[RESOLVED] php from inside html form?

[u-sit]

WHat's wrong with this?
Trying to trap $_POST as it was developed inside an html form just prior to its submission, as follows:

 	<form target="paypal" action="https://www.sandbox.paypal.com/cgi-bin/webscr" 
						  method="post"/> <!-- TEST -->

<input type=hidden name=cmd 		value="_xclick"		/>
<input type=hidden name=business 	value="[e-mail]"	/>
<input type=hidden name=notify_url	value='http://www.u-sit.net/auxlib/web07/
												HTMLpages/paypl_ntllck_loop3.php'/>

<input type=hidden name=payer_id	value='TESTBUYERIDO2'>											
<input type=hidden name=return 		value='http://www.u-sit.net/auxlib/web07/InclReq/THNX.php'/>

<input type=hidden name=item_name 	value='Book'					/>
<input type=hidden name=mc_gross 	value=''						/> 
<input type=hidden name=mc_fee		value=''						/>

<input type=hidden name=amount 		value="<? echo $amount    ?>"	/>
<input type=hidden name=invoice 	value="<? echo $invoiceNo ?>"	/>
<input type=hidden name=rm 			value='2'						/>

<input type=hidden name=charset 	value='utf-8'					/>
<input type=hidden name=no_shipping value='1'						/>
<input type=hidden name=country		value="<? echo $country   ?>" 	/>
<input type=hidden name=tax 		value="0.00"					/>

<input type=hidden name=first_name	value="<? echo $first_name ?>" 	/>	
<input type=hidden name=last_name	value="<? echo $last_name  ?>"  />	
<input type=hidden name=email		value="<? echo $email      ?>" 	/>	

<input type=hidden name=s_h			value="$s_h" 	   				/>
<?php   ob_start();
		var_dump($_POST);
		$dump = ob_get_clean();
		fputs($fp1, "L.421 \$_POST from within form \n".$dump."\n"); 
?>
	<input type="image"  src="http://images.paypal.com/images/x-click-but01.gif"
		   name="submit" alt="Make payments with PayPal - it&#1267; fast, free and secure!"	/>
	</form>

I'm trying to capture the unadulterated string that PayPal receives from this from. Am not interested in any parsing/formatting.

Thanks for ideas,
u-sit

[traq]

I think you may be confused:

PHP happens on the server, before the page goes to the user. Once the user sees the page, PHP is over and done with.

You will never see the values your user submits, because they submit to paypal (not to your site). Trying to sneak-a-peek at that submission is a security issue.

If you need to confirm what values the user submits, there are two approaches:

1.) Create and store the button on PayPal. This way, the user has no form to fill out, and the values are predetermined. (Paypal recommends this option, and highly discourages the use of user forms like the one in your example.)

2.) Use PayPal's IPN and/or PDT APIs to confirm the details of transactions. This will inform you not of what payment details were sent, but what payment details were accepted (as well as if the transaction was successful; probably far more useful).

[u-sit]

Excellent, thoughtful and educational reply.
Thanks traq.
u-sit

[u-sit]

My BuyNow button and form came from paypal years ago. Never thought where it was stored. Tried googling 'storing buy now button on paypal site" and variations, but only get how to install a shopping cart (on my site? they don't say).
How do I store a button at paypal's site?
Thanks
u-sit

[Weedpacket]

Does Paypal provide any documentation about how to use their service?

[traq]

yes indeed they do.

[edit]

actually (re: buttons stored on paypal), maybe only "saved buttons" are stored on paypal. You might need to have an account (beyond the basic account) for this; I don't know. In any case, IPN/PDT is a better way to track user purchases.

[u-sit]

Thanks traq, am resorting to IPN/PDT now.
U-sit