Receiving PayPal payments

PayPal logo center on the Internet

Payment systems. PayPal

• Introduction
• Types of payments
• Payment Process
  • Purchase "in one click"
  • Subscription
• IPN
• Examples of scripts
  • Payment for goods in the "basket"
  • Subscription to content
• Conclusion
• Links

Introduction

Organization of the actual payment is not difficult. In this article, I will Pay more attention to the automatic payment verification process with Using IPN (Instant Payment Notification). The article is based on Own experience, official PayPal documentation and materials An independent forum for PayPal developers.

Types of payments

• payment for goods in the cart provided by   PayPal. In this case, all basket support operations are   Yourself PayPal
• "one-click" shopping, without adding items to the shopping cart. This method is also used for payment   Goods in a basket formed without using PayPal
• recurring billing, subscription

Payment Process

Purchase "in one click"

<form method="post" action= "http://www.paypal.com/cgi-bin/webscr">
<input type="hidden" name="cmd" value="_xclick">
<input type="hidden" name="business" value="my@email.com">
<input type="hidden" name="item_name" value="Item name">
<input type="hidden" name="item_number" value="1234">
<input type="hidden" name="amount" value="19.95">
<input type="hidden" name="no_shipping" value="1">
<input type="submit" value="Buy Now">
</form>

Description of the main parameters

The table lists only the most commonly used parameters. For a complete list, see the documentation (links at the end of the article).

Subscription

PayPal provides an opportunity to organize a subscription: from the client's account a certain amount will be periodically transferred to your account, and the customer has the opportunity at any time to cancel the subscription. You can set the frequency and cost of the subscription, as well as the trial period, so that the client can be sure of the quality of the services you provide. The trial period can be either paid or free.

Form example:

<form action="http://www.paypal.com/cgi-bin/webscr" method="post">
<input type="hidden" name="cmd" value="_xclick-subscriptions">
<input type="hidden" name="business" value=  "my@email.com">
<input type="hidden" name="item_name" value="Baseball Hat Monthly">
<input type="hidden" name="item_number" value="123">
<input type="hidden" name="no_shipping" value="1">
<input type="hidden" name="a1" value=0>
<input type="hidden" name="p1" value="1">
<input type="hidden" name="t1" value="W">
<input type="hidden" name="a2" value="5.00">
<input type="hidden" name="p2" value=2>
<input type="hidden" name="t2" value="M">
<input type="hidden" name="a3" value="50.00">
<input type="hidden" name="p3" value="1">
<input type="hidden" name="t3" value="Y">
<input type="hidden" name="src" value="1">
<input type="hidden" name="sra" value="1">
<input type="hidden" name="srt" value="5">
<input type="submit" value="Subscribe">
</form>

DDescription of the main parameters

IPN

IPN (Instant Payment Notification) - This is a PayPal technology that allows Automate the process of processing payments. The essence of it is, That on the server of the seller the special script is created, and at occurrence Events related to the merchant account (such as payment, cancellation Payment, creating or canceling a subscription, etc.) the PayPal server sends This IPN script is a POST request with information about the transaction. Script in your The queue sends a request to the PayPal server to verify the transaction.

So, the buyer has completed the payment. With a little delay (Up to several seconds), the PayPal server sends the IPN to the script specified in Account settings or passed in the notify_url parameter. A well-written IPN script is the key to security Payments. If you've heard of cases of fraudulent sellers using PayPal, You can be sure: either they did not use IPN at all, or they have "Leaky" IPN script

First of all, the script should make sure that it really was Called by the PayPal server. To do this, it must generate a POST request to www.paypal.com/cgi-bin/webscr, Passing all received variables without changing with the addition of the cmd parameter with a value of _notify-validate. In response, there will be returned, or VERIFIED if the transaction was successfully verified, or INVALID in case of an error. If you answer INVALID The script should finish.

Then you should check the payee, since the potential an attacker can change the form to payment was credited to his account. The payee is determined by variables business and receiver_email. The need for two variables is explained by the fact that PayPal allows register several email addresses for one account. Email, specified when creating the account, is the primary email. The value of receiver_email is always primary email. If payment was sent to an additional email, it is sent through business.
 If business and/or receiver_email are not Contains the expected value, the script immediately exits.

