceStrArr = explode("|", $meta['price']);
+        if (count($goodsStrArr) != count($priceStrArr)) {
+            return null;
+        }
+        $idx = -1;
+        {
+            $i = 0;
+            array_filter($goodsStrArr, function($str) use(&$i, &$idx, $goodsId) {
+                if ($idx != -1) {
+                    $strArr = explode(":", $str);
+                    if (count($strArr) >= 2) {
+                        if ($strArr[0] == $goodsId) {
+                            $idx = $i;
+                            return true;
+                        }
+                    }
+                }
+                ++$i;
+                return false;
+            });
+        }
+        if ($idx <= 0) {
+            return null;
+        }
+        $info = array(
+            'goodsId' => 0,
+            'goodsNum' => 0,
+            'costItemId' => 0,
+            'costItemNum' => 0
+        );
+        {
+            $strArr = explode(":", $goodsStrArr[$idx]);
+            $info['goodsId'] = $strArr[0];
+            $info['goodsNum'] = $strArr[1];
+        }
+        {
+            $strArr = explode(":", $priceStrArr[$idx]);
+            if (count($strArr) < 2) {
+                return null;
+            }
+            $info['costItemId'] = $strArr[0];
+            $info['costItemNum'] = $strArr[1];
+        }
+        return $info;
+    }
+
+    protected static function getMetaList()
+    {
+        if (!self::$metaList) {
+            self::$meta = getMetaTable('newshop@newshop.php');
+        }
+        return self::$metaList;
+    }
+
+    protected static $metaList;
+
+}