StackOverflow2013

Note that there are some explanatory texts on larger screens.

plurals

POPaypal - Securing non-encrypted buttons
primarykey
Id
12371833
data
AcceptedAnswerId
12372323
AnswerCount
2
ClosedDate
CommentCount
0
CommunityOwnedDate
CreationDate
2012-09-11T14:18:25.390
FavoriteCount
0
LastActivityDate
2013-01-24T16:30:38.130
LastEditDate
LastEditorUserId
0
OwnerUserId
1415524
ParentId
0
PostTypeId
1
Score
0
ViewCount
262
LastEditorDisplayName
text
Body
I implemented a dynamic button "buy now" (not saved in my PayPal account) with IPN and it works fine (yeah!). Now I have a doubt about his security, because if someone change with firebug (for example) the amount value, the transaction is valid for paypal also if my IPN listener says there is a problem with amount. My question is "Can I encrypt the form with a php / codeigniter library?" Because I tried to check amount in the IPN listener, but the transaction on paypal continue correctly and It isn't blocked from IPN. Here, you find a part of my listener code: <pre><code>private function isVerifiedIPN(){ $req = 'cmd=_notify-validate'; $posts = $this->input->post(); foreach ($posts as $key => $value){ $value = urlencode(stripslashes($value)); $req .= "&$key=$value"; } if($this->config->item('SIMULATION')) $url = $this->config->item('SIMULATION_URL'); else $url = $this->config->item('PRODUCTION_URL'); if(!$this->isVerifiedAmmount() || !$this->isPrimaryPayPalEmail() || !$this->isNotProcessed()){ $req = ''; } $header = "POST /cgi-bin/webscr HTTP/1.0\r\n"; $header .= "Host: $url\r\n"; //443 $header .= "Content-type: application/x-www-form-urlencoded\r\n"; $header .= "Content-length: " . strlen($req) . "\r\n\r\n"; $fp = fsockopen ("ssl://$url", 443, $errno, $errstr, 30); if (!$fp) { $this->sendReport("Errore connessione socket"); return FALSE; } else { fputs ($fp, $header . $req); while (!feof($fp)) { $res = fgets ($fp, 1024); if (strcmp($res, "VERIFIED") == 0) { // transizione valida fclose ($fp); return TRUE; } else if (strcmp ($res, "INVALID") == 0) { $this->sendReport('Transizione non valida'); fclose ($fp); return FALSE; } } } } </code></pre>
Tags
<php><security><codeigniter><paypal><paypal-ipn>
Title
Paypal - Securing non-encrypted buttons
singulars
PostAcceptedAnswerId
1. PO
 singulars
 PostTypePostTypeId
 PTAnswer
PostParentId
1. This table or related slice is empty.
PostTypePostTypeId
1. PTQuestion
UserLastEditorUserId
1. This table or related slice is empty.
UserOwnerUserId
1. USLuca Garbin
plurals
PostLinksPostIdRelatedPostId
1. This table or related slice is empty.
PostLinksRelatedPostIdPostId
1. This table or related slice is empty.
PostsAcceptedAnswerId
1. This table or related slice is empty.
PostsParentIdCreationDate
1. PO
 singulars
 PostTypePostTypeId
 PTAnswer
2. PO
 singulars
 PostTypePostTypeId
 PTAnswer
VotesPostIdCreationDate
1. This table or related slice is empty.
CommentsPostId
1. This table or related slice is empty.

Querying!

Guidance

A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.