Git Product home page Git Product logo

php-paypal-ipn's Introduction

PHP-PayPal-IPN

This code is over a decade old and no longer relevant. Please consult Paypal developer documentation instead.

A PayPal Instant Payment Notification (IPN) class for PHP 5.

Use the IpnListener class in your PHP IPN script to handle the encoding of POST data, post back to PayPal, and parsing of the response from PayPal.

Features

  • Switch between live and sandbox by setting the use_sandbox property.
  • Supports both secure SSL and plain HTTP transactions by setting the use_ssl property (SSL is recommended).
  • Supports both cURL and fsockopen network libraries by setting the use_curl property (cURL is recommended).
  • Verifies an HTTP "200" response status code from the PayPal server.
  • Get detailed plain text reports of the entire IPN using the getTextReport() method for use in emails and logs to administrators.
  • Throws various exceptions to differentiate between common errors in code or server configuration versus invalid IPN responses.

Getting Started

This code is intended for web developers. You should understand how the IPN process works conceptually and you should understand when and why you would be using IPN. Reading the PayPal Instant Payment Notification Guide is a good place to start.

You should also have a PayPal Sandbox Account with a test buyer account and a test seller account. When logged into your sandbox account there is an IPN simulator under the 'Test Tools' menu which you can used to test your IPN listener.

Once you have your sandbox account setup, you simply create a PHP script that will be your IPN listener. In that script, use the IpnListener() class as shown below. For a more thoroughly documented example, take a look at the example/ipn.php script in the source code.

<?php

include('ipnlistener.php');

$listener = new IpnListener();
$listener->use_sandbox = true;

try {
    $verified = $listener->processIpn();
} catch (Exception $e) {
    // fatal error trying to process IPN.
    exit(0);
}

if ($verified) {
    // IPN response was "VERIFIED"
} else {
    // IPN response was "INVALID"
}

?>

Documentation

Documentation has not been generated yet, but, there are phpDocumentor style docstrings (comments) throughout ipnlistener.php which explain the important public properties and methods.

I have also written a more in-depth IPN tutorial on my blog: PayPal IPN with PHP

Known Issues

Problem

The processIpn() method throws the following exception:

cURL error: [52] GnuTLS recv error (-9): A TLS packet with unexpected length was received.

Solution

When cURL is compiled with GnuTLS the call to PayPal will fail if the SSL version is not explicitly set as a cURL option. Set the force_ssl_v3 property to force SSL 3:

$listener = new IpnListener();
$listener->force_ssl_v3 = true;

Note: force_ssl_v3 is now true by default

Problem

 PHP Warning: curl_setopt() [function.curl-setopt]: CURLOPT_FOLLOWLOCATION 
 cannot be activated when in safe_mode or an open_basedir is set in ...

Solution

If you need PHP safe mode, you can disable CURLOPT_FOLLOWLOCATION using the follow_location property.

$listener = new IpnListener();
$listener->follow_location = false;

Note: follow_location is now false enabled by default

Example Report

Here is an example of a report returned by the getTextReport() method. Create your own reports by extending the IpnListener() class or by accessing the data directly in your ipn script.

