Re: Paypal & instant payment notification

> Actually it doesn't seem like too much of a hack, except that it seems > to be not a realtime operation (otherwise why would they need to contact > your script?). They contact your script so you can do whatever *YOU* want for each transaction -- Log it, email the customer, ring a bell, whatever. They don't need to provide custom templates and database services to you on their site just so you can manage your customers. I dunno what the lag is between a transaction and the POST they send out, but there's no reason to expect it's not as real-time as it gets. All they have to do is open up a connection to port 80 on your server and send a few POST headers. Sample code to do this abounds in the various PHP Code Archive sites, so if you wanna write your own PayPal, this would be an easy feature. You are provided with a half of a key-pair to check back with their server that it's *REALLY* coming from them, and not some spoofer thief trying to fool your system into thinking they paid with PayPal when they didn't. So you send back your half of the key-pair, and they say "Yep, that's valid." and you *KNOW* it's a valid notification. Of course, if somebody can hack into PayPal server and insert their own key-pair, you're screwed, but one would hope they're pretty up on security over there at PayPal, eh? Whether you have a Shopping Cart or not is irrelevant -- If you want to provide people with the option of using PayPal, and you want to record their purchase in real-time instead of, err, doing it by hand when PayPal sends you some report or something, you want this instant payment notification stuff. Don't have sample code, but it's basically just an fopen() to the URL they provide with the key they provide, and then examine the output for either: "Yes, that's valid." "No, that's not valid." "Our server is dead. Sorry." types of results. If it's a "Yes", you mark the transaction as "Paid" or whatever your shopping cart does, and then ship the goods. If it's not valid, you log it, and tell the Customer their hack didn't work. If the server is dead, you tell the Customer there will be a short delay in verifiction, but they can check back in a half hour to be sure it all went through, and then retry in a few minutes or whatever. -- WARNING richard@zend.com address is an endangered species -- Use ceo@l-i-e.com Wanna help me out? Like Music? Buy a CD: http://l-i-e.com/artists.htm Volunteer a little time: http://chatmusic.com/volunteer.htm