如何确保从paypal服务器调用paypal notify_url？

Question

I was working with paypal recurring payment subscription form and using sandbox account for testing

here is my form:

<form action="https://www.sandbox.paypal.com/cgi-bin/webscr" method="post">
    <input type="hidden" name="cmd" value="_xclick-subscriptions">
    <input type="hidden" name="business" value="[e-mail]">
    <input type="hidden" name="lc" value="US">
    <input type="hidden" name="item_name" value="Standard Pack">
    <input type="hidden" id="item_number" name="item_number" value="1233434-23213">
    <input type="hidden" name="no_note" value="1">
    <input type="hidden" name="user_id" value="13692">
    <input type="hidden" id="package_id" name="package_id" value="<?php echo $package_type; ?>">
    <input type="hidden" name="a1" value="0">
    <input type="hidden" name="p1" value="1">
    <input type="hidden" id="t1" name="t1" value="M">
    <input type="hidden" id="a3" name="a3" value="10">
    <input type="hidden" name="p3" value="1">
    <input type="hidden" name="t3" value="M">
    <input type="hidden" name="src" value="1">
    <input type="hidden" name="currency_code" value="USD">
    <input type="hidden" name="no_shipping" value="1">
    <input name="return" type="hidden" value="<?php echo base_url();?>package/new_payment_success" />
    <input name="notify_url" type="hidden" value="<?php echo base_url();?>package/new_payment_notify" /> 
    <input name="cancel_return" type="hidden" value="<?php echo base_url();?>package/new_payment_cancel" />

    <div class="paypal-btn">
        <input type="image" src="pay-with-paypal.png" border="0" name="submit" alt="PayPal - The safer, easier way to pay online!" style='width: 125px'>
    </div>
    <img alt="" border="0" src="https://www.paypal.com/en_US/i/scr/pixel.gif" width="1" height="1">
</form>

and it's working totally fine and sends a success information to notify_url url now for security purpose im checking HTTP_USER_AGENT from $_SERVER variable but this can be modified too.

so how can i make sure that transection is done successfully before i update my database?

Answer 1

I think that you can verify the whole POST content by appending cmd=_notify-validate and sending it to PayPal. They will answer you with a Verified or Not verified response.

Please, check the link below for more information:

https://developer.paypal.com/docs/classic/ipn/gs_IPN/