--------------------------------------------------------------------------------
[09/09/2011 8:35 AM] - https://www.sandbox.paypal.com/cgi-bin/webscr (curl)
--------------------------------------------------------------------------------
HTTP/1.1 200 OK
Date: Fri, 09 Sep 2011 13:35:39 GMT
Server: Apache
X-Frame-Options: SAMEORIGIN
Set-Cookie: c9MWDuvPtT9GIMyPc3jwol1VSlO=Ch-NORlHUjlmbEm__KG9LupR4mfMfQTkx1QQ6hHDyc0RImWr88NY_ILeICENiwtVX3iw4jEnT1-1gccYjQafWrQCkDmiykNT8TeDUg7R7L0D9bQm47PTG8MafmrpyrUAxQfst0%7c_jG1ZL6CffJgwrC-stQeqni04tKaYSIZqyqhFU7tKnV520wiYOw0hwk5Ehrh3hLDvBxkpm%7cYTFdl0w0YpEqxu0D1jDTVTlEGXlmLs4wob2Glu9htpZkFV9O2aCyfQ4CvA2kLJmlI6YiXm%7c1315575340; domain=.paypal.com; path=/; Secure; HttpOnly
Set-Cookie: cookie_check=yes; expires=Mon, 06-Sep-2021 13:35:40 GMT; domain=.paypal.com; path=/; Secure; HttpOnly
Set-Cookie: navcmd=_notify-validate; domain=.paypal.com; path=/; Secure; HttpOnly
Set-Cookie: navlns=0.0; expires=Thu, 04-Sep-2031 13:35:40 GMT; domain=.paypal.com; path=/; Secure; HttpOnly
Set-Cookie: Apache=10.72.109.11.1315575339707456; path=/; expires=Sun, 01-Sep-41 13:35:39 GMT
X-Cnection: close
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

VERIFIED
--------------------------------------------------------------------------------
test_ipn                 1
payment_type             instant
payment_date             06:34:51 Sep 09, 2011 PDT
payment_status           Completed
address_status           confirmed
payer_status             verified
first_name               John
last_name                Smith
payer_email              [email protected]
payer_id                 TESTBUYERID01
address_name             John Smith
address_country          United States
address_country_code     US
address_zip              95131
address_state            CA
address_city             San Jose
address_street           123, any street
business                 [email protected]
receiver_email           [email protected]
receiver_id              TESTSELLERID1
residence_country        US
item_name                something
item_number              AK-1234
quantity                 1
shipping                 3.04
tax                      2.02
mc_currency              USD
mc_fee                   0.44
mc_gross                 12.34
mc_gross_1               9.34
txn_type                 web_accept
txn_id                   51991334
notify_version           2.1
custom                   xyz123
charset                  windows-1252
verify_sign              Ah5rOpfPGo5g6FNg95DMPybP51J5AUEdXS1hqyRAP6WYYwaixKNDgQRR

php-paypal-ipn's People

Contributors

emerinohdz avatar micahcarrick avatar mike182uk avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

php-paypal-ipn's Issues

PayPal blocked SSLv3

Due to POODLE security vulnerability, PayPal has blocked SSL v3, which prevents this script from working.

A temporary workaround that will stop working on or around Nov 6 is changing PayPal host domain to ipnpb.paypal.com (line 71), but a long term issue that replaces SSL v3 in this script will be needed. Is a fix coming?

IPN isn't been send to website

Hello Micah,
not sure if this is the right place to ask for help, but I found your file in a plugin I am using and since the support is no help, I thought I go to the source and see if you can help me.
I have a paid membership site that has a paypal gateway. However eventho I am receiving IPNs on my Paypal account with the status of 200 which means everything went ok, the IPNs aren't send back to the website so the memberships obviously are not beeing activated. Maybe I inserted the wrong url in my paypal account? I am going mad here because I can not find the cause for my problem.
It would be great of yout to get back to me on this issue.
kind regards,
Joanne

CURLOPT_FOLLOWLOCATION

[02-Dec-2011 12:08:58] PHP Warning: curl_setopt() [function.curl-setopt]: CURLOPT_FOLLOWLOCATION cannot be activated when in safe_mode or an open_basedir is set in /public/sites/www.fangate.info/ipnlistener.p... on line 92

Works with IPN Simulator, but always returns INVALID otherwise.

I can't seem to make this work. It works fine with the IPN Simulator, but I cannot get anything except INVALID from a live listener.