Now you need to check the amount and currency of the payment. Such verification is necessary, since It is not difficult for a potential attacker to change the amount in the form, in the case of a subscription, you should check all the subscription parameters (availability, duration And the cost of trial periods, duration and cost of the main a subscription cycle, etc.).

IPN for the same transaction can be sent more than once. For example, if a payment has been delayed for any reason, the first IPN will be sent immediately after the payment. After the payment is made, completed or canceled, a second IPN will be sent. If your IPN script did not return HTTP status 200, PayPal will retry sending IPN after some time. The first repeat will be after 10 seconds, then if necessary after 20, then through 40, 80, etc. (up to 24 hours). If within 4 days the expected a response from your script will not be received, attempts will be terminated. It's possible use in order to not lose transaction data in case of an error in your IPN script. For example, if the script failed to connect to the database in which it stores transaction data, it can return HTTP status 500, and IPN will be repeated later. Repeated IPN will also be sent if the IPN script does not contact the PayPal server for transaction verification.

As can be seen from the description of the parameters return, rm and notify_url, IPN can be passed to two scripts specified in parameters return and notify_url. Between them 2 differences:

1. IPN for return will be sent only once, immediately after payment. notify_url can be called several times (see the previous paragraph).
2. The output of the return script will be displayed to the user. Please note, that if the output contains references, then they must be absolute. The output of the script notify_url to the user's browser is not displayed.

In the obtained POST variables contain information about the transaction. The most commonly used variables:

Additional variables used with the subscription

Examples of scripts

I will give two examples of scripts using PayPal IPN. I put Its goal is not to bring ready scripts that you can use By the method of copy/paste, but merely to illustrate the general principles.

In the first example, the buyer pays for goods in the "basket". After payment, the site administrator receives an email notification of admission Order, and the contents of the basket are entered in the database for monitoring Order. The second example shows how you can organize Subscription to the content.

Payment for goods in the "basket"

I will not describe the actual implementation of the "basket" here. I will only note that in our case, the sessions for storing the contents of the basket We are not able to restore the session data in our IPN script. For definiteness, I believe that $_ COOKIE ['cart_id'] contains The identifier of the basket by which we distinguish the basket of one user From another. Let the contents of the recycle bin are stored in the MySQL database, in the Table with the following structure:

CREATE TABLE cart (
  cart_id     int(11),
  item_id     int(11), 
  price decimal(8,2),
  quantity    mediumint(6)
);

CREATE TABLE orders (
  order_id    int(11)  auto_increment,
  txn_id      varchar(20),	
  order_date  datetime,		
  order_total decimal(8,2),	
  email varchar(50),		
  first_name  varchar(50),		
  last_name   varchar(50),	
  street      varchar(50),		
  city  varchar(50),		
  state varchar(50),		
  zip   varchar(15),	
  country     varchar(50)	
  PRIMARY KEY (id)
);

CREATE TABLE order_details (
  order_id    int(11),
  item_id     int(11),
  price decimal(8,2),
  quantity    mediumint(6)
);

Code script that displays the order form (checkout)

<?php
  // checkout.php
  
  $paypalemail  = "my@email.com";     // email of vendor
  $currency     = "USD";              // currency
  $cart_id=intval($_COOKIE['cart_id']);

  /*
    Here code that connects to the database data  
       content baskets
  */

  $r=mysql_query("SELECT sum(price*quantity) FROM cart WHERE cart_id=".$cart_id);
  list ($total)=mysqli_fetch_row($r);
  mysqli_free_result($r);
  $total=number_format($total,2);
  echo <<<FORM
<form method="post" action= "http://www.paypal.com/cgi-bin/webscr">
<input type="hidden" name="cmd" value="_xclick">
<input type="hidden" name="business" value="$paypalemail">
<input type="hidden" name="item_name" value="Shopping cart">
<input type="hidden" name="item_number" value="$cart_id">
<input type="hidden" name="amount" value="$total">
<input type="hidden" name="no_shipping" value=0>
<input type="hidden" name="return" value="http://myhost.com/payment_success.php">
<input type="hidden" name="rm" value=2>
<input type="hidden" name="cancel_return" value="http://myhost.com/payment_cancel.html">
<input type="hidden" name="no_shipping" value=0>
<input type="hidden" name="currency_code" value="$currency">
<input type="submit" value="Checkout"> 
</FORM>
FORM;
?>


