If you think you’ve received a suspicious email or have been directed to a fake website, forward it to firstname.lastname@example.org and we’ll investigate it for you. After you send us the email, delete it from your inbox. If you clicked on any links or downloaded any attachments within the suspicious email or website, log into your account and view your transactions. It’s also a good idea to change your password.
You can either use the online button creator to generate the code for you or else you can manually create the code. If you're new to this, suggest using the online button creator. I would also suggest that you download both PayPal's Website Payments Standard Integration Guide and Merchant Setup and Administration Guide from here. Both guides have tons of great info and examples.