Hard to explain question

[Rifts]

Sorry this may sound insane.

 

Is there anyway to accomplish this,

 

using paypal you can creat buy it now buttons and whatnot. The problem with these is you set the price of the time when making the button.

Is there a way to set the price with php thus creating a dynamic price instead of a static one?

 

I know you can send paypal vars. but is there a way to edit the price?

 

Thanks I hope that makes sense at all

[trq]

Considering php is used to create html dynamically I see no reason this can't be done. Where exactly are you stuck?

[Zurev]

Sorry this may sound insane.

 

Is there anyway to accomplish this,

 

using paypal you can creat buy it now buttons and whatnot. The problem with these is you set the price of the time when making the button.

Is there a way to set the price with php thus creating a dynamic price instead of a static one?

 

I know you can send paypal vars. but is there a way to edit the price?

 

Thanks I hope that makes sense at all

 

Wouldn't you just take the form value and change it with your php?

 

Like in https://www.paypal.com/cgi-bin/webscr?cmd=_pdn_xclick_techview_outside it shows the value on the top example as 12.99, couldn't you just change the value like:

 

name="amount" value="<?=$thisnewamount;?>"

[Rifts]

that is perfect and it works. one last question, is that safe? cant someone just ust temper data and change the price or the email the payment is going to?

[monkeytooth]

I know more that just a transaction ID and paypal variables come back to you on the thank you page, based on variables you supply through the form fields being posted. I just tried looking for the specific doc file on it but can't find it, I think its mentioned in a hard copy I have somewhere. Anyway the point I am tempting to make is seeing as the price is merely put out there via form element, and theres various ways to bypass said coded in price through external means or browser based means with things like grease monkey, and the ability to run script locally prior to page load through some browsers. That said I think you should generate a sha1 hash with various variables going into it, such as the item number, item price, some hard coded values (or 3).. something that can be created as the form is shown on the user side, then recreated in a similar fashion on the thank you page. That way if it matches up from start to finish you can do what ever the thank you page would be intended for, recipte, download, redirect, whatever. where if it doesnt let the user know the transaction failed somewhere and they need to contact you for further support.

 

Otherwise leaving your button open like that just leaves the ability to exploit the hell out of your reason for wanting the button in the first place and then before you know it youve sold 500 copies of whatever but havent made a dime... food for thought is all. I know this doesnt help things I know this complicates things from easy copy and paste to now figuring something out along the lines of my mentions here.. but ask yourself, would you rather deal with it now, or after having lost money?

[ignace]

I agree with monkeytooth. Make sure you have proper validation set up.

[Rifts]

Hey thanks guy I really appreciate the input, I would love to do what you said but I honestly have no idea where to start could you give me a little push?

[Sleeper]

I would have to ask are you trying to change the $ amount via a form where someone puts in the amount they want to pay or via a php variable? If your doing a shopping cart type thing then in the coding for the paypal button just change the value for the amount to either a $_POST[value] or a $var that will be pulled in from the page before.

 

If your doing it on the same page with a form filed like a donation script then you would need to use java so once they change the value the java runs and changes the amount value.

[Rifts]

i'm pulling the price from my DB

 

I just read that when I use IPN I can check the amount to make sure it matches so I'm gunna give that a go untill someone explains how to do that sh1 encrypt stuff.