php - paypal ipn developer script to long? -

hey there ask specific script, here is:

http://www.phpbuilder.com/articles/application-architecture/shopping-carts/setting-up-paypal-ipn-in-php.html

i understood everything, quite nice structured , it, looks safe well, have 1 question else-part:

    } else {          // paypal payment valid         // process order here      } 

what have here? insert values in database?? done before?! :

    } else {         // transaction not processed, store in database         $payer_email  = mysql_real_escape_string($_post[‘payer_email’]);         $gross = mysql_real_escape_string($_post[‘mc_gross’]); 

greetings !

edit: ok , prevent replay attack well? :

    if($f[‘count’] > 0) {         $errors[] = “transaction processed”;      } else {       if (count($errors) > 0)  {          // ipn data incorrect - possible fraud         // practice send transaction details e-mail , investigate manually          $message = "ipn failed fraud checks";         mail(‘youremail@example.com’, 'ipn fraud warning', $message, $headers);       } else {          // transaction not processed, store in database         $payer_email  = mysql_real_escape_string($_post[‘payer_email’]);         $gross = mysql_real_escape_string($_post[‘mc_gross’]);          $insert = mysql_query(“insert transactions (txt_id, payer_email, mc_gross) values          (‘$txt_id’,’$payer_email’,’$mc_gross’)”);        }     } 

what think of this?

the above code in question is:

if (!$fp) { // http error } else { 

you must place within else, because if $fp false, means connection paypal's ipn verification system not established.

following through, can see there checks within else, check if payment (considered paypal) valid:

if (strcmp ($res, "verified") == 0) { // payment valid } 

the idea of ipn this, when user follows html button code, links them paypal's website pay.

there hidden value (or if using hosted button, it's saved on paypal's website instead), paypal pings payment went through.

the next step in assuring client's , server's security double check ping came paypal. ssl certificates downloaded before hand, , connect check paypal on https.

the below code shows valid: if (count($errors) > 0) { else linked this.

what have here? insert values in database?? done before?! :

you process information. such as, if user buying membership website, set user upgraded state in database.

the payment logged in database, prevents replay attack.

replay attack

i think you've answered own question $errors[] = "transaction processed";

if @ code above, can see script queries database past transactions. if id matches rows, it's deemed invalid. so, no. long have checks in place, replay attack should not possible.