PayPal Payment Module

Businesses of any size can benefit from the reliable and trusted PayPal brand. Using PayPal for osCommerce transactions is also one of the easier modules to work with. In fact, you can have a more or less working PayPal facility up and running in no time at all. The hard work comes from ironing out the wrinkles along the way and ensuring the smoothest operation of your payments in the future.

If you are happy with the most basic setup, then all you need to do is create your own PayPal account, and enable the PayPal Payment module in osCommerce using the admin tool. Then, when customers attempt to purchase goods, they will have the option to pay with PayPal and be redirected to the PayPal site, where they can make the transaction.

There are a couple of cons to doing things this way! The main thing is that customer's making payment might simply close their browser, without continuing back to the store. In this case, the order is simply not recorded in the database. This is clearly quite a problem because straightaway you will be unsure as to who has paid for what without manually checking your records. Secondly, customers must have a PayPal account in order to complete the transaction—this is not necessarily the case if you decide to implement PayPal functionality on your own because PayPal has now introduced Account Optional facilities.

As of milestone 2, version 2.2, there is a contribution that uses the PayPal IPN system to make transactions secure and reliable.

Some of you may be asking, "What is an IPN?"

Well, very briefly, let's quickly go over the payment transaction process for PayPal to get a good idea of what is going on under the hood. From the PayPal website, the definition of an IPN is:

Instant Payment Notification (IPN) is PayPal's interface for handling real-time purchase confirmation and server-to-server communications. IPN delivers immediate notification and confirmation of PayPal payments you receive and provides status and additional data on pending, cancelled, or failed transactions.

Basically, an IPN is sent to your server as soon as a payment is made, allowing you to incorporate information sent with this notification into your programming. On receiving the notification, your server will send the information, including the encrypted code, back to a secure PayPal URL. PayPal will then authenticate the transaction and send your server a Verified or Invalid response, which you can use to fulfill an order after you have performed a few checks.

Now, you don't even have to have any form of security enabled to do this because there is no sensitive client information being passed back and forth between your server and PayPal. But while this is an option, you shouldn't really treat it as such—consequently, from your point of view, you either need to have encryption enabled to work with PayPal or you must have a secure server which can be targetted by PayPal.

As well as this, in order to get the IPN system functional you need to be able to supply PayPal with a valid URL, which it will use to send its messages to. So, what this all boils down to is that you need to ensure your hosts can provide you with encryption functionality (or a secure server); you might also wish to read through the following chapter on security, as well as this one, in order to get a better feel for security issues before you get the PayPal payment method up and running.

For now, though, let's begin with setting up a PayPal account...