I have this simple page where people can buy a rank for $24.99. However, they must enter their username and their favNum. These 2 user inputs get validated by the is_favnum_valid() and is_username_valid() functions. If any of the inputs are not valid, then the page is reloaded again with an error message showing. However, if the input is valid, then we redirect the customer to PayPal, where they pay via PayPal.
My question is, on line 47 (the if ($errorMsg == "") if statement block). I build the link to redirect the customer to. Is that safe? If its not safe, what should I do to redirect the customer so they can pay for the item. It is important for me somehow save the username and favNum into the database if the customer has paid for the item successfully.
My Concern is that it is exposing my listener URL http://example.com/ipn.php, its exposing all the settings I am using to make the order, people can change the custom field and the fact people can just make up their own links/orders up and try and purchase items by just visiting this link:
https://www.paypal.com/cgi-bin/webscr?cmd=_xclick&item_name=Premium rank&item_number=10&amount=24.99¤cy_code=USD&business=test@gmail.com&no_shipping=1&custom=coolusername:5&no_note=0&return=http://example.com/success.php&cancel_return=http://example.com/cancel.phpl¬ify_url=http://example.com/ipn.php
I also use the custom field in this PayPal request to store the favNum and username. So when my PayPal listener hears that the payment was successful, it will add the transaction details into my database, as well as the username and favNum PayPal sends you in the custom field when you are listening.
shop.php
<?php
$errorMsg = "";
// Checks if the username is valid.
// A valid username only contains letters
// @return boolean - true of username is valid otherwise false
function is_username_valid($username) {
if (ctype_alpha($username)) {
return true;
}
return false;
}
// Checks if the favNum is valid.
// A valid favNum must be an integer
// @return boolean - true of favNum is valid otherwise false
function is_favnum_valid($favNum) {
if (ctype_digit($favNum)) {
return true;
}
return false;
}
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
// Check if username and favNum is set
if (!isset($_POST["username"]) || !isset($_POST["favNum"])) {
$errorMsg = "Please enter a username and your Favorite number<br>";
} else {
// Check if username is not valid
if (!is_username_valid($_POST["username"])) {
$errorMsg .= "Username must be letters only<br>";
}
// Check if favNum is not valid
if (!is_favnum_valid($_POST["favNum"])) {
$errorMsg .= "Favorite number must be an integer<br>";
}
}
// If there has been no errors with the user's input
// redirect to paypal page so user can pay
if ($errorMsg == "") {
$query = array();
$query['cmd'] = '_xclick';
$query['item_name'] = 'Premium Rank';
$query['item_number'] = 2;
$query['amount'] = '24.99';
$query['currency_code'] = 'USD';
$query['business'] = 'test@gmail.com';
$query['no_shipping'] = '1';
$query['custom'] = $_POST["username"] . ":" . $_POST["favNum"];
$query['no_note'] = 0;
$query['return'] = 'http://example.com/return.php';
$query['cancel_return'] = 'http://example.com/cancel.php';
$query['notify_url'] = 'http://example.com/ipn.php';
header('Location: https://www.paypal.com/cgi-bin/webscr?' . http_build_query($query));
exit(0);
}
}
?>
<!DOCTYPE html>
<html>
<body>
<p>Buy premium rank for $24.95</p>
<?php
if ($errorMsg != "") {
echo ('<p style="color: red;">Errors:<br>' . $errorMsg . '</p>');
}
?>
<form method="POST" action="shop.php">
Enter Your Username:<br>
<input type="text" name="username" placeholder="Letters only">
<br>
Enter Your Favorite Number:<br>
<input type="text" name="favNum" placeholder="Integer only">
<br><br>
<input type="submit" value="Buy">
</form>
</body>
</html>
