32

I have created a non-hosted PayPal-Button with a text input to let users define an amount to pay. It's a subscription button.

Now the problem is that there must be a minimum amount to pay, say 101 (CHF - Swiss francs).

According to the docs of PayPal HTML-Variables I have the possibility to add the following vars in hidden inputs to my form to get it to work.

  • set_customer_limit with a value of max_limit_own
  • min_amount with a value of 101

The set_customer_limit is working but not the min_amount. Any amount is accepted.

I opened a ticket at the technical support, but no reply till now.

Here's my form:

<form action="https://www.paypal.com/cgi-bin/webscr" method="post" target="_top">
    <input type="hidden" name="cmd" value="_xclick-subscriptions">
    <!-- //... -->
    <input type="hidden" name="cancel_return" value="mydomain.com/cancel">
    <input type="hidden" name="return" value="mydomain.com/paid">
    <input type="hidden" name="token" value="<?php echo $token; ?>">
    <input type="hidden" name="src" value="1">
    <input type="text" name="a3" value="101.00">
    <input type="hidden" name="p3" value="1">
    <input type="hidden" name="t3" value="Y">
    <input type="hidden" name="currency_code" value="CHF">
    <input type="hidden" name="bn" value="PP-SubscriptionsBF:btn_subscribeCC_LG.gif:NonHostedGuest">
<!-- the concerned inputs -->
    <input type="hidden" name="set_customer_limit" value="max_limit_own">
    <input type="hidden" name="min_amount" value="101">
<!-- ---- -->
    <input type="image" src="https://www.paypalobjects.com/de_DE/CH/i/btn/btn_subscribeCC_LG.gif" border="0" name="submit" alt="Jetzt einfach, schnell und sicher online bezahlen – mit PayPal.">
    <img alt="" border="0" src="https://www.paypalobjects.com/de_DE/i/scr/pixel.gif" width="1" height="1">
</form>

As for the moment, I just validate the minimum amount with JavaScript, which isn't really secure...


EDIT

As an idea, I could implement another form (submit it by AJAX, onchange, onkeyup, whatever), which sets the minimum amount given by the user before the PayPal-form and put it into the PayPal-input then (set to hidden again):

<input type="hidden" name="a3" value="<?php echo $_POST['pre_min_amount'] ?>">

That way I could validate the minimum amount with PhP, before submitting the PayPal-form. But that doesn't seem a clean way to me. Really Glad if anybody could give me a hint!

1 Answer 1

29

The answer of the PayPal technical support is: No it is not possible!

(Date of answering was 05/02/2015) Hopefully, this will be possible in the future. If so please post your answer!


I'd really suggest using the PayPal API for this kind of thing (including creating a developer account, byting thru the docs, etc).

So this "solution" is a quick & dirty workaround.


First, add a small form (I call it the min_amount -form for now) to the page (telling the user, he has to set the amount first):

<form id="min_amount" method="post" action="<?php echo $_SERVER['PHP_SELF'] ?>">
    <input type="text" id="pre_min_amount" name="pre_min_amount" value="101">
    <input type="submit" value="Set min. Amount">
</form>

Then, add the whole PayPal form to a PHP variable with NowDoc and add the posted value from the min_amount-form to the a3 input:

$min_amount = 0;
$payPalForm = <<<SOME
<form action="https://www.paypal.com/cgi-bin/webscr" method="post" target="_top">
    <!-- //... -->
    <input type="hidden" name="a3" value="$min_amount">
</form>
SOME;

After submitting, check if the minimum amount is true and then only show the PayPal-form:

if (isset($_POST['pre_min_amount']) && is_numeric($_POST['pre_min_amount']) && floatval($_POST['pre_min_amount']) >= 101) {
    $min_amount = htmlspecialchars($_POST['pre_min_amount']);
    echo $payPalForm;
}

As I said, it's quick and dirty (no more time for this project), but you ensure to validate the minimum amount on the server-side, not just with Javascript. You could also submit the min_amount-form with an AJAX call, but then the return of this call is on the client-side, which isn't really secure either. (Sure you may also)

BTW, I am not proud of this solution at all, but sometimes, a programmers life is hard and I'm sure all you coders out there had to do some q&d code somehow, somewhere ;-)...


Update: 08/05/2015

All depends on the country in which the concerning account is registered. Full services guaranted by PayPal only in the USA and Canada

5
  • value="{ $_POST['pre_min_amount'] }" <- you should sanitize this instead of writing $_POST directly to html
    – Imanuel
    Commented May 5, 2015 at 22:26
  • @Pharaoh not necessary because I test it with floatval and if false the form doesn'tshow up
    – toesslab
    Commented May 6, 2015 at 4:07
  • Assume this string: 200<script>alert('hacked')</script> It passes the floatval() test, but still injects javascript.
    – Imanuel
    Commented May 6, 2015 at 8:10
  • oops... ok convinced!!
    – toesslab
    Commented May 6, 2015 at 8:11
  • @Pharaoh Fixed with htmlspecialchars and is_numeric. Thx to Pharaoh for pointing at!
    – toesslab
    Commented May 6, 2015 at 10:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.