如何在没有登录的情况下实现付款后提供信息的秘密网址？

Question

I would like to deliver some information to customers after a paypal payment, using the paypal return url, and without having the customer log in.

So I think I need a system to create urls for each transaction, and to avoid that a url for another transaction is guessed.

I have thought of something like:

http://www.domain.com/product/send.php?productID=12&transactionHash=[thisTransactionHash]

using a transactionHash that could be calculated based on the customer's email and the product unique id.

Does this method make sense? or what would be your recommendation delivering information without login, and avoiding customers guessing the url for other products?

---

Although they were several interesting answers about hashes, there is still one concern with the idea I mention above: Paypal needs to receive the return url, therefore the information is passed before payment and therefore the method is not securing against fraud.

The only secure way I see is the Paypal delivery system, which is why I accepted that answer.

Answer 1

If you target PayPal only, why don't you check Instant Payment Notification Guide? https://www.x.com/sites/default/files/ipnguide.pdf

I didn't use Paypal before, but it seems this solves your problem.

Create table: | product_id (unique ID of you product) | varchar transaction_hash |

In this sample code (PHP example): https://www.x.com/developers/PayPal/documentation-tools/code-sample/216623

After validating that the payment is correct, insert product ID and verify_sign( value from paypal POST data) in the table. and Give the user a URL with with product ID and verify_sign.