Jamie Rumbelow's PayPal Library

[eluser]megabyte[/eluser]
A note or question on this library.

I am not sure why it's not included in the library unless I'm missing something.

I did get this library working, however I think it is missing a step that I had to research for and include to make an express checkout.


when you call set_express_checkout() and you get a success return value, you then need to forward the user off to paypal (sandbox for testing below) then they login and continue, are returned back to your website and then you can call get_express_checkout()

This is the code I used below between these 2 steps.

Code:

header('location: https://www.sandbox.paypal.com/cgi-bin/webscr?cmd=_express-checkout&token;='.$TOKEN);

Maybe their is a way to do this without it, but thats what it says to do here:

https://www.paypal.com/en_US/ebook/PP_Sa...h_nvp.html


Any clarification about this would be awesome.

[eluser]skunkbad[/eluser]
I don't have an answer to your question, but I'd also like to point out something that I learned over the last few days, and think needs to be fixed.

When Jamie's ipn/validate method receives an ipn notification from paypal, the first thing that needs to be checked is that it is valid, but instead, this method checks for a payment status. If for some reason the payment status is not 'completed', curl never notifies paypal of receipt of the ipn notification, and therefore paypal will resend the notification at intervals for eternity... or for a while anyways. I'm using Jamie's example and the Paypal_lib from the wiki to create a solution that works with my Community Cart, and noticed this today. Also, it is possible to get IPN notifications for cancellations, refunds, etc. These notifications also need to be validated/verified, even though you might not be doing anything with them.

The payment solution that I'm working on should be done tonight. I'm going to use curl like Jamie did, but fallback to fsockopen if curl isn't available. If both aren't available, then I guess your SOL.

As a side note, I gotta say is, for what a person saves by using paypal instead of a real gateway, they are really opening themselves up to being ripped off. Paypal makes it pretty clear from what I can tell, that if the transaction turns up to be fraudulent, you just lose the money. With a real gateway or credit card merchant account, if the gateway/merchant account approves the transaction, and it turns out to be fraudulent, then it is they who lose the money. Also, from having used paypal and working with people that are big ebay sellers, I know you should always be aware that Paypal can freeze your account, and can make doing business difficult in various ways. Paypal isn't something to use unless you're willing to reject unverified addresses, and reject basically anything that looks suspicious.

[eluser]megabyte[/eluser]

If for some reason the payment status is not ‘completed’, curl never notifies paypal of receipt of the ipn notification, and therefore paypal will resend the notification at intervals for eternity… or for a while anyways.

Do you have a link to documentation on this? I'd be interested in giving it a read. I haven't read that you need to notify paypal that you received the ipn.


As for my previous message, I figured it out.


I also agree PayPal is not the way to go, and for that and many other reasons.

But sadly some people request it.

PayPal == Too much inconsistent documentation

[eluser]skunkbad[/eluser]
[quote author="megabyte" date="1275531528"]

If for some reason the payment status is not ‘completed’, curl never notifies paypal of receipt of the ipn notification, and therefore paypal will resend the notification at intervals for eternity… or for a while anyways.

Do you have a link to documentation on this? I'd be interested in giving it a read. I haven't read that you need to notify paypal that you received the ipn.[/quote]

You can read about this on the technical overview page:

https://cms.paypal.com/cgi-bin/marketing...n_IPNIntro

It says this:

The IPN message service does not assume that all messages will be received by your listener in a timely manner. Because the internet is not 100% reliable, messages can become lost or delayed. To handle the possibility of transmission and receipt delays or failures, the IPN message service implements a retry mechanism that resends messages at various intervals until you acknowledge that the message has successfully been received. Messages may be resent for up to four days after the original message.

So I said eternity, but it turns out to be four days

[eluser]megabyte[/eluser]
skunkbad


Regarding the ipn notification if you're using express checkout and do direct payment.

I have both setup and working on a website right now, but I don't use the ipn.

I just use the payment status to register it as complete and valid.

The PayPal documentation says that there is no guarantee when you'll get the ipn response.

So my question is should I not be alerting the customer that their transaction is complete based on the payment status?

Should I be using the IPN and testing to make sure its verified?