Question

When I do a payment by credit card on paypal sandbox, I fill some special characters (ex: !@#@%^&) on address 1/address 2 text fields.
After payment, I get a IPN message, post back to PP and receive a INVALID message (HTTP error 200).

I set UTF-8 on profile/language on PP. But the problem is still there.

Remark: The payment process works fine if I pays by using PP account (means log in and click payment button).

Answer 1

You have to be careful to send to Paypal the exact data you received in the IPN call, with the notable exception of the cmd parameter, which has to be set to _notify-validate.

Here is some PHP code that takes the raw POST data, parses it to an array, changes the cmd parameter, converts it back to POST data, and sends it to Paypal. Getting the raw POST data allows to bypass PHP’s built-in parsing, which may apply messy things such as magic quotes, depending on your configuration.

$post = file_get_contents('php://input');
parse_str($post, $data);
$data['cmd'] = '_notify-validate';
$post = http_build_query($data);

$ch = curl_init('https://www.paypal.com/cgi-bin/webscr');
curl_setopt($ch, CURLOPT_HEADER, false);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, $post);

$result = curl_exec($ch);
curl_close($ch);

if ($result == 'VERIFIED') {
    // process the payment
}