I'm using the following:

ini_set('log_errors', true);
ini_set('error_log', dirname(FILE).'/ipn_errors.log');

$listener = new \IpnListener();
$listener->use_sandbox = true;
try {
$listener->requirePostMethod();
$verified = $listener->processIpn();
error_log("_RAW POST_".file_get_contents('php://input'));
error_log("**
_getPostUri_".$listener->getPostUri());
error_log("**
getResponse**".$listener->getResponse());
error_log("**
getResponseStatus**
".$listener->getResponseStatus());
error_log("**
getTextReport*******".$listener->getTextReport());
return $verified;
}
catch (Exception $e){
error_log($e->getMessage());
exit(0);
}

I'm writing all these things out to the log trying to figure out what is going on. Here is a dump for all of these (first is the live example, followed by the logs from the simulator) ...

Invalid response status: 500

hi,
sometimes the IPS returns this error: Invalid response status: 500, but the server is running well and the payment is regular.
what could it be?

thank you

Prestashop 1.4.6.2 and PayPal USA, Canada v1.3.8 by PrestaShop

Hello all
I'm very self taught and have been very busy for the last year so I'm just relearning the basics of my web sites. I upgraded paypal to PayPal USA, Canada v1.3.8 because of the ssl bug. Now I get paid but the back office never gets to order completed. I see that I get 301 redirects in logs when paypal sends https://www.mysite.com/modules/paypalusa/validation.php. I have checked .htaccess and robot.txt, I have looked in cpanel for redirects no luck. I have upgraded Backward compatibility v0.6.1 by PrestaShop still no luck. I'm using Prestashop 1.4.6.2 on this site and I did a lot of custom work so upgrading at this time is a no go. This is my first time here and I'm over my head so I would really like a little advice.

Thanks Wayne

cURL error: [0]

Class was working fine but recently i'm getting: "cURL error: [0]" for all transactions.
The issue appears with both with "use_ssl" true or false.

With "use_curl" FALSE the class works fine.

Small improvement

Hi,
All the :

for ($i = 0; $i < 80; $i++)
{
    $r .= '-';
}

in ipnlistener::getTextReport can be replaced by :

$r .= str_repeat('-', 80);

Thanks anyway for this good IPN Listner !

Use input stream instead of rereading from $_POST

If you're using POST data again, you can read the entire body with 1 cmd:

$encoded_data = file_get_contents('php://input')

instead of looping through $_POST and urlencoding en stripslashing and checking magic_quotes_gpc.

cURL error: [77]

The script keeps trowing he following error:
cURL error: [77] Problem with the SSL CA cert (path? access rights?)
What might be the problem?

$listener->processIpn() always returns false

Hi,
For some reason 'processIpn()' is always returning 'false'.

I checked my PHP config and allow_url_fopen and Curl are On.
I checked my server logs and I am not getting any error.

This problem happens when using PayPal IPN simulator and also when using real code from my server.

Please note it is in Sandbox mode, I have not tested in the Live PayPal server.

PayPal CA certificate

I was getting: cURL error: [60] SSL certificate problem, verify that the CA cert is OK.

Then I read this: http://unitstep.net/blog/2009/05/05/using-curl-in-php-to-access-https-ssltls-protected-sites/

I've added in ipnlistener.php this:
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);

on function curlPost() after "curl_setopt($ch, CURLOPT_HEADER, true);" (around line 103)

I think this needs the "proper fix", maybe you should bundle PayPal CA certificate along with the example?.

Thank you very much.

CURL Should Be Off

Hello,

Great class. It's only that Curl had to be off in order to work. Thanks.

HTTP/1.1 301 Moved Permanently from sandbox...