Script code payment_success.php

<?php
  // payment_success.php
  $paypalemail = "my@email.com";     // email of sailer
  $adminemail  = "admin@email.com";  // email  of admin
  $currency    = "USD";              // currency

  /********
  Request transaction transaction
  ********/
  $postdata="";
  foreach ($_POST as $key=>$value) $postdata.=$key."=".urlencode($value)."&";
  $postdata .= "cmd=_notify-validate"; 
  $curl = curl_init("http://www.paypal.com/cgi-bin/webscr");
  curl_setopt ($curl, CURLOPT_HEADER, 0); 
  curl_setopt ($curl, CURLOPT_POST, 1);
  curl_setopt ($curl, CURLOPT_POSTFIELDS, $postdata);
  curl_setopt ($curl, CURLOPT_SSL_VERIFYPEER, 0); 
  curl_setopt ($curl, CURLOPT_RETURNTRANSFER, 1);
  curl_setopt ($curl, CURLOPT_SSL_VERIFYHOST, 1);
  $response = curl_exec ($curl);
  curl_close ($curl);
  if ($response != "VERIFIED") die("You should not do that ..."); 

  /********
  check your recipient payment  transaction type, and we exit if not our account
  in $ paypalemail -  primary email, therefore check receiver_email
  ********/
  if ($_POST['receiver_email'] != $paypalemail 
    || $_POST["txn_type"] != "web_accept")
      die("You should not be here ...");

  /*
    here code that connects to the database data  
  */ 

  /********  
    make sure in that this transaction is not  
    was processed earlier  
  ********/
  $r = mysql_query("SELECT order_id FROM orders WHERE txn_id='".$_POST["txn_id"]."'");
  list($duplicate) = mysqli_fetch_row($r);
  mysqli_free_result($r);
  if ($duplicate) die ("I feel like I met you before ..."); 
  /********
    Check payment amount  
  ********/ 
  $cart_id = intval($_POST['item_number']);
  $r = mysql_query( "SELECT sum(price*quantity), COUNT(cart_id) FROM cart 
                      WHERE cart_id=".$cart_id);
  list ($total,$nitems) = mysqli_fetch_row($r);
  mysqli_free_result($r);
  if (!$nitems) // You failed recover contents Recycle Bin
  {
    mail($adminemail, "IPN error", "Unable to restore cart contents\r\nCart ID: ".
      $cart_id."\r\nTransaction ID: ".$_POST["txn_id"]);
    die("I cannot recall what you paid for ... Please contact ".$adminemail); 
  }
  if ($total != $_POST["mc_gross"] || $_POST["mc_currency"] != $currency)
  {
    mail($adminemail, "IPN error", "Payment amount mismatch\r\nCart ID: "
      . $cart_id."\r\nTransaction ID: ".$_POST["txn_id"]);
    die("Out of money? Please contact ".$adminemail);
  }
   /********
     Checks completed form order
  ********/
  $order_date = date("Y-m-d H:i:s",strtotime ($_POST["payment_date"])); 
  mysql_query("INSERT INTO orders SET 
    txn_id      = '".$_POST["txn_id"]."',
    order_date  = '$order_date',
    order_total = $total,
    email       = '".$_POST["payer_email"]."',
    first_name  = '".mysql_escape_string($_POST["first_name"])."',
    last_name   = '".mysql_escape_string($_POST["last_name"])."',
    street      = '".mysql_escape_string($_POST["address_street"])."', 
    city        = '".mysql_escape_string($_POST["address_city"])."', 
    state       = '".mysql_escape_string($_POST["address_state"])."', 
    zip         = '".mysql_escape_string($_POST["address_zip"])."', 
    country     = '".mysql_escape_string($_POST["address_country"])."'" );
  $order_id = mysql_insert_id(); 
  $r = mysql_query("SELECT * FROM cart WHERE cart_id=".$cart_id);
  while ($row = mysql_fetch_assoc($r))
  {
    mysql_query("INSERT INTO order_details SET 
      order_id = $order_id, 
      item_id = ".$row['item_id'].",
      price = ".$row['price'].",
      quantity = ".$row['quantity']);
  }
  mysqli_free_result($r); 
  mysql_query("DELETE FROM cart WHERE cart_id=".$cart_id);
  mail($adminemail, "New order", "New order\r\nOrder ID: ". $order_id."\r\nTransaction ID: "
    .$_POST["txn_id"]);
  /* 
    inform, that order is accepted, we thank you for for purchase and 
    we offer buy anything else */ 
?>


Using the return parameter is convenient because Allows immediately after payment to give the result of verification to the user. However, such a check does not give 100% certainty that the money was Really credited to our account. For example, if the buyer pays Electronic check (e-check), money will be credited only after processing Check by the bank, and the enrollment is not guaranteed. notify-url It is not deprived of this shortcoming, since it allows one to trace the moment of the actual Receipts of money. In the following example, I'll show you how to handle Repeated IPN on the example of a subscription to the content.

