Btukfyl

I am experimenting with PayPal-sandbox for an online shop that I am endeavouring to build. As it currently stands the buyer simply selects a product, clicks the buy now button and is then sent to PayPal to complete the transaction.

After such, I have a function that makes use of the return url to store the transaction details in my orders tables.

Everything works fine but I am wondering if it is also possible to capture the buyers name and shipping address from the PayPal form using the return url.

function process_transaction() {







if(isset($_GET['tx'])) { // ie. if transaction sale has been completed....



$amount = $_GET['amt']; // get amount details for our db

$currency = $_GET['cc'];

$transaction = $_GET['tx']; // get transaction details and we will bump into our db

$status = $_GET['st']; // get status, ie completed

$total = 0; // default product total variables set to zero in the first instance 

$item_quantity = 0;   // default quantity variable set to zero 









$send_order = query(" INSERT INTO orders (order_amount, order_transaction, order_status, order_currency) VALUES('{$amount}','{$transaction}','{$status}','{$currency}')");







confirm($send_order); 





$last_id = last_id(); 







foreach ($_SESSION as $name => $value) { 





if($value > 0 ) { 





if(substr($name, 0, 8) == "product_") { 





$length = strlen($name) - 8; 



$id = substr($name, 8 , $length);









$query = query(" SELECT * FROM products WHERE product_id = " . escape_string($id). " " );



confirm($query);







while ($row = fetch_array($query)) {



$product_price = $row['product_price'];

$sub = $row['product_price']*$value;

$item_quantity +=$value;







$insert_report = query(" INSERT INTO reports (product_id, order_id, product_price, product_quantity) VALUES('{$id}','{$last_id}','{$product_price}','{$value}')");

confirm($insert_report); //runs the confirm helper method  









} // end of while loop





$total += $sub; 

echo $item_quantity; 





} // end of substring if statement









}









} 





session_destroy();



} else {





redirect("index.php");





} 









} 

The information you are adding to your database is coming from the URL string, as you said, using PHP $amount = $_GET['amt'], etc. Your buyer's name and all other information would have to be parsed in the same way, if it is included in that string, for example in the form of "&customer_name=firstname_lastname".

My guess is though, that it will not be. It would be completely insecure to transmit any sensitive data in such a way.

You will have to get customer information from another source. You should be getting it anyway, since you will have to collect it in your web shop at one point.