CODEWITHSUNDEEP
phppaypal
Shuswap River
Shuswap River

Reputation: 23

Paypal IPN $custom Variable not working with PHP

I have a paypal listener with mailing set up and working just fine, but I am trying to pass a "custom" variable to paypal to return in my IPN to update my database. The listener is working with the IPN Simulator but I've narrowed it down to the registration page not sending the "custom" information. I'm not fluent with php by any means, below is the code I am using with my paypal button:

<?php
          if(!empty($_POST['name']))
          {
          $name = mysql_real_escape_string($_POST['name']);
          $phone = mysql_real_escape_string($_POST['phone']);
          $email = mysql_real_escape_string($_POST['email']);
          $address = mysql_real_escape_string($_POST['address']);
          $date = mysql_real_escape_string(date("Y.m.d"));
          $active = mysql_real_escape_string('Active - Not Paid');
          $supportrec = isset($_POST['supportboatsyes']);
          $support10hpban = isset($_POST['support10hpbanyes']);
          $supporttotalban = isset($_POST['supporttotalbanyes']);
          $emaillist = isset($_POST['addtoemailyes']);
          $volunteer = mysql_real_escape_string($_POST['volunteer']);              

          $checkusername = mysql_query("SELECT * FROM recreationUsers WHERE Name = '".$name."'");

          if(mysql_num_rows($checkusername) == 1)
          {
          echo "<h1>Error</h1>";
          echo "<p>Sorry, you have already registered. <br /> Please contact the site administrator regarding any issues.</p>";
          }
          else
          {
          $registerquery = mysql_query("INSERT INTO recreationUsers (Name, Phone, Email, Address, Date_added, Status, Support_all_recreation, Support_10hp_ban, Support_no_boats, Email_list, Volunteer) VALUES('".$name."', '".$phone."', '".$email."', '".$address."', '".$date."', '".$active."', '".$supportrec."', '".$support10hpban."', '".$supporttotalban."', '".$emaillist."', '".$volunteer."')");
          if($registerquery)
          {
          $custom = mysql_real_escape_string($_POST['name']);

          echo "<h1>Success, please choose your account type below:</h1>";
          echo '<form action="https://www.paypal.com/cgi-bin/webscr" method="post" target="_top">
                   <input type="hidden" name="cmd" value="_s-xclick" />
                   <input type="hidden" name="hosted_button_id" value="6F6YP6CVBRW92" />
                   <input type="hidden" name="custom" value="$custom" />
                   <table>
                       <tr><td><input type="hidden" name="on0" value="Choose a subscription:" />Choose a subscription:</td></tr>
                       <tr>
                           <td>
                               <select name="os0">
                                   <option value="Individual">Individual: $20.00 CAD - Annual</option>
                                   <option value="Family">Family: $50.00 CAD - Annual</option>
                               </select>
                           </td>
                       </tr>
                   </table>
                   <input type="hidden" name="currency_code" value="CAD" />                       
                   <input type="image" src="https://www.paypalobjects.com/en_US/i/btn/btn_subscribeCC_LG.gif" border="0" name="submit" alt="PayPal - The safer, easier way to pay online!" />
                   <img alt="" border="0" src="https://www.paypalobjects.com/en_US/i/scr/pixel.gif" width="1" height="1" />
                </form>';

          echo "<p>If you don't have a Paypal account Please Click on the next page \"Pay using your credit or debit card.\"</p>";
          }
          else
          {
          echo "<h1>Error</h1>";
          echo "<p>Sorry, your registration failed. Please go back and try again.</p>";
          }
          }
          }
          else
          {
          ?>

I've also tried:

<input type="hidden" name="custom" value="<?php echo htmlspecialchars($custom); ?>"

and: 

 <input type="hidden" name="custom" value="<?php echo $custom); ?>"

Can anyone direct me to the correct usage of this please?

Upvotes: 2

Views: 371

Answers (1)

Drew Angell
Drew Angell

Reputation: 26036

This will make the form output with the custom parameter filled in correctly (assuming $custom is getting populated the way you expect it to.)

echo '<form action="https://www.paypal.com/cgi-bin/webscr" method="post" target="_top">
               <input type="hidden" name="cmd" value="_s-xclick" />
               <input type="hidden" name="bn" value="AngellEYE_SP_GeneralConsult" />
               <input type="hidden" name="hosted_button_id" value="6F6YP6CVBRW92" />
               <input type="hidden" name="custom" value="'. $custom . '" />
               <table>
                   <tr><td><input type="hidden" name="on0" value="Choose a subscription:" />Choose a subscription:</td></tr>
                   <tr>
                       <td>
                           <select name="os0">
                               <option value="Individual">Individual: $20.00 CAD - Annual</option>
                               <option value="Family">Family: $50.00 CAD - Annual</option>
                           </select>
                       </td>
                   </tr>
               </table>
               <input type="hidden" name="currency_code" value="CAD" />                       
               <input type="image" src="https://www.paypalobjects.com/en_US/i/btn/btn_subscribeCC_LG.gif" border="0" name="submit" alt="PayPal - The safer, easier way to pay online!" />
               <img alt="" border="0" src="https://www.paypalobjects.com/en_US/i/scr/pixel.gif" width="1" height="1" />
            </form>';

To explain further, you're using a single quote to open up your echo statement. As such, simply using $custom inside that won't actually output the value of $custom, so you need to use the ' . $custom . ' method instead.

If you were using a double quote to open up the echo line, then using $custom directly would work, but then you would also have to escape all of the double quotes inside the form html because they would be closing that echo line if they weren't escaped.

I read somewhere a while ago that it's best to use the single quote as much as possible because if you use double quotes then PHP will look for $phpvars within that content which chews up some processing power on the server.

Upvotes: 1

Related Questions