PayPal IPN的工作方式与预期不符

Question

I'm using an own written download software for paid downloads over paypal. This worked for the last years without any problems, but the last days there are some problems occurred with the IPN from PayPal. Each download has a own form, the for looks like this

<form action="https://www.paypal.com/cgi-bin/webscr" target="_top" method="post" target="_top" style="text-align: right">
<input type="hidden" name="cmd" value="_xclick">
<input type="hidden" name="business" value="[e-mail]">
<input type="hidden" name="item_name" value="SOME PRODUCT Single License">
<input type="hidden" name="item_number" value="20001"> <input type="hidden" name="amount" value="69">
<input type="hidden" name="currency_code" value="EUR"><input type="hidden" name="button_subtype" value="services">
<input type="hidden" name="no_note" value="0">
<input type="hidden" name="notify_url" value="https://www.example.com/path1/path2/path3/?no_cache=1&tx_ppdownload_pi1%5Baction%5D=notify&tx_ppdownload_pi1%5Bcontroller%5D=Transaction">
<input type="hidden" name="image_url" value="http://www.example.com/files/logo.png">
<input type="hidden" name="return" value="https://www.example.com/path1/path2/path3/?no_cache=1&tx_ppdownload_pi1%5Baction%5D=return&tx_ppdownload_pi1%5Bcontroller%5D=Transaction">
<input type="hidden" name="cancel_return" value="https://www.example.com/path1/path2/path3/?no_cache=1&tx_ppdownload_pi1%5Baction%5D=cancel&tx_ppdownload_pi1%5Bcontroller%5D=Transaction">
<button class="btn btn-lg btn-success btn-block" style="border-radius: 0;">Purchase now <br /><small>secure via PayPal</small></button>

There a multiple forms on the page with different products. Since a few days, I have this problems:

Sandbox and live: After purchase, there is a new layout and a new link to return to the shop. A few days ago, that link called my return url, with some get/post data. Included in that data was the txn_id. On the notify url sends PayPal always the transaction, and with the return url and the txnid I was able to check the transaction and show some information.

The cancel url is ignored too. I can click the button and then I came to paypal. A few days ago I was able to click there on cancel, and came back to the cancel_return to show some information. The cancel_return is in most cases now:

https://www.example.com/path1/path2/path3/?no_cache=1

without the other parameters. In 7 of 10 cases, the additional parameters are not in the cancel link at paypal page.

And in 7 of 10 cases, the notify_url gets never called, maybe there are the parameters missed too.

in 10 of 10 cases the return_url does not include the txn_id and in 7 out of 10 cases the return url has missed parameters from my forms.

the first bad payment (got the money, no correct return_url and no call on the notify_url was a few days ago). In last month I had around 60 transactions from different pages with different products, all without error.

I have no idea what's wrong now.

Answer 1

As of March 8, 2017, a problem began to occur with PayPal's IPN handling. When a transaction passes a url (return, cancel_return, and notify_url) that contains an '&' (such as when separating multiple values), PayPal is stripping the url of all content after the first '&'.

This post was one of the first to report the issue and recommends using urlencode: QueryString values removed from the IPN endpoint by PayPal

I have made some modifications to my own PayPal form replacing just the '&' with '&' (the encoded version) and that seems to work too.

This issue has been reported to PayPal (probably by many people by now); hopefully they will get it fixed. Note also that the issue appears to be intermittent and as the above linked post mentions, it may be dependent on the PayPal server you connect to.