I was getting a this messsage from the ipnlistener.php in my error log:
Unexpected response from PayPal" so I appended the whole response, and it begins with:
HTTP/1.0 302 Found
Location: https://www.sandbox.paypal.com
Server: BigIP
Connection: Keep-Alive
Content-Length: 0

HTTP/1.1 301 Moved Permanently
Date: Tue, 02 Apr 2013 20:49:12 GMT
Server: Apache
X-Frame-Options: SAMEORIGIN
Set-Cookie: c9MWDuvPtT9GIMyPc3jwol1VSlO=%7cXvmjn23Tcb0azc7NMszAIsuJMaiY_jL-QYumQHoPR4stjLVr_ivSLJTXCMHJc1gsmzQqBm%7cId2lWRNEPD4zIWpXBFpP9Kk0ZLqfGRljP87gzjM7ntnK4kLPfHEMg_hEntbStokIqA7VMm%7c; domain=.paypal.com; path=/; Secure; HttpOnly
Set-Cookie: -1ILhdyICORs4hS4xTUr41S8iP0=_00KImvKbtWRtkGJZuur813tcCmPUBI4CMQZJcBj9YzsQtY0XwfHsjAvEHTk2ZCaJBj8VHSDpZx7raqO; expires=Mon, 28-Mar-2033 20:49:12 GMT; domain=.paypal.com; path=/; Secure; HttpOnly
Set-Cookie: cookie_check=yes; expires=Fri, 31-Mar-2023 20:49:12 GMT; domain=.paypal.com; path=/; Secure; HttpOnly
Set-Cookie: Apache=10.72.109.11.1364935752095343; path=/; expires=Thu, 26-Mar-43 20:49:12 GMT
Location: https://www.sandbox.paypal.com/cgi-bin/webscr?cmd=_home&country_lang.x=true
Connection: close
Content-Type: text/plain; charset=ISO-8859-1

Which is followed by:
HTTP/1.1 200 OK and a paypal web page....

I set the options for my instance of the class to:
$listener->use_sandbox = true;
$listener->use_ssl = false;
$listener->follow_location = true;

I added the cert file to my server. Otherwise I'm using this "out of the box". So far I'm only testing with a paypal initiated ipn from their test site. Any idea what I'm doing wrong? I know paypal is in the middle of migrating their developer tools to a new domain... but I don't know if this is related to that or not. Any help greatly appreciated...

Thanks,

improvement FIX SSL

replace this:
$fp = fsockopen($url_parsed[host],"80",$err_num,$err_str,30);
with:
if ($url_parsed['scheme'] == 'https') {
$url_parsed['port'] = 443;
$ssl = 'ssl://';
} else {
$url_parsed['port'] = 80;
$ssl = '';
}
$fp = @fsockopen($ssl.$url_parsed['host'], $url_parsed['port'], $err_num, $err_str, 30);

Curl error: [35] SSL connect error.

When I receive IPN, CurlVerifier make this error:

Curl error: [35] SSL connect error.

I try solve with $verifier->forceSSLv3(false); and $verifier->forceSSLv3(true);, but don't work. Trying with CURLOPT_SSLVERSION = 4 generate other errors.

Can you help me?

fsockPost() does not send HOST header.

Had lots of 400 errors in sandbox until i added (@~ line 149)

$header .= "HOST: ".$this->getPaypalHost()."\r\n";

PS: Im using your code un-moded in a production system (loving it btw) with exactly the same setting as the new test system where I found this issue, so im not 100% if this is a real bug; maybe im going crazy; maybe its paypals sandbox; maybe i need some sleep... But perhaps this issue report will help some other luckless soul from loosing a couple clumps of hair like i have today.

Concatenating to a variable that doesnt exist [yet]

On lines 140 to 143 of ipnlistener.php, you have

    $header  .= "POST /cgi-bin/webscr HTTP/1.0\r\n";
    $header .= "Content-Type: application/x-www-form-urlencoded\r\n";
    $header .= "Content-Length: ".strlen($encoded_data)."\r\n";

but the $header variable isnt defined anywhere else, it was causing my code to fail. I changed the first line and now I have

    $header  = "POST /cgi-bin/webscr HTTP/1.0\r\n";
    $header .= "Content-Type: application/x-www-form-urlencoded\r\n";
    $header .= "Content-Length: ".strlen($encoded_data)."\r\n";

It works.

processIpn should have a $data argument so it can be used in frameworks etc

Because some frameworks delete $_POST and save all post data to some other location. Or when you want to test IPN data.