Subscription to content

The PayPal subscription feature is very convenient, however it has a significant Lack. The matter is that if the subscription has a trial period, then The user can cancel the subscription until the trial period is over, and Subscribe again, thus obtaining another trial period, and so to infinity. Two outputs are possible. The first, the simplest, is not Use trial periods. The second is to provide only limited Access during the trial period.   Also keep in mind that there is no automatic return mechanism The user can cancel the subscription in the middle of the cycle.

The IPN script for the subscription must handle several kinds of IPN. it Often causes difficulties. I will describe in more detail the different types of IPN ( txn_type)

• subscr_signup subscription created. This IPN notifies only About subscription, but not about payment.
• subscr_payment payment was made either during the trial period (If it is not free), or for the main subscription cycle.
• subscr_failed the payment attempt failed. This IPN is sent only as a notification, usually no action is taken Do not need to.
• subscr_cancel subscription is canceled by the buyer, seller Or automatically (if payment can not be made). When receiving This IPN should not close the user's access to the resource, since Subscription can be canceled in the middle of the cycle for which you already paid.
• subscr_eot end of subscription. When you receive this IPN You must prevent the user from accessing the resource.
• subscr_modify Change subscription settings.

Let there is a certain resource to which we want to provide paid access. Payment is $10 per month, a week of free limited access is provided.

Subscriber data is stored in a table subscribers

CREATE TABLE subscribers (
  subscr_id    varchar(20)  #Unique subscription identifier
  subscr_date  datetime,    #date of subscription
  payer_id     varchar(20), #Buyer ID
  email  varchar(30), #Buyer email
  username     varchar(20), #user name
  passhash     varchar(32), #Password hash
  limited      tinyint(1)  #Restricted flag
  PRIMARY KEY (subscr_id)
);

Code of the script that displays the subscription form

<?php
  // subscribe.php
  $paypalemail  = "my@email.com";     // email of vendor
  $currency     = "USD";              // Currency
  $price        = "10.00";            // cost of the subscribe
  $trial        = 1;                  // Length of trial period
  $trialunit    = "W";                // 1 week

  echo <<<FORM
<form method="post" action= "http://www.paypal.com/cgi-bin/webscr">
<input type="hidden" name="cmd" value="_xclick-subscriptions">
<input type="hidden" name="business" value="$paypalemail">
<input type="hidden" name="item_name" value="Subscription">
<input type="hidden" name="no_shipping" value=0>
<input type="hidden" name="return" value="http://myhost.com/subscribed.html">
<input type="hidden" name="rm" value="1">
<input type="hidden" name="cancel_return" value="http://myhost.com/subsc_cancel.html">
<input type="hidden" name="no_shipping" value="1">
<input type="hidden" name="currency_code" value="$currency">
<input type="hidden" name="notify_url" value="http://myhost.com/ipn.php">
<input type="hidden" name="a1" value=0>
<input type="hidden" name="p1" value="$trial">
<input type="hidden" name="t1" value="$trialunit">
<input type="hidden" name="a3" value="$price">
<input type="hidden" name="p3" value="1">
<input type="hidden" name="t3" value="M">
<input type="hidden" name="usr_manage" value="1">
<input type="submit" value="Subscribe"> </FORM>
FORM;
?>


Code Script ipn.php

<?php
  // ipn.php
  $paypalemail = "my@email.com";     // email of vendor
  $adminemail  = "admin@email.com";  // email  of admin
  $currency    = "USD";              // currency
  $price       = 10.00;              // cost of subscribtion
  $trial       = "1 W";              // Length of trial period
  $cycle       = "1 M";              // Main cycle time

