Hi, I am building a website where we sell courses, I manage courses with Eventlist and registration to courses with Chronoforms.
I have set up a form in which variables like code, title, dates, price and city of the course are loaded thru php (basically I pass the code of the course to the chronoform and it reads all details form the database)
The user fills in a form with its details, which are sent by email.
After the email has been sent (using the "On Submit code - after sending email") I create the paypal button dinamically for the course to which the user has registered.
something like:
Is this the right approach? Could the PayPal form be hacked in some way to hijack funds???
I have set up a form in which variables like code, title, dates, price and city of the course are loaded thru php (basically I pass the code of the course to the chronoform and it reads all details form the database)
The user fills in a form with its details, which are sent by email.
After the email has been sent (using the "On Submit code - after sending email") I create the paypal button dinamically for the course to which the user has registered.
something like:
Your registration to Course <?php echo $_POST["CourseCode"];?> Has been received.
<br/>
<br/><br/>
You can complete your transaction with PayPal: <br />
<br />
<form action="https://www.paypal.com/cgi-bin/webscr" method="post">
<input type="hidden" name="cmd" value="_xclick">
<input type="hidden" name="business" value="example@example.com">
<input type="hidden" name="item_name" value="Course: <?php echo $_POST["CourseCode"]; ?> - Dates: <?php echo $_POST["Dates"]; ?> - City: <?php echo $_POST["City"]; ?>">
<input type="hidden" name="amount" value="<?php echo $_POST["Price"]; ?>">
<input type="hidden" name="shipping" value="0.00">
<input type="hidden" name="no_shipping" value="0">
<input type="hidden" name="no_note" value="1">
<input type="hidden" name="currency_code" value="EUR">
<input type="hidden" name="lc" value="IT">
<input type="hidden" name="bn" value="PP-BuyNowBF">
<input type="image" src="https://www.paypal.com/en_US/i/btn/btn_buynow_LG.gif" border="0" name="submit" alt="PayPal">
<img alt="" border="0" src="https://www.paypal.com/en_US/i/scr/pixel.gif" width="1" height="1">
</form>
Is this the right approach? Could the PayPal form be hacked in some way to hijack funds???