I have a PayPal listener that gets an HTTP POST request from PayPal (or the PayPal documentation seems to indicate that’s what they send), the listener sends back the information for verification by PayPal, and then if the information is verified, it does database transactions. This is the normal PayPal IPN process and the verification part works fine.
One of the values in the POST array that I get from PayPal is something that I am passing through to keep track of the transaction number. So I make a call that looks like: (not actual code; I am fully aware of SQL injection)
UPDATE transactions SET status='paid' WHERE id=$_POST['invoice']
The problem: If I fake the input by pointing a form with some inputs to my listener everything works fine, but if I get a real POST array from PayPal the database doesn’t run. I know the $_POST['invoice'] variable is set when I get the real PayPal data, I’ve tested that, and it has a valid value, like 84, so I don’t know why my transaction doesn’t execute. The lines above and below the transaction both execute.
Maybe I’ll have to post my actual code, but is it possible that PHP could be configured in some way that it wouldn’t run transactions when it gets a request from PayPal? Like I said, I think PayPal is sending an HTTP POST request so it should be indistinguishable from my fake form, but something is wrong.
The notify URL was set to point at the listener in the development database. So I got the emails indicating that the POST[‘invoice’] variable was set, but all the transactions were run on the development database