Further to my question and awesome answers from the previous thread, Redirection / Return Check in PHP
I would also love to know, if a payment confirmation page is returned to my website from PayPal, how can I 100% sure that it is co开发者_开发问答ming from paypal and the payment is made?
Regards, Andy
To make sure the request is coming from PayPal you can try resolving the IP address:
if (preg_match('~^(?:.+[.])?paypal[.]com$~', gethostbyaddr($_SERVER['REMOTE_ADDR'])) > 0)
{
// came from PayPal
}
You can (and should) also request https://www[.sandbox].paypal.com/cgi-bin/webscr/
with the same data your received in POST and append the cmd
=> _notify-validate
key-value pair to the request, if the response is VERIFIED
the data is valid.
See also this question: PayPal IPN Security
精彩评论