  /********
  We request a transaction confirmation
  ********/
  $postdata="";
  foreach ($_POST as $key=>$value) $postdata.=$key."=".urlencode($value)."&"; 
  $postdata.="cmd=_notify-validate";
  $curl = curl_init("http://www.paypal.com/cgi-bin/webscr");
  curl_setopt ($curl, CURLOPT_HEADER, 0);
  curl_setopt ($curl, CURLOPT_POST, 1);
  curl_setopt ($curl, CURLOPT_POSTFIELDS, $postdata);
  curl_setopt ($curl, CURLOPT_SSL_VERIFYPEER, 0);
  curl_setopt ($curl, CURLOPT_RETURNTRANSFER, 1);
  curl_setopt ($curl, CURLOPT_SSL_VERIFYHOST, 1);
  $response = curl_exec ($curl);
  curl_close ($curl); 
  if ($response != "VERIFIED") exit; 

  /********
  Check the payee and the transaction type, and exit, 
  If not our account or IPN does not require processing
  in $paypalemail - Our primary email, so we check receiver_email
  ********/
  if ($_POST['receiver_email'] != $paypalemail 
      || $_POST["txn_type"] != "subscr_signup"
      || $_POST["txn_type"] != "subscr_eot"
      || $_POST["txn_type"] != "subscr_payment")
        exit;


  /* 
    Here is the code that connects to the database 
  */ 

  /******** 
    subscription ? 
  ********/ 
  if ($_POST["txn_type"] == "subscr_signup")
  {
    $r = mysql_query("SELECT payer_id FROM subscribers WHERE payer_id='".$_POST["payer_id"]."'"); 
    list($duplicate) = mysqli_fetch_row($r);
    mysqli_free_result($r);
    if ($duplicate) exit; // repeated IPN - Ignore 
    if (isset($_POST["p2"]) 
        || $_POST["mc_currency"] != $currency 
        || $_POST["mc_amount3"] != $price 
        || $_POST["period1"] != $trial 
        || $_POST["period3"] != $cycle) exit; // Incorrect subscription settings 
    $subscr_date = date("Y-m-d H:i:s",strtotime ($_POST["subscr_date"]));
    mysql_query("INSERT INTO subscribers SET 
      subscr_id   = '".$_POST["subscr_id"]."',
      subscr_date = '$subscr_date',
      payer_id    = '".$_POST["payer_id"]."',
      email       = '".$_POST["payer_email"]."',
      username    = '".$_POST["username"]."', 
      passhash    = '".md5($_POST["password"])."', 
      limited = 1"); 
    /* 
      Here you can send an email with a username and password, 
      I do not do this, since the password is generated by PayPal 
      And is available to the subscriber on the PayPal website in the Account Control Panel 
    */ 
  } 
  /******** 
    Ðpaymentnbsp;? 
  ********/ 
  elseif ($_POST["txn_type"] == "subscr_payment") 
  {
    if ($_POST["mc_currency"] != $currency 
    || ($_POST["payment_status"] != "completed" && $_POST["pending_reason"] != "intl")
    || $_POST["mc_gross"] != $price) exit;
    // After the first payment we give full access 
    mysql_query("UPDATE subscribers SET  limited=0 WHERE subscr_id='".$_POST["subscr_id"]."'");
  } 
  /******** 
    Ending of subscriptions ? 
  ********/ 
  elseif ($_POST["txn_type"] == "subscr_eot") 
  { 
    mysql_query("DELETE FROM subscribers WHERE subscr_id='".$_POST["subscr_id"]."'");
  }
?> 


Conclusion

In conclusion, a few tips

• Never trust the data received by the IPN script before receiving VERIFIED response from PayPal. Store the data about the processed transactions, and After receiving the VERIFIED response, verify that this Transaction before.
• or all possible IPNs, determine what data you expect get. Any discrepancy is suspicious.
• Do not use payer_email - email can be changed. Use payer_id
• Getting txn_type=web_accept or txn_type=subscr_payment does not mean that you received Payment. Always check payment_status=completed. The only thing Exception: you have a non-US account and pending_reason=intl
• Limit the size of the POST request sent to the IPN script at the level Several kilobytes
  #httpd.conf
<files my_ipn_script.php>
php_admin_value post_max_size 10K
</files>
• Any system can fail, PayPal is no exception. If the IPN script received suspicious data, you should write to the log and Notify administrator. It is also useful to bring out a form, The user can send an error message.

About PayPal