Paypal - IPN doesn't work, recurring payment - php

Question

So I'm doing a site selling membership plan (monthly billing)
User will need to input a registration form (name, ICNumber, etc which may be different to the paypal used by this user)
Upon clicking 'next/submit', system will save the posted data inside a session, and will display it again in another page so it's like a confirmation page.
Inside the confirmation page,
<form method='post' action="https://www.sandbox.paypal.com/cgi-bin/webscr" method="post">
<input type="hidden" name="cmd" value="_ext-enter">
<input type="hidden" name="redirect_cmd" value="_xclick-subscriptions">
<input type="hidden" name="item_number" value="<?php echo $plan[0]['id'];?>">
<input type="hidden" name="no_note" value="1">
<input type="hidden" name="item_name" value="<?php echo $plan[0]['plan_name'];?>">
<input type="hidden" name="currency_code" value="USD">
<input type="hidden" name="a3" value="<?php echo $plan[0]['plan_price'];?>">
<!--change p3 value 1M=1month, 1D(t3) = 1 day-->
<input type="hidden" name="p3" value="1">
<!--change value=M as month-->
<input type="hidden" name="t3" value="M">
<input type="hidden" name="src" value="1">
<input type="hidden" name="sra" value="1">
<!--here change to your seller sandbox account-->
<input type="hidden" name="business" value="seller-facilitator#test.com">
<input type="hidden" name="return" value="<?php echo base_url(); ?>signup/success">
<input type="hidden" name="notify_url" value="<?php echo base_url(); ?>payment/subscribe" />
<input type="hidden" name="rm" value="2">
<!--and echoing out bunch of data (name, ICNumber, phone number etc) posted from previous page,, which has been stored into a session array-->
So, user can do the payment, the money has come into the seller account, and buyer's balance has been deducted.
So my questions:
1. where should I put my ipn link? Is it inside 'notify_url' AND 'return' url?
2. If my understanding is correct, we 'should' put a link under our profile>selling preference>IPN so I have updated my profile, and put mydomain.com/controller/ipncode (I'm using codeigniter)
3. I turned on auto-return, but even on live, the site won't autoreturn. This is minor issue; my return page contains a simple 'thank you' page. Now, since the txn_type when the payment is made is "subscr_signup" therefore, NO txn_id, NO payment_status UNTIL the txn_type changes to 'subcr_payment', and this may occur long AFTER or BEFORE the user returns to our main site and surfing. So I need to save the registration data (as the user submitted) for his login. After payment, user can directly login, no matter what the payment outcome will be as the end, the seller and buyer will have to meet up for transaction (this is a rental dvd site, so buyer must go down to the retail shop and collect the dvds he books through the site).
But to make the life of the seller easier, it'd better if I can update the membership_status to 'active' IF the payment_status is verified and completed.
So far, my IPN code is this
$req = 'cmd=_notify-validate';
$fullipnA = array();
$url ='https://www.sandbox.paypal.com/cgi-bin/webscr';
foreach ($_POST as $key => $value)
{
$fullipnA[$key] = $value;
$encodedvalue = urlencode(stripslashes($value));
$req .= "&$key=$encodedvalue";
}
//$fullipn = Array2Str(" : ", "\n", $fullipnA);
$curl_result=$curl_err='';
$fp = curl_init();
curl_setopt($fp, CURLOPT_URL,$url);
curl_setopt($fp, CURLOPT_RETURNTRANSFER,1);
curl_setopt($fp, CURLOPT_POST, 1);
curl_setopt($fp, CURLOPT_POSTFIELDS, $req);
curl_setopt($fp, CURLOPT_HTTPHEADER, array("Content-Type: application/x-www-form-urlencoded", "Content-Length: " . strlen($req)));
curl_setopt($fp, CURLOPT_HEADER , 0);
curl_setopt($fp, CURLOPT_VERBOSE, 1);
curl_setopt($fp, CURLOPT_SSL_VERIFYPEER, FALSE);
curl_setopt($fp, CURLOPT_TIMEOUT, 30);
$response = curl_exec($fp);
$curl_err = curl_error($fp);
curl_close($fp);
$custom=$this->session->userdata('registration'); //this contains the submitted registration data in a session array
$this->load->model('signup_model');
//'VERIFIED' only qualifies if the txn_type=subscr_payment(seller has received the money)
//if payment status is verified, then update DB/activate the account
if (strcmp ($response, "VERIFIED") == 0) {
if($_POST['payment_status']=='Completed') {
//this is to get customer_id based on the ICNumber posted upon registration (which is stored inside a session)
$cid=$this->signup_model->getCustomerID($custom['nric']);
//this is to update membership_status to active if payment is verified and completed
$this->signup_model->updatePlanStatus($cid[0]['id'],1);
$this->signup_model->test('payment status complete and verified', $cid);
} else {
$cid=$this->signup_model->getCustomerID($custom['nric']);
$this->signup_model->updatePlanStatus($cid[0]['id'],0);
$this->signup_model->test('payment status NOT complete but verified', $cid);
}
}
//'Invalid' if paypal can't process the payment
//update account status as pending
if (strcmp ($response, "INVALID") == 0) {
$cid=$this->signup_model->getCustomerID($custom['nric']);
$this->signup_model->updatePlanStatus($cid[0]['id'],0);
$this->signup_model->test('payment status NOT verified', $cid);
}
I'm also confused WHERE to put the sql syntax to insert the registration data into the DB.
Currently because I don't know how to use IPN properly, the return url (which is a thank you page), I put mysql db insert there. So, when user click 'return to main site', system will insert the registration details first, with membership_status = 0 (pending), this is to allow user to login directly to use the site.
Please guide me how should I put this all together.
Thanks!