Question

I implemented a dynamic button “buy now” (not saved in my PayPal account) with IPN and it works fine (yeah!).

Now I have a doubt about his security, because if someone change with firebug (for example) the amount value, the transaction is valid for paypal also if my IPN listener says there is a problem with amount.

My question is “Can I encrypt the form with a php / codeigniter library?”

Because I tried to check amount in the IPN listener, but the transaction on paypal continue correctly and It isn’t blocked from IPN.

Here, you find a part of my listener code:

private function isVerifiedIPN(){

    $req = 'cmd=_notify-validate';
    $posts = $this->input->post();
    foreach ($posts as $key => $value){
        $value = urlencode(stripslashes($value));
        $req .= "&$key=$value";
    }

    if($this->config->item('SIMULATION'))
        $url = $this->config->item('SIMULATION_URL');
    else
        $url = $this->config->item('PRODUCTION_URL');


    if(!$this->isVerifiedAmmount() ||
    !$this->isPrimaryPayPalEmail() ||
    !$this->isNotProcessed()){
        $req = '';
    }

    $header = "POST /cgi-bin/webscr HTTP/1.0\r\n";
    $header .= "Host: $url\r\n"; //443
    $header .= "Content-type: application/x-www-form-urlencoded\r\n";
    $header .= "Content-length: " . strlen($req) . "\r\n\r\n";

    $fp = fsockopen ("ssl://$url", 443, $errno, $errstr, 30);

    if (!$fp)
    {
        $this->sendReport("Errore connessione socket");
        return FALSE;
    }
    else
    {
        fputs ($fp, $header . $req);
        while (!feof($fp))
        {
            $res = fgets ($fp, 1024);
            if (strcmp($res, "VERIFIED") == 0)
            {
                // transizione valida
                fclose ($fp);
                return TRUE;
            }
            else if (strcmp ($res, "INVALID") == 0)
            {
                $this->sendReport('Transizione non valida');
                fclose ($fp);
                return FALSE;
            }
        }
    }

}

Answer 1

You can dynamically encrypt buttons so that people with Firebug (or similar software) can’t edit them. The PayPal API library has an example of this you can use, but I can’t find it again right now.

This PayPal help file explains how to get the various keys you need using your server command line.

I also found a tutorial and a certificate builder (I didn’t use, so can’t confirm how secure it is…)

Once you’ve generated your key and certificate, you need to put them on your server and set DEFAULT_EWP_PRIVATE_KEY_PATH and DEFAULT_EWP_CERT_PATH to the relevant files.

Upload the public certificate to PayPal (instructions in linked tutorials), and set DEFAULT_CERT_ID to the Cert ID it gives you for that file. It’ll also give you a file you can download – add that to your server and set PAYPAL_CERT_PATH to the path for that file.