diff --git a/sql/marketdb.sql b/sql/marketdb.sql
index 2f0d9877..23f92024 100644
--- a/sql/marketdb.sql
+++ b/sql/marketdb.sql
@@ -31,6 +31,7 @@ CREATE TABLE `t_box_order` (
   `order_id` varchar(60) NOT NULL DEFAULT '' COMMENT '订单id',
   `game_id` int(11) NOT NULL DEFAULT '0' COMMENT 'game id',
   `batch_id` int(11) NOT NULL DEFAULT '0' COMMENT '批次号',
+  `type` varchar(60) NOT NULL DEFAULT '' COMMENT 'type',
   `item_id` int(11) NOT NULL DEFAULT '0' COMMENT '道具id',
   `state` int(11) NOT NULL DEFAULT '0' COMMENT 'state 0:待支付 1：支付成功',
   `bc_synced` int(11) NOT NULL DEFAULT '0' COMMENT '0:未上链 1:已上链',
diff --git a/third_party/phpcommon b/third_party/phpcommon
index e42a7b73..195376f8 160000
--- a/third_party/phpcommon
+++ b/third_party/phpcommon
@@ -1 +1 @@
-Subproject commit e42a7b732c806c4cc8060a101f9a13ae579039e3
+Subproject commit 195376f820d8882e8fe10c14f219cebcfd908dcf
diff --git a/webapp/controller/BaseController.class.php b/webapp/controller/BaseController.class.php
index 68bf9590..7ccfd0d3 100644
--- a/webapp/controller/BaseController.class.php
+++ b/webapp/controller/BaseController.class.php
@@ -5,6 +5,7 @@ use phpcommon\SqlHelper;
 class BaseController {
 
     private $nowtime = 0;
+    private $marketDbConn = null;
 
     function __construct()
     {
@@ -89,15 +90,18 @@ class BaseController {
 
     public function _getMarketMysql()
     {
+        if ($this->marketDbConn) {
+            return $this->marketDbConn;
+        }
         $mysql_conf = getMarketMysqlConfig(crc32(''));
-        $conn = new phpcommon\Mysql(array(
+        $this->marketDbConn = new phpcommon\Mysql(array(
             'host' => $mysql_conf['host'],
             'port' => $mysql_conf['port'],
             'user' => $mysql_conf['user'],
             'passwd' => $mysql_conf['passwd'],
             'dbname' => 'marketdb2006'
         ));
-        return $conn;
+        return $this->marketDbConn;
     }
 
     public function _getRedis($data)
diff --git a/webapp/controller/MarketController.class.php b/webapp/controller/MarketController.class.php
index 92ca30d6..deb873e1 100644
--- a/webapp/controller/MarketController.class.php
+++ b/webapp/controller/MarketController.class.php
@@ -84,8 +84,9 @@ class MarketController extends BaseController {
         if ($batchMetas) {
             foreach ($batchMetas as $meta) {
                 $heroMeta = mt\Hero::get($meta['item_id']);
+                $boxId = phpcommon\genBoxId($currBatchMeta['batch_id'], $meta['id'], $meta['item_id']);
                 $saleBox = array(
-                    'box_id' => $meta['item_id'],
+                    'box_id' => $boxId,
                     'item_id' => $meta['item_id'],
                     'name' => emptyReplace($heroMeta['name'], 'Hill'),
                     'job' => emptyReplace($heroMeta['herotype'], '1'),
@@ -126,6 +127,14 @@ class MarketController extends BaseController {
         $gameId = 2006;
         $funcId = 1;
 
+        $batchId = 0;
+        $idx = 0;
+        $itemId = 0;
+        if (!phpcommon\extractBoxId($type, $batchId, $idx, $itemId)) {
+            myself()->_rspErr(2, 'type parameter error');
+            return;
+        }
+
         if (empty($type) ||
             empty($buyerAddress) ||
             empty($price) ||
@@ -141,6 +150,14 @@ class MarketController extends BaseController {
             myself()->_rspErr(500, 'server internal error');
             return;
         }
+        if ($batchId != $currBatchMeta['batch_id']) {
+            myself()->_rspErr(500, 'server internal error');
+            return;
+        }
+        if (!mt\MarketGoods::isOnSaleItem($batchId, $idx, $itemId)) {
+            myself()->_rspErr(500, 'server internal error');
+            return;
+        }
 
         if (!phpcommon\isValidBcGameId($gameId)) {
             myself()->_rspErr(500, 'server internal error');
@@ -152,7 +169,7 @@ class MarketController extends BaseController {
             return;
         }
 
-        if (!phpcommon\isValidBcFunc($funcId)) {
+        if (!phpcommon\isValidBcFuncId($funcId)) {
             myself()->_rspErr(500, 'server internal error');
             return;
         }
@@ -163,7 +180,7 @@ class MarketController extends BaseController {
             }*/
 
         $orderId = BuyRecord::genOrderId($gameId, $funcId, myself()->_getNowTime(), $buyerAddress);
-        $tokenId = '';
+        $tokenId = $orderId;
         if ($this->isTestMode()) {
             $itemId = $type;
             SqlHelper::insert
@@ -173,6 +190,7 @@ class MarketController extends BaseController {
                      'batch_id' => $currBatchMeta['batch_id'],
                      'game_id' => $gameId,
                      'order_id' => $orderId,
+                     'type' => $type,
                      'item_id' => $itemId,
                      'state' => 1,
                      'buyer_address' => $buyerAddress,
@@ -208,6 +226,7 @@ class MarketController extends BaseController {
                  array(
                      'batch_id' => $currBatchMeta['batch_id'],
                      'order_id' => $orderId,
+                     'type' => $type,
                      'item_id' => $itemId,
                      'state' => 0,
                      'buyer_address' => $buyerAddress,
diff --git a/webapp/models/BuyRecord.php b/webapp/models/BuyRecord.php
index 9655718c..539d09d0 100644
--- a/webapp/models/BuyRecord.php
+++ b/webapp/models/BuyRecord.php
@@ -5,6 +5,7 @@ namespace models;
 require_once('phpcommon/bchelper.php');
 
 use mt;
+use phpcommon;
 use phpcommon\SqlHelper;
 
 class BuyRecord extends BaseModel {
diff --git a/webapp/mt/MarketGoods.php b/webapp/mt/MarketGoods.php
index d77da29c..ad202b91 100644
--- a/webapp/mt/MarketGoods.php
+++ b/webapp/mt/MarketGoods.php
@@ -27,6 +27,19 @@ class MarketGoods {
         return getXVal(self::$batchHash, $batchId, null);
     }
 
+    public static function isOnSaleItem($batchId, $idx, $itemId)
+    {
+        $metas = self::getBatchMetas($batchId);
+        if (!empty($metas)) {
+            foreach ($metas as $meta) {
+                if ($meta['id'] == $idx && $meta['item_id'] == $itemId) {
+                    return true;
+                }
+            }
+        }
+        return false;
+    }
+
     protected static function getMetaList()
     {
         if (!self::$metaList) {