Hi,
That's great! Thank you for sharing it.
However, beware that the payment notifications are not secured in that plugin. That means that I could go on your website, order something, and validate my order myself by just calling a specific URL of your website.
That's because the code
if ($sig != $vars["SHASIGN"])
{
echo "Signatur nicht akzeptiert.";
return false;
}
was commented out. That's probably because your friend had a problem with the calculation of the signature by I wouldn't be able to say why and what should be changed to correct it.