Paypal PHP checkout - php

Question

I have this code below, it works perfectly, but I can use a proxy to change all the data (I also can change the receiver email) :/
How can I make it a POST checkout method? Now it's a GET method
<?php
public function checkout()
{
$query = [];
$query['cmd'] = '_cart';
$query['upload'] = 1;
$query['business'] = $this->getCredential();
foreach ($this->getItems() as $id => $item)
{
$id = $id + 1;
$query['item_name_' . $id] = $item['name'];
$query['amount_' . $id] = $item['amount'];
$query['quantity_' . $id] = $item['quantity'];
}
$query['custom'] = $this->getReference();
$query['<first_name>'] = $this->first_name;
$query['<last_name>'] = $this->last_name;
$query['<email>'] = $this->customer_email;
$query['notify_url'] = $this->getNotificationURL();
$query['return'] = $this->getReturnURL();
$query['cancel_return'] = $this->getCancelURL();
$query['rm'] = '2';
$query['cbt'] = 'Retornar para o site';
$query['lc'] = $this->getLocation();
$query['currency_code'] = $this->getCurrency();
$query_string = http_build_query($query);
return "https://". ($this->isSandbox() ? 'sandbox' : 'www' ) .".paypal.com/cgi-bin/webscr?".$query_string;
}
I also tried the code below, but when I click to finish the payment, it return me to the return URL with the token and payer_id, but don't pay :C
public function checkout()
{
$curl = curl_init();
curl_setopt($curl, CURLOPT_URL, 'https://api-m.paypal.com/v2/checkout/orders');
curl_setopt($curl, CURLOPT_HTTPHEADER, [
'Content-Type: application/json',
'Authorization: ' . $this->getAccessToken(),
'Prefer: return=representation'
]);
curl_setopt($curl, CURLOPT_POST, true);
curl_setopt($curl, CURLOPT_POSTFIELDS, json_encode([
'brand_name' => 'yStore Plugins',
'intent' => 'CAPTURE',
'purchase_units' => $this->getItems(),
'application_context' => [
'notify_url' => $this->getNotificationURL(),
'cancel_url' => $this->getCancelURL(),
'return_url' => $this->getReturnURL()
]
]));
curl_setopt($curl, CURLOPT_RETURNTRANSFER, true);
$response = json_decode(curl_exec($curl));
curl_close($curl);
return $response->links[1]->href;
}

Answer 1

Follow the Set up standard payments guide which in its 'Add and modify the code' section explains that you should make 2 routes on your server, one for 'Create Order' and one for 'Capture Order', documented here. For PHP you can use the Checkout-PHP-SDK (not any older or deprecated SDK). When accessed by a browser, both routes you create should only output JSON data (no additional HTML or text which cannot be parsed as JSON). Inside the 2nd route, when the capture API is successful you should store its resulting payment details in your database (particularly purchase_units[0].payments.captures[0].id, which is the PayPal transaction ID) and perform any necessary business logic (such as sending confirmation emails or reserving product) immediately before forwarding your return JSON to the frontend caller.
Pair those 2 routes with the frontend approval flow: https://developer.paypal.com/demo/checkout/#/pattern/server , which has important client-side error handling.