Awards
- Community Pick
If you want to sell something on your website, perhaps something like a personalized kid's storybook, you can add a PayPal buy-button that will send the user to PayPal to make a payment to your PayPal account. You will get an email and then you can create and send the book to the buyer.
The Html code that makes up the button (created manually or from the PayPal button factory) contains things like your PayPal account email, the item description and price and perhaps a few other parameters. However, someone knowledgeable could view the source of your page or save the Html from the browser, change the price and then click the modified button and you will receive the order with a lower payment. Maybe you will notice it but if you get lots of orders for various items, it may go unnoticed until after you send the book.
The solution is to use PayPal's Encrypted Website Payments (EWP) buttons. This can be done by the button factory and you can set a flag in the profile to only allow encrypted buttons to be used on your site. People will no longer be able to modify your buttons in any way. All the parameters that make up the button are encrypted into one string of characters and that string is sent as a single parameter to PayPal when the button is clicked. When created by the factory, PayPal knows how to decrypt what it encrypted in the first place.
However, what if you want to dynamically generate your buy-buttons in your code? You can create the parameters as you need on the fly and use them unencrypted but if you want to encrypt them, you can't use the factory. For example, the personalized book's item description could be "Billy Jones and the Magic Pancake" which will display when the buyer enters PayPal to pay. Dynamic buttons are also useful when you have a database with lots of items. Once you create the set of parameters for the button, you can then run the string through an encryption routine and use the encrypted string in your buy button. The PayPal site explains how to do this (http://www.paypal.com/Int
There are several steps to do this as discussed in the link above:
For testing purposes, I have created a simple tool to do steps 1 and 3 (http://www.webguild.com/P
The Html code that makes up the button (created manually or from the PayPal button factory) contains things like your PayPal account email, the item description and price and perhaps a few other parameters. However, someone knowledgeable could view the source of your page or save the Html from the browser, change the price and then click the modified button and you will receive the order with a lower payment. Maybe you will notice it but if you get lots of orders for various items, it may go unnoticed until after you send the book.
The solution is to use PayPal's Encrypted Website Payments (EWP) buttons. This can be done by the button factory and you can set a flag in the profile to only allow encrypted buttons to be used on your site. People will no longer be able to modify your buttons in any way. All the parameters that make up the button are encrypted into one string of characters and that string is sent as a single parameter to PayPal when the button is clicked. When created by the factory, PayPal knows how to decrypt what it encrypted in the first place.
However, what if you want to dynamically generate your buy-buttons in your code? You can create the parameters as you need on the fly and use them unencrypted but if you want to encrypt them, you can't use the factory. For example, the personalized book's item description could be "Billy Jones and the Magic Pancake" which will display when the buyer enters PayPal to pay. Dynamic buttons are also useful when you have a database with lots of items. Once you create the set of parameters for the button, you can then run the string through an encryption routine and use the encrypted string in your buy button. The PayPal site explains how to do this (http://www.paypal.com/Int
There are several steps to do this as discussed in the link above:
- 1
Obtain a private key and public certificate
You use your private key to decrypt something encrypted by your public cert. Public certs are used for encryption and authentication.
- 2
Upload your public cert to PayPal
You then give away your public certificate to anyone that needs to authenticate that you are you or encrypt data to send to you. In this case, you upload your public cert to PayPal. Actually, PayPal does not need to send you anything encrypted so they mainly need your public cert for authentication. There are other non-PayPal uses of this private key/public cert pair like encrypted email but I will discuss that in a future posting.
- 3
Downloading PayPal's public cert
PayPal has two certs, one for the live PayPal site and one for the PayPal sandbox (or beta sandbox). You use PayPal's cert to encrypt the buy-button parameters. PayPal provides links for you do download their certs. Certs are created with an expiration date. In PayPal's case, their certs will expire in 2035.
- 4
Set your PayPal profile to only allow encrypted buttons.
Do this by logging on to your PayPal account and click on Profile and then Encrypted Payments
For testing purposes, I have created a simple tool to do steps 1 and 3 (http://www.webguild.com/P
Click the Buy Now and after some seconds, if you selected the Free cert, a link will display to download the zip file and if you selected a longer expiration date, you will first pay through PayPal and then return to click the zip download. This is the file:
The image shows the two PayPal public certs, the Pkcs12.p12 file, your private key (keep this secure) and your public cert (to give away). The Readme.txt file has some hints and information on the OpenSSL commands used to create these files. The p12 file is used by your code that generates your encrypted buttons. This file also should be kept secure since it contains both your private key and public cert.
The tool to create your private key and public cert is at http://www.webguild.com/Pa
- Gary Davis
Certified PayPal Developer
by: jennhp on 2010-03-01 at 13:23:52ID: 10262
I'm helping a friend out with her website and one of the things she's asked me to do is work on her PayPal settings. I had no idea that someone could change the price of a product if they knew HTML code. Thanks for the heads up!