# PayPal Checkout API with PHP - Sending and retrieving additional data safely

I am learning to use the new API version of Paypal, and I have some doubts.

Note: I've tried this on https://www.sandbox.paypal.com and it works, I have not done the tests on Live.

# onApprove:

I need to send additional personalized data to Paypal, and once the user makes the payment, I return to a URL on my server, and then retrieve the data I sent.

Paypal uses fetch() to do to specify the URL and a Json object called headers, there I am adding the additional value called user_ID that I need to recover.

I am using the PHP function getallheaders(), to retrieve user_ID, which I have specified.

My questions are:

1. Is this a correct way to send personalized data to PayPal and then be recovered?
2. It is safe to use getallheaders(), I understand that the headers can be modified before being sent, is there any possibility that these can be altered?
3. Using \$_SERVER['HTTP_REFERER'], to detect that the referred website is from Paypal, is this still safe or difficult to break?
4. Would this be a secure way to integrate Paypal Checkout?
5. Any recommendation that can give me, please.

I would greatly appreciate your help.

<!DOCTYPE html>

<meta name="viewport" content="width=device-width, initial-scale=1">
<meta http-equiv="X-UA-Compatible" content="IE=edge" />

<body>

<input type="text" id="price" value="100.00">
<input type="hidden" id="user_id" value="15">

<div id="paypal-button-container"></div>

<script src="https://www.paypal.com/sdk/js?client-id=HERE_CLIENT_ID&currency=USD"></script>

<script>
paypal.Buttons({
createOrder: function(data, actions) {
return actions.order.create({
purchase_units: [{
amount: {
value: document.getElementById("price").value
}
}]
});
},
onApprove: function(data, actions) {
return actions.order.capture().then(function(details) {
alert('Transaction completed by ' + details.payer.name.given_name);
// Call your server to save the transaction
return fetch('https://my-domain.com/payment-from-paypal.php', {
method: 'post',
'content-type': 'application/json',
'user_ID': document.getElementById("user_id").value
},
body: JSON.stringify({
orderID: data.orderID
})
});
});
}
}).render('#paypal-button-container');

</script>
</body>

• I don't see a great deal of php in your question. – mickmackusa Jul 9 '19 at 7:14
• PHP is the example that I also want to see, how can I consume the PHP REST API to obtain data related to a transaction, in all Paypal examples use CURL, does another PHP alternative exist without using CURL? For example, once the transaction has been made or the product has been purchased, with the Paypal token, we can obtain the data that was sent, including the personalized ones. – Learning and sharing Jul 10 '19 at 4:10
• When you tag a question with php, I expect to see php code to review. – mickmackusa Jul 10 '19 at 4:13