Is Ipn A good Idea

[NightCoder]

Hi ya all.

I have just built a new website and would like to charge my visitors for the services that we offer. I have a keen interest in Paypal's Instant Payment Notification (IPN) but I keep seeing posts all over the net saying that its not safe to use. One of the posts say's that people can change the buttons so it does not charge them when they get to Paypal. What I was wondering is if anyone here uses it and if they have had any problems. Thank you.

[monaghan]

I guess you could fake it, however I've not had any problems using it. I've not coded anything myself, however I have coded using the nochex APC whish I understand to be very similiar and it will bounce back the values you send, so should be fairly secure as this is a transaction between your server and the (in this case) nochex server, not the result of a user's post.

If it was that easy to bypass, then nobody would use IPN or similiar.

[HostYorkshire]

Hi Nightcoder. I used paypal IPN for www.bonsaihelp.co.uk/subscribe.php
Basicly what it does it passes a call back to my little mod I have in PHPBB and opens up other forums for members.

I set it on 1 month, 3 month, 6 month and 12 months subsciption prices.

However sometimes the IPN callback took a while to come back. I was fed up of people emailing me saying their subscription was not active.

Therefore I now charge annual access and do the subscription activation manually.
When it did work it was good. Every day there would be small monthly payments flying in, accounts activated and deactivated. It's worked handsfree, all I did was get my cash.

I don't know if PayPal have improved IPN since then as it is a while since I have used it. I suppose it depends on exactly what you are doing.

Alex, would like to get into the NOCHEX IPN stuff when I have a chance.
Have you or anyone else had a go with the NOCHEX merchant acount? Sounds good.

[HostYorkshire]

Originally Posted by NightCoder

One of the posts say's that people can change the buttons so it does not charge them when they get to Paypal.

Whoops, yes you can generate encrypted buttons now which tries to stop people spoofing. You just really need to keep an eye on all transactions for security and if you see anything suspcious, hold back and check it out before you deliver goods or services.

I have a few hundred pounds a week in fraudulant orders through the hosting system at Host Yorkshire. None have suceeded yet. :-)

[monaghan]

Andrew,

You need to be clearing ?1K or more a month to get the Nochex merchant account, most of my payments come via bank transfer (now a IPN generated off the back of a bank deposit would be cool )

[A-Wing]

I find IPN, etc... only tends to break if you have problems with your site/server. It doesn't hang around too long if your server has load, and won't retry on an error.
NoChex's version seemed a bit hit-and-miss for me when I tried it but I was using someone else's code for it back then. I have written my own version but not really used it in anything.