ok...
i've read the paypal sample code, the paypal implementation guide (nearly all of the 168 pages anyway) and before i start coding and stuff, i'm STILL trying to get a broad understanding of what happens.
i have a shopping cart--shopping_cart.php. i collect the user's order and store it in a mySQL database.
the shopping cart submit button is one of the typical buttons you can create on the paypal site with their button generator...the final form on my site looks something like this:
<form action="https://www.paypal.com/cgi-bin/webscr" method="post">
<input type="hidden" name="cmd" value="_xclick">
<input type="hidden" name="business" value="sales@sales.com">
<input type="hidden" name="item_name" value="Sales Order #xxxxxxx">
<input type="hidden" name="item_number" value="xxxxxx">
<input type="hidden" name="amount" value="1.00">
<input type="hidden" name="return" value="http://sales.com/thanks.php">
<input type="hidden" name="cancel_return" value="http://sales.com/cancel.php">
<input type="hidden" name="currency_code" value="USD">
<input type="hidden" name="notify_url" value="http://sales.com/ipn.php">
<input type="image" src="https://www.paypal.com/en_US/i/btn/x-click-but03.gif" border="0" name="submit" alt="Make payments with PayPal - it's fast, free and secure!">
so the user is taken to the paypal site where they enter info.
now i think i understand what my cancel.php and thanks.php files are for, but the ipn.php file...what is up with that? how do thanks.php and ipn.php work together?
as best i can tell, when the user clicks PAY on the paypal site after entering all their info, then paypal posts to ipn.php some info which IPN.php is supposed to echo back to paypal and then paypal responds yet again and expects a final response....that's a lot of back and forth....
and then we go to thanks.php....or don't we? i really don't understand all the back and forth and when and under what circumstances the paypal site actually gets to the thanks.php file and does the thanks.php file get information POSTed to it or is it a simple redirect? seems to me that IPN.php is going to get the VALID or INVALID response and must somehow inform the THANKS.PHP page that the payment went through (or didn't). do i understand that correctly?
here's recommended code for ipn.php:
<?
// read the post from PayPal system and add 'cmd'
$req = 'cmd=_notify-validate';
foreach ($_POST as $key => $value) {
$value = urlencode(stripslashes($value));
$req .= "&$key=$value";
}
// post back to PayPal system to validate
$header .= "POST /cgi-bin/webscr HTTP/1.0\r\n";
$header .= "Content-Type: application/x-www-form-urlencoded\r\n";
$header .= "Content-Length: " . strlen($req) . "\r\n\r\n";
$fp = fsockopen ('www.paypal.com', 80, $errno, $errstr, 30);
// assign posted variables to local variables
$item_name = $_POST['item_name'];
$item_number = $_POST['item_number'];
$payment_status = $_POST['payment_status'];
$payment_amount = $_POST['mc_gross'];
$payment_currency = $_POST['mc_currency'];
$txn_id = $_POST['txn_id'];
$receiver_email = $_POST['receiver_email'];
$payer_email = $_POST['payer_email'];
if (!$fp) {
// HTTP ERROR
} else {
fputs ($fp, $header . $req);
while (!feof($fp)) {
$res = fgets ($fp, 1024);
if (strcmp ($res, "VERIFIED") == 0) {
// check the payment_status is Completed
// check that txn_id has not been previously processed
// check that receiver_email is your Primary PayPal email
// check that payment_amount/payment_currency are correct
// process payment
}
else if (strcmp ($res, "INVALID") == 0) {
// log for manual investigation
}
}
fclose ($fp);
}
?>
