Joomla Paypal IPN always return INVALID

[advcha]

Hi,
I've problem to veryfied the paypal payment on my joomla 1.5 website. I always get "INVALID" although the payment is success. i cannot get POST value from paypal, only can GET value. what's wrong with these code or the setting.

my paypal setting in sandbox.paypal.com
IPN : Turn On
Message delivery : enabled
notification url : http://mysite.com/index.php?option=com_order&type=orders
auto return : on
return url : http://mysite.com/index.php?option=com_order&type=orders
PDT : on
Encrypted Website Payments : off
PayPal Account Optional : off
         
in mycomponent joomla                           
payment.php

<form method="post" action="https://www.sandbox.paypal.com/cgi-bin/webscr" name="paypal">
  <input type="hidden" value="_xclick" name="cmd">
  <input type="hidden" value="myname_1335697493_biz_email" name="business">
  <input type="hidden" value="test payment" name="item_name" id="item_name">
  <input type="hidden" value="11" name="item_number" id="item_number">
  <input type="hidden" value="0.1" name="amount" id="amount">
  <input type="hidden" value="USD" name="currency_code" id="currency_code">
  <input type="hidden" value="<?php echo JURI::base();?>index.php?option=com_order&type=orders" name="return" id="return">
  <input type="hidden" value="<?php echo JURI::base();?>index.php?option=com_order&type=orders" name="cancel_return" id="cancel_return">
  <input type="hidden" value="<?php echo JURI::base();?>index.php?option=com_order&task=orders" name="notify_url" id="notify_url">
  <input type="hidden" name="rm" value="2">
  <table class="tblpay">
  .....
  </table>
</form>

                                     

on my controller.php

function display()
{   
    $user =& JFactory::getUser();
    $type = JRequest::getVar('type');
    switch($type) {
        ...
            case 'orders':
            $viewName    = 'orders';
            $viewLayout  = 'orderslayout';
            if (JRequest::getVar('tx') != null){
                $this->processpayment();
                $viewLayout  = 'paymentlayout';
            }
            break;
        ...
}

function processpayment(){
    // Response from Paypal

    // read the post from PayPal system and add 'cmd'
    $req = 'cmd=_notify-validate';
    $get = JRequest::get('get');
    foreach ($get as $key => $value) {
        $value = urlencode(stripslashes($value));
        $req .= "&$key=$value";
    }
    // assign posted variables to local variables
    $data['amount']            = JRequest::getVar('amt');
    $data['currency']         = JRequest::getVar('cc');
    $data['cm']             = JRequest::getVar('cm');
    $data['idorder']         = JRequest::getVar('item_number');
    $data['st']                = JRequest::getVar('st');
    $data['tx']                = JRequest::getVar('tx');
    $data['option']            = JRequest::getVar('option');
    $data['type']            = JRequest::getVar('type');
    $data['paymentresult']    = "";
        
    // post back to PayPal system to validate
    $header = "POST /cgi-bin/webscr HTTP/1.0\r\n";
    $header .= "Content-Type: application/x-www-form-urlencoded\r\n";
    $header .= "Content-Length: " . strlen($req) . "\r\n\r\n";
    
    $fp = fsockopen ('ssl://www.sandbox.paypal.com', 443, $errno, $errstr, 30);    
    if (!$fp) {
        // HTTP ERROR
    } else {    

        fputs ($fp, $header . $req);
        while (!feof($fp)) {
            $res = fgets ($fp, 1024);
            if (strcmp($res, "VERIFIED") == 0) {
                ...
            }else if (strcmp ($res, "INVALID") == 0) {
                ...
            }        
        }        
    fclose ($fp);
    }
    
    //$redirectTo = str_replace("amp;","",JRoute::_('index.php?option='.JRequest::getVar('option').'&type=orders&layout=paymentlayout'));
    //$this->setRedirect($redirectTo, '');
}

this is the result i get from paypal (use jdump):
[string] option = "com_order"
[string] type = "orders"
[string] tx = "9D9224627W344360N"
[string] st = "Completed"
[string] amt = "0.10"
[string] cc = "USD"
[string] cm = ""
[string] item_number = "41"
[string] Itemid = "" --> why i get this because i never send itemid?