1

I'm setting up a website that uses paypal to process payments.

The easiest way to implement the checkout form would be to create an HTML form that submits directly to paypal, sending the order details and redirecting the user to paypal in order to finalize the transaction.

However, there is a security vulnerability with this process. The client could edit the information submitted to paypal, such as changing the price of the checkout to $0.00.

What is an accepted way to handle this type of situation? Is it to submit the form back to my server, then do some processing in PHP, then submit verified data to paypal and redirect the user to paypal? Is this possible?

Thanks!

Chris Dutrow
  • 48,402
  • 65
  • 188
  • 258

1 Answers1

1

There are two main ways to handle this issue.

  1. The first is somewhat like what you outline: You send the filled in form to PayPal, and provide a callback-url. When PayPal has processed the payment, they will call your provided url, and you can check whether or not the information given in that call is the same as what you provided. For this to work, you need to store the information in the meantime, like in a database. You will then only give access to the product after the validation has happened.

  2. You can also encrypt the information you send to PayPal, making it practically impossible to alter information in your form.

See https://www.x.com/developers/paypal for details.

Devin Burke
  • 13,642
  • 12
  • 55
  • 82
Steni
  • 56
  • 3
  • From what I understand, this would prevent an attack by a third party, but what if the user just edited the form to change the price to $0.00? Or am I misunderstanding you? – Chris Dutrow Sep 12 '11 at 18:50
  • No, both methods are safe. With the first one, you have to wait until you get the verification in the callback from PayPal before you send anything to the customer. – Steni Sep 13 '11 at 19:34