贝宝重定向网址不起作用

Question

I'm using PayPal to make my website work and I ran into a problem

Here is my code, let me explain what I want and what is not working.

<?php
if($_GET['action'] == 'payment_out') //Check from URL if a invoice is going to be payed.
{

    $dbh = new PDO('xxx'); //Connect to the database
    $gpi = $dbh->prepare("SELECT * FROM invoice WHERE invoice_id = ('{$_GET['id']}')"); //Prepare the statement
    $gpi->execute(); //Execute statement
    while ($row = $gpi->fetch(PDO::FETCH_ASSOC)) //Create all needed variables
    {
        $iid = $row['invoice_id'];
        $iow = $row['invoice_owner'];
        $iit = $row['invoice_item'];
        $ipr = $row['invoice_price'];
        $ipp = $row['invoice_payprice'];
        $ist = $row['invoice_status'];
        $ispk = $row['invoice_spk'];
    }
    if($_SESSION['user_name'] == $iow)
    {
    $method = $_GET['method']; //Get the method
    $payment_start = $iow . ' started paying invoice #'.$iid; //Log that the payment started
    $payment_cancel = $method . ' cancelled payment for invoice #'.$iid; //Log that the payment got cancelled
    $ps = $dbh->prepare("INSERT INTO logs (invoice_id,log_exby,log_action,log_time) VALUES ('$iid','$iow','$payment_start',NOW())"); //Prepare the statement
    $ps->execute(); //Insert into logs
    if($_GET['method'] == 'paypal') //Check the payment
    {
        echo '<div class="alert alert-success alert-dismissable"><button type="button" class="close" data-dismiss="alert" aria-hidden="true">&times;</button>
        <h4><i class="fa fa-check-circle"></i> Please wait...</h4> Sending you to PayPal, please wait.
        </div>'; //Tell user that paying is disabled.
                $cancel_return = 'http://x/ClientArea/base_pages_upgrade.php?action=payment_cancel&amp;id='. $iid .'&method=PayPal';
        $return = 'http://x/ClientArea/base_pages_upgrade.php?action=complete_payment&amp;id='. $iid .'&secret_code=' . $ispk . '&method=PayPal&item='. $iit;

        echo '<script>
window.onload = function(){
  document.forms["pay"].submit()

}
</script>
<form action="https://www.paypal.com/cgi-bin/webscr" method="post" name="pay">
  <input type="hidden" name="cmd" value="_xclick" />
  <input type="hidden" name="business" value="x" />
  <input type="hidden" name="quantity" value="1" />
  <input type="hidden" name="item_name" value="'. $iit .'" />
  <input type="hidden" name="item_number" value="Order_'. $iid .'" />
  <input type="hidden" name="amount" value="0.01" />
  <input type="hidden" name="shipping" value="0.00" />
  <input type="hidden" name="no_shipping" value="1" />
  <input type="hidden" name="cn" value="Comments" />
  <input type="hidden" name="currency_code" value="USD" />
  <input type="hidden" name="lc" value="US" />
  <input type="hidden" name="bn" value="PP-BuyNowBF" />
  <input type="hidden" name="return" value="'. $return . '" />
  <input type="hidden" name="cancel_return" value="'. $cancel_return . '" /> 
  <input type="hidden" name="image_url" value="http://i.imgur.com/oxtw9XW.png" />
</form>';


    }
    }
}
?>

This is what I am using at the moment, but I dont want that, I want to use this

$generate_url = 'cmd=_xclick&business=x&quantity=1&item_name=' . $iit . '&item_number='. $iid . '&amount=0.01&no_shipping=1&cn=Comments&currency_code=USD&lc=US&image_url=http://i.imgur.com/oxtw9XW.png';
$fullurl = 'http://paypal.com/cgi-bin/webscr?'. $generate_url .'&return='.$return.'&cancel_return='.$cancel_return;
        header('Location: '.$fullurl);

But when I do that and you paid or you return it just sends you to

http://website.com/ClientArea/base_pages_upgrade.php?action=complete_payment

and not the rest. It has to be

http://website.com/ClientArea/base_pages_upgrade.php?action=complete_payment&id=ID&secret_code=CODE&item=ITEM

is there any way I can fix this problem? It works but the form but I dont want that.

Answer 1

You've neglected to properly URL-encode the value you put into another URL as a parameter value – and therefor, it sees & as the start of a new parameter in the “outside” URL.

Use rawurlencode on your $generate_url value, before you put it into the $fullurl value. (And you should do that on all parameter values, to be safe.)

Or, make your life a little easier, and use http_build_query to begin with – it automatically takes care of the necessary URL-encoding for you.