[PHP] PayPal IPN Security [HELP]

[Xavi.]

When creating a PayPal IPN, what security measures would you have to take? So far I have:

- Checking if the payment gross is the same as the amount they required to pay
- Check the currency.
- Check the receiver email.
- Check if the transaction ID already exists.
- Check if the payment status is completed.

And how would you deal with chargebacks/disputes? Do PayPal send something similar to "CHARGEBACK" to the IPN Listener?

 

[Dave]

Re: [HELP] PayPal IPN Security

Check the currency.
Check the receiver email.
Check if the transaction ID already exists.
Check if the payment status is completed.

About the chargeback/dispute, search for "payment_status" on the following page: https://cms.paypal.com/us/cgi-bin/?...e_howto_html_IPNandPDTVariables#id091EB04C0HS
It will say the possible returned payment_status values. (Case sensitive)

 

[Xavi.]

Re: [HELP] PayPal IPN Security

Payment status complete is the "VERIFIED" right?

And with the transaction ID is that to prevent the user re-using their first payment to buy more, but not necessarily paying?

Thanks for this. Added to the list.

Is there anymore security measures I must take?

 

[Dave]

Re: [HELP] PayPal IPN Security

Payment status complete is the "VERIFIED" right?

And with the transaction ID is that to prevent the user re-using their first payment to buy more, but not necessarily paying?

Thanks for this. Added to the list.

Is there anymore security measures I must take?

I check for "Completed" in my PayPal API.
Also check the custom field value and the item_number field value (if you use the item_number field).

 

[Xavi.]

Re: [HELP] PayPal IPN Security

Alright, I see what you mean about Completed, But doesn't that mean you won't be able to accept bank transfers? As the status would be pending.

And what is the custom field value?
And what is item_number?

 

[Dave]

Those are optional variables. You can store the account name of your customer in it for example. Or the amount of items they want to buy.
If people send their payment as eCheck, PayPal will automatically postback to your API once the eCheck period is over.

Not sure about bank transfers though.

 

[advocaite]

you can not stop a charge back and paypal dose not give buyer protection for virtual items