A library should never depend on environment variables (like $_POST).

So I propose:

public function processIpn( $ipn ) {

and

$verified = $listener->processIpn($_POST);
// or
$verified = $listener->processIpn(array('a' => 'b', 'c' => 'd', 'e' => 'f'));
// etc

(I also don't see why processIpn would check the request's REQUEST_METHOD...)

Paypal IPN PHP Script not inserting into database

What I have already done:
-set ipn url at paypal (not localhost);
-removed "completed" condition;
-removed "txn_id" and others conditions trying to make it works;

None of these attempts worked for me, even if I use ipn simulator.

<?php

// tell PHP to log errors to ipn_errors.log in this directory
ini_set('log_errors', true);
ini_set('error_log', dirname(__FILE__).'/ipn_errors.log');

// intantiate the IPN listener
include('PHP-PayPal-IPN-master/ipnlistener.php');
$listener = new IpnListener();

   // tell the IPN listener to use the PayPal test sandbox
   $listener->use_sandbox = true;

  // try to process the IPN POST
   try {
     $listener->requirePostMethod();
     $verified = $listener->processIpn();
   } catch (Exception $e) {
      error_log($e->getMessage());
      exit(0);
  }

if ($verified) {

$errmsg = ' <br/>';   // stores errors from fraud checks

// 1. Make sure the payment status is "Completed" 
if ($_POST['payment_status'] != 'Completed') { 
    //simply ignore any IPN that is not completed
    exit(0); 
}

 // 2. Make sure seller email matches your primary account email.
if ($_POST['receiver_email'] != '[email protected]') {
    $errmsg .= "'receiver_email' does not match: ";
    $errmsg .= $_POST['receiver_email']."\n";
}

// 3. Make sure the amount(s) paid match
if ($_POST['mc_gross'] != '10') {
    $errmsg .= "'mc_gross' does not match: ";
    $errmsg .= $_POST['mc_gross']."\n";
}


// 4. Make sure the currency code matches
if ($_POST['mc_currency'] != 'USD') {
    $errmsg .= "'mc_currency' does not match: ";
    $errmsg .= $_POST['mc_currency']."\n";
}

// 5. Ensure the transaction is not a duplicate.
include_once("../includes/psl-config.php");
$mysqli = new mysqli(HOST, USER, PASSWORD, DATABASE);

$txn_id = mysqli_real_escape_string($mysqli, $_POST['txn_id']);
$sql = "SELECT COUNT(*) FROM paypal WHERE txn_id = '$txn_id'";
$r = mysqli_query($mysqli, $sql);

if (!$r) {
    error_log(mysqli_error($mysqli));
    exit(0);
}

$exists = $r;

if ($exists) {
     $errmsg .= "'txn_id' has already been processed: ".$_POST['txn_id']."\n";
}

if (!empty($errmsg)) {

    // manually investigate errors from the fraud checking
$body = "IPN failed fraud checks: \n$errmsg\n\n";
$body .= $listener->getTextReport();
mail('[email protected]', 'IPN Fraud Warning', $body);

} else {

// add this order to a table of completed orders
if (isset($_POST['item_number'])) {
    $item_number = $_POST['item_number'];
}

if($stmt = $mysqli->prepare("INSERT INTO paypal (item_number) VALUES (?)")){
        $stmt->bind_param('s', $item_number);
        $stmt->execute();   
    }else{
        $errmsg .= "Error trying to insert into DB<br/>";
        error_log(mysqli_error($mysqli));
    }                               

  // free user ads here
 }

  } else {
 // manually investigate the invalid IPN
 mail('[email protected]', 'Invalid IPN', $listener->getTextReport());
 }

?>

I´m receiving fraud email all the time. Sometimes it brings me txn_id has already been processed but how can it check this if nothing has been inserted into database?

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.