Hiding Paypal Button

zoobie

I need to hide the Paypal button source code. I know it's rediculous...Anyone can just view the source code, change the price, go directly to the finish page, etc.

Paypal has seemed to have disabled the direct link thusly disabling $_SERVER['HTTP_REFERER']. I sure can't get it to work/echo/isset(), or print.

Suggestions?

Any help appreciated.

Thanks :rolleyes:

jc94062

Anyone can GO to view source, but unless your server was setup by a zombie they can't change it 😃 (No offense meant!)

In fact, I'm not even SURE if its possible to change it even then, I think if your server has really bad setup (or someones gone at set the file to have 777 file permission it may be possible to change the code but otherwise...

Whats the URL of your site?

zoobie

Umm...Yes, they can easily change the price, bypass the processing, even order thousands merely by coping the source code and pasting it in their editor...believe it or not.

Too easy for punks...

I'm open to suggestions...

Anyone? :rolleyes:

jc94062

They can paste it into their editor, but how are they going to execute it on YOUR site?

zoobie

Anyone have any ideas? :p

dannys

What's the URL of your site?

I still don't think PayPal could have made that much of an oversight when they were planning this and i've never heard of anyone else having this problem (and there are a lot of site using PayPal as the payment mechanism).

zoobie

Well, I guess nobody knows.

Maybe there isn't a way...:rolleyes:

jmcneese

use javascript to hide the link. try hotscripts.com or javascripts.com for a script.

zoobie

That's what I'm doing now...and hiding the 'key' within 2 or 3 hundred includes. This way, I can move the key every few weeks or so.

But, I was hoping for a PHP solution...or SSI since Paypal has made the 'thank you' page's link indirect thusly disabling the $_SERVER['HTTP_REFERER'] function.

piersk

What is PayPal and why would you want to hide it?

zoobie

That would require actually reading this thread. :rolleyes:

piersk

Sorry, I dont have a clue what Paypal is tho...

dannys

Actually, having looked at the PayPal Shopping Cart stuff, I'll admit it does actually look freakishly easy scam - PayPal don't seem very bothered about reply to my enquiries either.

Personally, I'd look at something else - such as WorldPay - which doesn't require purchasers to have an account either.

zoobie

Well, I just got off the phone with Paypal and they confirmed anyone could just type in the 'thank you' page addy and bypass the credit card processing altogether...as I suspected. They also recommended using the IPN (Instant Payment Notification) to circumvent this...but it doesn't fit my bill.

However, they also said they didn't disable the 'continue' link on the final page...but couldn't tell me why the $_SERVER['HTTP_REFERER'} wasn't at least echoing even though it's enabled with my host using v4.22

Hmm...😕

dannys

I can't believe nobody's noticed it prior to this thread, it's been in operation for ages, hasn't it?

zevacronet

I use paypal too and your right, they probably COULD do that but your suppose to verify the funds to make sure you got your money before you send anything so nothing like that happends. At least that's what I thought.

Weedpacket

Originally posted by dannys
I can't believe nobody's noticed it prior to this thread, it's been in operation for ages, hasn't it?

What makes you so sure nobody has? :eek:

dannys

I there'd be a bit of a stink about by now - The Register hasn't mentioned anything about it - did a quick google which didn't turn up anything useful.