My idea is as follow:

1. .swf on you page sends variables into PayPal

2. After finishing the payment on PayPal, the customer is auto-redirected to your page ("return" variable)

3. Customer returns to your page. PayPal does NOT send any payment data there.

Separately in the background, you receive a form POST from PayPal at a different URL (notify_url variable) - (here resides the php that I added below).

4. You post back a form with cmd=_notify-validate and all fields you received from PayPal. PayPal responds with a single word VERIFIED or INVALID

5. If you receive VERIFIED, you can process payment

This method means that you can easily update for example your MySQL database but unfortunately you have to reload .swf file each time - and that's why it is not a perfect solution in my opinion;

PS:

- variables.return   and variables.notify_url must be absolute urls

- notify_url must also allow anonymous access from outside of your network

- firewall must be opened to host: notify.paypal.com

- in your business PayPal account:

• Auto Return = Enabled in account profile
• PDT = Disabled in account profile
• IPN = Enabled in account profile

- php file:

<?php

// read the post from PayPal system and add 'cmd'

$req = 'cmd=' . urlencode('_notify-validate');

foreach ($_POST as $key => $value) {

        $value = urlencode(stripslashes($value));

        $req .= "&$key=$value";

}

$ch = curl_init();

curl_setopt($ch, CURLOPT_URL, 'https://www.paypal.com/cgi-bin/webscr');

curl_setopt($ch, CURLOPT_HEADER, 0);

curl_setopt($ch, CURLOPT_POST, 1);

curl_setopt($ch, CURLOPT_RETURNTRANSFER,1);

curl_setopt($ch, CURLOPT_POSTFIELDS, $req);

curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 1);

curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 2);

curl_setopt($ch, CURLOPT_HTTPHEADER, array('Host: www.paypal.com'));

$res = curl_exec($ch);

curl_close($ch);

// assign posted variables to local variables

$item_name = $_POST['item_name'];

$item_number = $_POST['item_number'];

$payment_status = $_POST['payment_status'];

$payment_amount = $_POST['mc_gross'];

$payment_currency = $_POST['mc_currency'];

$txn_id = $_POST['txn_id'];

$receiver_email = $_POST['receiver_email'];

$payer_email = $_POST['payer_email'];

if (strcmp ($res, "VERIFIED") == 0) {

        // process payment

}

else if (strcmp ($res, "INVALID") == 0) {

        // log for manual investigation

}

?>