0

I'm using this Class

<?php
class paypalIPN {
    //sandbox:
    private $paypal_url = 'https://www.sandbox.paypal.com/cgi-bin/webscr';
    //live site:
    //private $paypal_url = 'https://www.paypal.com/cgi-bin/webscr';
    private $data = null;

    public function __construct()
    {
        $this->data = new stdClass;
    }

    public function isa_dispute()
    {
        //is it some sort of dispute.
        return $this->data->txn_type == "new_case";
    }

    public function validate()
    {
        // parse the paypal URL
        $response = "";
        $url_parsed = parse_url($this->paypal_url); 
        // generate the post string from the _POST vars aswell as load the
        // _POST vars into an arry so we can play with them from the calling
        // script.
        $post_string    = '';    
        foreach ($_POST as $field=>$value) {        
            $this->data->$field = $value;
            $post_string .= $field.'='.urlencode(stripslashes($value)).'&'; 
        }
        $post_string.="cmd=_notify-validate"; // append ipn command

        $ch = curl_init();
        curl_setopt($ch, CURLOPT_URL, $this->paypal_url);
        //curl_setopt($ch, CURLOPT_VERBOSE, 1);
        //keep the peer and server verification on, recommended 
        //(can switch off if getting errors, turn to false)
        curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, FALSE);
        curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, FALSE);
        curl_setopt($ch, CURLOPT_RETURNTRANSFER,1);
        curl_setopt($ch, CURLOPT_POST, 1);
        curl_setopt($ch, CURLOPT_POSTFIELDS, $post_string); 
        $response = curl_exec($ch);

        if (curl_errno($ch))
        {
            die("Curl Error: " . curl_errno($ch) . ": " . curl_error($ch));
        } 
        curl_close($ch);
        return $response;
        if (preg_match("/VERIFIED/", $response))
        {  
            // Valid IPN transaction.
           return $this->data;
        }
        else
        {  
            return false;         
        }
    }
}

ANd i recall in this mode:

 public function get_ipn()
{
    $ipn = new paypalIPN();
    $result = $ipn->validate();
    $logger = new Log('/error.log');
    $logger->write(print_r($result));
}

But I obtain only "VERIFIED" or "1" (whitout or with the print_r function).

I just tried also to return directly the raw curl response with

return $response;

or

return $this->response;

or also

return $this->parse_string;

but everytime I receive only "1" or "VERIFIED".......

Thank you very much

2 Answers 2

1

The Paypal IPN notification comes into your script as posted data. You can see, in that class, that the code uses the superglobal $_POST to reference this incoming data. You could, instead of using the class, just work with the posted data directly.

The danger is that it might not have come from Paypal.

The script you show here is doing a post-back validation -- that is, it is taking the information that you think Paypal posted to you and putting it right back at them; you're asking them, "is this real?". Paypal is verifying that, yes, this information came from them. The $response variable you see in that code only contains this confirmation from Paypal.

In your code, when you call $result = $ipn->validate();, the interesting data is the returned by the validator with the linereturn $this->data; (the same data is in $_POST still). Per your code, it would then be in the variable $result. That's what you want to work with, it has the transaction data, it is the IPN notification. The $response value from inside the class, again, is only an uninteresting nod from Paypal letting you know that the data you're about to work with is real.

On a side note, this class is a little messy and not very flexible. Tutorial code? A couple of suggestions: it would be better to inject the data into the validate method rather than having it directly read $_POST:

<?php
...
public function validate($data)
{
    ...

    foreach ($data as $field=>$value) { 
        ...
    }

    ...
}

//use
$result = $ipn->validate($_POST);

?>

Also, your validator will call die if there is a problem with the curl request. It should probably return false instead, or better still throw an exception that you can handle with a try...catch. You don't want your entire process to puke out a white screen with mysterious error codes just because Paypal is slow and the request times out. Handle the error, don't die. Finally, as with the validator, you should inject the url into the constructor rather than hard-coding it into the class. That way you could switch between live and sandbox from the outside instead of modifying the class file.

3
  • print_r on what? And, did you modify the class? Looking at your code exactly as it is posted here, the line return $response; needs to be removed, everything else should be fine. Nov 8, 2013 at 6:34
  • first of all thank you for your help. Just modified class with your indication, and invoking now in this manner: $ipn = new paypalIPN(); $result = $ipn->validate($_POST); $logger = new Log('/res.log'); $logger->write(print_r($result)); In the log I've only a "1". If I remove the return $response, PayPal says me "We cannot send IPN"
    – sineverba
    Nov 8, 2013 at 9:01
  • OK! Just solved! I.e., AFTER i have the CONFIRMED VALUE, i need to re-scan $_POST.... and now all is ok! Thank you very much!
    – sineverba
    Nov 8, 2013 at 10:26
0

I'm confused. $_POST is a superglobal. So you don't need this class to tell you the values because you already have them. The VERIFIED response is to let you know the data is authentic.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.