Question

I have a sandbox account for paypal for trial purpose
An aspx page:sampleprocess.aspx

In Merchant A/c the page is Redirected to http://www.Hostsite.com/member/samplepaypal.aspx
after completion of payment.

In samplepaypal.aspx.cs Page Load:

protected void Page_Load(object sender, EventArgs e)
    {
        //string tx = Request.QueryString["tx"];
        //Post back to either sandbox or live
        string strSandbox = "https://www.sandbox.paypal.com/cgi-bin/webscr";
        string strLive = "https://www.paypal.com/cgi-bin/webscr";
        HttpWebRequest req = (HttpWebRequest)WebRequest.Create(strSandbox);

        //Set values for the request back
        req.Method = "POST";
        req.ContentType = "application/x-www-form-urlencoded";
        byte[] param = Request.BinaryRead(HttpContext.Current.Request.ContentLength);
        string strRequest = Encoding.ASCII.GetString(param);
        strRequest += "&cmd=_notify-validate";

        req.ContentLength = strRequest.Length;

        //for proxy
        //WebProxy proxy = new WebProxy(new Uri("http://url:port#"));
        //req.Proxy = proxy;

        //Send the request to PayPal and get the response
        StreamWriter streamOut = new StreamWriter(req.GetRequestStream(), System.Text.Encoding.ASCII);
        streamOut.Write(strRequest);
        streamOut.Close();
        StreamReader streamIn = new StreamReader(req.GetResponse().GetResponseStream());
        string strResponse = streamIn.ReadToEnd();
        streamIn.Close();

        if (strResponse == "VERIFIED")
        {
            lblmsg.Text = "Verified";
            //check the payment_status is Completed
            //check that txn_id has not been previously processed
            //check that receiver_email is your Primary PayPal email
            //check that payment_amount/payment_currency are correct
            //process payment
        }
        else if (strResponse == "INVALID")
        {
            lblmsg.Text = "Not Verified";
            //log for manual investigation
        }
        else
        {
            lblmsg.Text = "IPN Logged";
            //log response/ipn data for manual investigation
        }
    }

here i get the result “INVALID”! whats wrong plz rectify the error.
after post back to http://www.Hostsite.com/member/samplepaypal.aspx page from paypal
it shows :

http://111.111.111.111/member/samplepaypal.aspx?tx=8L903541KW5338647&st=Pending&amt=100.00&cc=USD&**cm=&item_number=&**sig=QRmNHFf5%2fAH3io9Tn2kj%2fuicu3gpAuMew701OvazfkCdN3jSR5tmFoX3OUPbQlZGoj2PY7vI%2fP1dH84g1CEzSG9NhjnLbjuAFFHyENVsBjKb1dVvK1nZe3FJfElZt11qPfggMOPu8%2bUhDwHekJvNAcXkjLQV01vAjN1y%2fZs1rJw%3d

what are these cm & item_number are blank! what to do to get “VALID” response.

help appreciated..!

Answer 1

Using Postbacks for Validation:

If you cannot use shared secrets for notification validation, you can use postbacks to PayPal,
instead. Your postback must include exactly the same variables and values that you receive in
the IPN posted to your server by PayPal, and they must be in the same order.

Constructing Your Postback

Use these guidelines for constructing your postback to PayPal:.

1. Your postback must be sent to https://www.paypal.com/cgi-bin/webscr.
   NOTE:You can implement IPN without SSL, including your postbacks for validation, but
   PayPal recommends against doing so.

2. Your postback must include the variable cmd with the value _notify-validate:
   cmd=_notify-validate

3. Your postback must include exactly the same variables and values that you receive in the
   IPN from PayPal, and they must be in the same order.

Processing the PayPal Response to Your Postback
PayPal responds to your postbacks with a single word in the body of the response: VERIFIED
or INVALID.
When you receive a VERIFIED postback response, perform the following checks on data in
the IPN:

1. Check that the payment_status is Completed.

2. If the payment_status is Completed, check the txn_id against the previous PayPal
   transaction that you processed to ensure it is not a duplicate.

3. Check that the receiver_email is an email address registered in your PayPal account.

4. Check that the price, carried in mc_gross, and the currency, carried in mc_currency, are
   correct for the item, carried in item_name or item_number. After you complete the above checks, notification validation is complete. You can update your database with the information provided, and you can initiate other appropriate automated
   back-end processing.