Hiding GET fields

[johnrb87]

Hi all

 

I have a website which has a payment system on it, I use sagepay, paypal and a few others.

 

They all have relatively similar forms, in which the total amount to be paid is passed in a hidden form field, such as

 

<input type="hidden" name="amount" value="25">

 

all the payment gateways I use have the same or similar method to send the total amount (ie: 25)

 

for example, my paypal form is like

 

<form action="https://www.paypal.com/cgi-bin/webscr" name="paypal_form" method="post">">
    <input type="hidden" name="cmd" value="_xclick">
    <input type="hidden" name="item_name" value="items">
    <input type="hidden" name="currency_code" value="GBP">
<input type="hidden" name="notify_url" value="complete.php">
<input type="hidden" name="return" value="complete.php">
<input type="hidden" name="cancel_return" value="complete.php">
    <input type="submit" name="submit" value="PayPal" />
</form>

 

this is all fine, apart from the user can use things like "firebug" to alter the total to be paid, so they can change $25 to $4 for example.

 

So my question is, is there anyway with PHP to send over these form values are hidden variables.

 

My idea was to post my form fields apart from the "cost" to a PHP script, then get PHP to grab the total from the database and dump the value in cost field and send it along with the other posted values.

 

So really, is there anyway to get PHP to process a form data in a hidden enviroment, so my payment form URL is something like

 

process.php

 

and then process.php on my server deals with the sending of the paypal form data, but in a way that the user cannot see this data, so they basically never get to see the paypal form and any of its contents.

 

Hopefully that kind of makes sense

 

I have tried so many ideas, but cannot seem to find a solution, although when I do, hopefully the same method can be used on all my payment forms.

 

Thanks tons in advance

[JasonLewis]

Have you considered looking into PayPal's IPN. When you receive the payment, do a check with your locally stored payment to see if everything corresponds. If it doesn't, flag it, so when you login you have a list of invalid payments that you can resolve.