PHP按钮，处理一个php文件，然后重定向到另一个页面

Question

I have a question regarding php button. I want to make a dynamic buy now button with paypal. A button that i can pass my custom variables into. The only way i know how to that is through a paypal form.

<form action="https://www.paypal.com/cgi-bin/webscr" method="post">
<input type="hidden" name="cmd" value="_xclick">
<input type="hidden" name="business" value="paid@yourdomain.com">
<input type="hidden" name="item_name" value="my product">
<input type="hidden" name="item_number" value="12345">
<input type="hidden" name="amount" value="9.99">
<input type="hidden" name="no_note" value="1">
<input type="hidden" name="currency_code" value="USD">
<input type="hidden" name="bn" value="PP-BuyNowBF">
<input type="image" src="https://www.paypal.com/en_US/i/btn/x-click-but23.gif" border="0" name="submit" alt="Make payments with PayPal - it's fast, free and secure!">
<img alt="" border="0" src="https://www.paypal.com/en_US/i/scr/pixel.gif" width="1" height="1">
</form>

But the above form's amount value can easily be tampered with. So instead of this i want to have just a button in html, and have everything process through a php file. When a user clicked the button, the process of price calculation will happen in the php file, and then redirect the user to paypal, where they can pay for the item. This way the price can't be tampered with. Can someone tell me if it's possible to do it that way? or i have to dynamically encrypt the button using openssl? or there's another way?

Answer 1

Instead of posting directly to PayPal, you can collect all the data server side, and use cURL to post the data to PayPal. The form would look more like:

<form action="confirm.php" method="post">
    <input type="hidden" name="business" value="paid@yourdomain.com">
    <input type="hidden" name="item_number" value="12345">
    <input type="image" src="https://www.paypal.com/en_US/i/btn/x-click-but23.gif" border="0" name="submit" alt="Make payments with PayPal - it's fast, free and secure!">
    <img alt="" border="0" src="https://www.paypal.com/en_US/i/scr/pixel.gif" width="1" height="1">
</form>

Then confirm.php would do a handful of things. Lookup the price, calculate the total, etc.

<?php
$bizName = isset($_POST['business']):$_POST['business']:"";
$itemNumber = isset($_POST['item_number'])?intval($_POST['item_number']):"";

// Lookup details for the Item, purchase, and collect them into an array maybe
$itemDetails = array(
    "cmd" => "_xclick",
    "amount" => $itemPrice, // Get from DB
    "no_note" => 1,
    "currency_code" => "USD",
    "bn" => "PP-BuyNowBF",
    "business" => $bizName,
    "item_name" => $itemName, // Get from DB
    "item_number" => $itemNumber
);
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, "https://www.paypal.com/cgi-bin/webscr");
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($itemDetails));
// receive server response ...
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$svr_out = curl_exec ($ch);
curl_close ($ch);
// Do something with $svr_out, maybe display it, or if it's a redirect, redirect the user in turn.
?>

This is untested and is more of a template to get you started. I am sure your site is more complex and you could then build off of this. It is just an example of something you could do.