PayPal; don't show order token public - php

Question

When somebody wants to buy something from me website he has to fill a form that is creating a URL like this and the redirect to PayPal:
https://www.paypal.com/cgi-bin/webscr?cmd=_xclick&business=buy#example.com&Product_Number_11&amount=4.20&return=http://www.example.com/product/Product_Number_11/%26payment=success%26order_token=a3f7e6fc6273c368ab374c5152ff2b63&cancel_return=http://www.example.com/error.php
This will transmit the billing details to PayPal. If payment succeed PayPal will redirect to http://www.example.com/product/Product_Number_11/&payment=success&order_token=a3f7e6fc6273c368ab374c5152ff2b63. The script on my website will get the order_token and finish the order by sending the product to the buyer.
Problem is: A user could copy the string http://www.example.com/product/Product_Number_11/&payment=success&order_token=a3f7e6fc6273c368ab374c5152ff2b63 and call it in browser manually without having payed.
What can I do to prevent this? Is PayPal website certificate the right?

Answer 1

In fact, you cannot prevent a user to call the payment URL manually.
What you have to do is to request a validation from PayPal itself.
Each time you receive a payment, the first thing to do is to open a connection to www.paypal.com, and send all the POST data you received, with the additional variable cmd: cmd=_notify-validate.
Here is an example payment validation:
// read the post from PayPal system and add 'cmd'
$req = 'cmd=_notify-validate';
foreach ($_POST as $key => $value) {
$value = urlencode(stripslashes($value));
$req .= "&$key=$value";
}
// post back to PayPal system to validate
$header = "POST /cgi-bin/webscr HTTP/1.0\r\n";
$header .= "Content-Type: application/x-www-form-urlencoded\r\n";
$header .= "Content-Length: ".strlen($req)."\r\n\r\n";
$fp = fsockopen('ssl://www.paypal.com', 443, $errno, $errstr, 30);
if (!$fp) {
// HTTP ERROR => RETRY LATER and check $errstr
}
else {
fputs($fp, $header.$req);
while (!feof($fp)) {
$res = fgets($fp, 1024);
if (strcmp($res, "VERIFIED") == 0) {
// PAYMENT VALIDATED & VERIFIED!
break;
}
else if (strcmp($res, "INVALID") == 0) {
// PAYMENT INVALID => INVESTIGATE MANUALLY!
break;
}
}
fclose($fp);
}
Conclusion: do not send automatically a product to a customer if you do not get the VERIFIED status from PayPal.