Verisign PayFlow Link Post Capture

[aaron_karp]

I'm using Verisign's Payflow Link system for the first time, and I'm trying to set up a page that captures the information sent through their Silent Post.

Basically, on my checkout page, I enter all of the order information into a database (products, quantities, unique order number, etc). Then I pass the unique order number to verisign.

So I want to caputure that unique order number when Verisign completes the order and sends it back to me. I can then use the order number to retreive the order information from my temporary database (products and quantities) and process the order.

Verisign provides a meager example in ASP, about which I only understand the bare essentials.

Can anyone please give me an example of how to grab the variables sent to my server from Verisign's server?

Thanks!

[stolzyboy]

here is a help manual for payflow link, this is what i used when i needed the same question answered

http://www.cloverfish.net/images/PayFlow.pdf

[aaron_karp]

Thanks. I've seen the manual before, and it does help me with the variables. However, I've never written PHP code that receives a post from another page. Is it just like a form submission? For example, Verisign sends the values COUNTRY CITY etc.

If I wanted a script that emails the results to myself would I just do this?:

<?PHP

  $city = $_POST['CITY'];
  $country = $_POST['COUNTRY'];

  mail ("[e-mail]", "New Order", "

Order Information:

City: $city
Country: $country

", "From: Order Form <[e-mail]>");
?>

[stolzyboy]

yes, it's just like a form submission, they are actually POSTing the page to your page when they are done processing the information, so you can get anything with $_POST['variablename']

[aaron_karp]

Theoretically, though, anyone could construct a form that POSTed variables to my script, therefore simulating a real order. How can I verify that the POST came from Verisign?

If I can't, are there other ways to protect against such activity? I.e. some random number usage?

[aaron_karp]

Theoretically, though, anyone could construct a form that POSTed variables to my script, therefore simulating a real order. How can I verify that the POST came from Verisign?

If I can't, are there other ways to protect against such activity? I.e. some random number usage?

[stolzyboy]

well you keep the order id or some unique identifier in a session variable, then post that to verisign, and request it get sent back on their silent post back to you, then you can check if

<?
if ($_SESSION['sessionedvarfromid'] == $_POST['postedvaridfromverisign'])
{
//do your order process
}
else
{
//invalid id you can't be here
}
?>

[aaron_karp]

That makes sense, but how can I send the variable to Verisign in the first place without the user being able to check the HTML source code for a hidden field? The hidden field would have to contain the random value being POSTED to verisign, and would be visible to anyone checking the source code.