PayPal IPN success URL

thefisherman

Hi,

I've created this page with a PayPal button for checkout, so people are going to the PayPal site where they will make a transaction.

However, this button on the page, shows the success-url (and cancel-url), so people could bypass the transaction and copy/paste this url in their browser right?

Ok, so IPN is probably the thing to do, so i can check wheter PayPal has verified the transaction or not.

But how exactly does it work? I've seen the code on PayPal's site, is it a matter of just checking if the variables, which PayPal posts back are unchanged?

Any and all help appreciated.

thefisherman

AstroTeg

Read PayPal's IPN documentation very carefully. Then read it one more time to make sure you understand it. Its been a while since I last played with IPN, but its not too difficult once you get the flow down.

Basically:

user goes to your site and makes a purchase (or decides to pay you for something)
you present them with a check out page
on the total page they click submit to enter their payment info -> the submit takes the user to PayPal's payment page
user does their thing on PayPal's site
the two URLs you give PayPal allows PayPal to return the user back to your site. The success/fail allows your user to feel warm and fuzzy regarding the transaction. The fail page is really for when the user has hit cancel somewhere along the way.
if user cancels, you may need to do shopping cart cleanup. Or whatever you wish if the user cancels the process.
if user pays and its a success - as in they went through the entire check out process without errors, then they go to your success page (and you'll probably want to show them a confirmation number of some sort, send an email receipt, and do something with a database).
at this point, the user is done and happy - but IPN just begins
PayPal (via IPN) will notify your web server the status of payment. If it was instant PayPal to PayPal transaction, this will come very quickly. If it was some other means, it may take up to 2 weeks. But PayPal will send some form data to a URL you specify for you to validate by sending it back to PayPal and waiting for a sucess response from PayPal. If all checks out, validate the data to ensure it matches what the user did and if all checks out, you can safely assume you have the money and you can update your database and/or send email or send product.

You'll need to pay CLOSE attention to how PayPal wants you to validate the data with their web servers and how to validate the data to ensure you had a validate transaction and not someone trying to stiff you.

As for the URLs - if the user copies and goes directly to the success or fail URL, no problem. They never paid right? So IPN will never update your server saying you have money so you don't need to do anything. They HAVE to go through PayPal and complete the transaction. You don't need to worry if they skip a step because all you need to worry about is IPN coming back saying you have money.

Check out their documentation. Its pretty straight forward, but you may almost need to map it out on paper to ensure you understand all the communications that are going on.