Securing Button for Multi-item cart checkout

[chichicards]

Hello all!

I'm pretty new to PayPal integration and have used various paypal tutorials and sample code to integrate the paypal checkout page into my website. I have successfully managed to add multi-item checkouts using sample code but there are warnings stating that the following type of code is not secure and I should secure the button:

When I add the hosted button variables to the above I always get the following paypal error displayed:

"You have entered an invalid quantity. A quantity must be a whole number greater than or equal to one."

My question is, how do I create a secure button that will work as above, passing multiple items within the form? I have tried to create Buy Now/Add to Cart buttons from the selling profile but you are always forced to enter details of a single items descripition and price.

Also, from what I've managed to find so far it appears you cannot use a hosted button with the above "_cart" cmd.

Any help would be greatly appreciate and I thank you in advance!

Cheers,
Simon.

<form action="https://www.paypal.com/cgi-bin/webscr" method="post">
<input type="hidden" name="cmd" value="_cart">
<input type="hidden" name="upload" value="1">
<input type="hidden" name="business" value="<website_email_address">
<input type="hidden" name="item_name_1" value="Item Name 1">
<input type="hidden" name="amount_1" value="1.00">
<input type="hidden" name="shipping_1" value="1.75">
<input type="hidden" name="item_name_2" value="Item Name 2">
<input type="hidden" name="amount_2" value="2.00">
<input type="hidden" name="shipping_2" value="2.50">
<input type="submit" value="PayPal">
</form>

[snowshoe]

If using the "upload" method, you cannot use "hosted" or "encrypted" item button code.

[chichicards]

Thanks for the reply snowshoe!

That is what I thought I'd read. I guess my next question is, is it safe to use this Upload method or should I be using some sort of encrpyted button/functions?

I do have things working with the upload method but PayPal seems to suggest I should be encrpting it somehow?

Thanks again in advance!

[snowshoe · Accepted solution]

Using the "upload" method is safe for the most part, yes, it's possible someone could alter the code however, as a seller, you have the final review of the transaction.  What's really interesting is scammers don't take the time to muck with button code because it's easier to scam someone after the transaction.  You could have totally bullet proof code however, if a dispute is opened against you, it's a new game.   As far as encrypting the upload method code, really have not seen anyone do that.

[chichicards]

Thanks snowshoe, that's great. I'll just ensure the code that passes through the information to PayPal is done in a redirect rather than direct from my checkout page.

Thanks for your help, really appreciate it!

Cheers,

Simon.

[snowshoe]