Paypal Webhook Response - php

Question

I have been trying to get Paypal's Webhooks to work but all ive been running into is problems. I am trying to make a simple payment process where the user just pays for a product and then I want to setup webhooks to alert me when the payment is made, refunded, or reversed. I have the payment process setup and that is not a problem. I am also hosting the webhook url at a SSL enabled URL.
When I have a purchase go through it sends the webhook response to the link and I have it upload a basic "test" variable to the database just to show that it is indeed being contacted. I also try to insert all of the post data into the database but that doesn't seem to work. Here is the code that the webhook contacts:
<?php
header('HTTP/1.1 200 OK');
$servername = "xxxx";
$username = "xxxx";
$password = "xxxx";
$db = "xxxx";
// Create connection
$conn = mysqli_connect($servername, $username, $password, $db);
if (!$conn) {
die("Connection failed: " . mysqli_connect_error());
}
$sql = "INSERT INTO vars (var) VALUES ('test')";
$conn->query($sql);
foreach ($_POST as $param_name => $param_val) {
echo "Param: $param_name; Value: $param_val<br />\n";
$sql = "INSERT INTO vars (var) VALUES ('" . $param_name . "')";
$conn->query($sql);
}
?>
So like i said I see it insert the "test" into the database but when I try to go through the post variables (which from what i understand there should be some) it doesnt upload any variables.
But when I use the IPN simulator on the paypal developer sandbox and I send it to the link it inserts all of the post variables.
So why is it contacting the URL but not including any of the information? Am I receiving it incorrectly and not processing it right?
Thank you.

Answer 1

First of all You should verify that this request really came from PayPal. For that you should send a little bit modified POST request back to PayPal.
$paypalurl = 'https://www.paypal.com/cgi-bin/webscr';
$req = 'cmd=_notify-validate';
foreach ($_POST as $key => $value) {
$value = urlencode(stripslashes($value));
$req .= "&$key=$value";
}
$ch = curl_init($paypalurl);
if ($ch == false) {
return false;
}
curl_setopt($ch, CURLOPT_HTTP_VERSION, CURL_HTTP_VERSION_1_1);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, $req);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 1);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 2);
curl_setopt($ch, CURLOPT_FORBID_REUSE, 1);
curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 30);
curl_setopt($ch, CURLOPT_HTTPHEADER, array('Connection: Close'));
$res = curl_exec($ch);
In the response you should check if it's verified or not:
if ($res) && strcmp($res, "VERIFIED") == {
// your code here
}
So it's better to always use IPN simulator to test this thing, otherwise (by sending plain POST request to your script) it wouldn't be validated normally.
Besides, I would advise you to take a closer look to $_POST['payment_status'] variable. It could be "Completed" (which is ok when payment is processed normally), or "Refund", "Reversed". And process payment according to that. And of course I strongly recommend to validate input — check _POST request (for availability, possible SQL injections, etc) and then proceed to the rest.

Answer 2

$bodyReceived = file_get_contents('php://input');
This is the information you'll receive from paypal as a json object