Paypal PDT and IPN , how does it work?

Question

I have a form which is submitted to a PHP page. The data from the form needs to be added to an Access database, however the website is hosted and the Access database is on a network drive. So for now, the form just emails the data to someone who enters it by hand. We're trying to improve this process.

So there is no way for the PHP page to directly access the .mdb file.

My idea is to have the PHP page somehow create a block of encoded data, probably with a checksum hidden in it, and email it to our data entry person. This email would look something like this:

===== BEGIN FORM DATA =====
oipcxunrhunt5klejswtnlerj,m,nxupogxjidoh
jpos89760aq2y984hu5nw3jnm4tiopanj5kjny;s
ljknm;l5nkl;ksnm;linjtg89jx9070g89xc6dgh
890unysl;ne.lmsjo8r7g9n0cf9ogumhlkod9ysd
8hj7pc9pg8uopcfmity68od7r9pyh9pm9pfghpju
ypxdekopslp4mpsmkl;4m;slkmk;smjilenmuops
inuobnuiou5io5nuosiun5oin5u4oinu5oiwnu3o
in2oinounion0uonio76n598n109yb9705btbsnb
===== END FORM DATA =====

UUencoding comes to mind, though really I guess I just need some sort of encryption algorithm that would be easy to implement in both PHP and Access (VBScript).

The last part, of course, is on the Access input form there would be a button. This button would pop up a text box, the data entry person would just paste the above block of text into the box and click ok, and some macro code would handle unpacking the data and fill in the forms. Then the data entry person would just need to check that everything's fine and add the record to the database.

Does this process sound like the most efficient one? What algorithm would you recommend to create that block of text and easily unpack it into an Access form?

By the way, I'm very proficient at PHP and not so much at Access/VBScript. Please be verbose about the Access side of things. Thanks!

Solution

When I integrate PayPal I only use the PDT transaction token on the return URL to let the user view the status of the payment. So when the user returns from PayPal the website is issuing a POST request (server side) to the PayPal server and the current status is retrieved. This information is displayed to the user along with any order details. If it failed the user is given a choice to try again or choose a different payment option. If it succeeded no further action is needed.

I only update the actual payment status of the order upon receiving an IPN update from PayPal. This IPN update results again in a POST request to the PayPal server and the status received then will be used to update the payment status.

Are you testing using the PayPal Sandbox environment? To be honest, it's a pain in the *** to use and quite confusing at times as you have to login multiple times with different accounts and account types to finally simulate a payment. You can turn on auto return under Selling Preferences -> Website Payment Preferences and then enable Auto Return, enable Payment Data Transfer and provide a Return URL. You don't have to add the tx querystring variable as PayPal will automatically add that.

You can turn on IPN under Selling Preferences -> Instant Payment Notification Preferences) and provide the Notitication URL that PayPal must use. PayPal will issue a GET request to this URL whenever there's an update concerning a payment.

Comments

[anonymous]

I did all that and got some really useful link to implement everything but the auto return does not work. Can you tell me how exactly it works? Is there an intermediate paypal page showering confirmation and then redirects or it is just direct redact. Do paypal have to approve you page to make it active? I am actually using production environment because I can refund the transaction with minor fee.

[Marco Miltenburg]

After the payment it shows an intermediate screen that automatically redirect back to the website after 10 seconds (or if the user clicks on the link manually). This the last screen I see from PayPal on one of my test sites, using the Sandbox environment. As far as I know PayPal does not have to approve your return URL.

[anonymous]

This helps. This happened to me one time and I was not sure if this is the standard way of redirect. It didn't happen gain though. I was thinking more of a direct redirect without intermediate screen. Thanks