PayPal 'Buy Now' Button 'amount' variable is not being passed to the PayPal payment page

[Volunteer_A]

Since the 29th March 2017 change to PayPal buttons, our button links have stopped passing the amount variable.

Below is an example of the link that we send to our Volunteers (when we are collecting money on behalf of our Community Based Organizations):

https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=R6S773THAWR8J&amount=12.8&item_...

In this example both the 'amount' and 'item_number' are not being passed to the PayPal payment page - see screenshot below:

What is going wrong / what has changed?

The amount and all other variables change for each Volunteer (based on the price set by the Community Based Organization) - so I cannot set this within the PayPal Button. I need to be able to 'set' the amount within the URL like we have done in the past. Is this possible? If not, how else can we do this?

[angelleye]

The button URL you're showing here is for a hosted button.  Hosted buttons have the amount set when you create the hosted button and it cannot be overriden directly.  If you want to dynamically set the amount you'll need to use a non-hosted button.

[Volunteer_A]

Thanks for the info Angelleye,

I've been reading up on hosted vs. non hosted buttons.

How do I create a non hosted button?

What are the advantages/disadvantages of using a non hosted button? Specifically how secure/insecure is a non hosted button?

If I use a non hosted button will I be able to use all the same HTML variables?

Thanks in advance!

[angelleye]

While creating the button in your PayPal account, the "Save to PayPal" step is what makes it a hosted button.  You want to uncheck the box that saves the button to PayPal.  Furthermore, at the end it will give you button code that is encrypted, and you'll need to uncheck the box for that security as well.  This will leave you with HTML code that displays all of the variables inside it, and then you can easily add any additional variables you want directly.

The reason this is unsecure is because anybody that loads your page could view source, copy your button code, change the pricing values, and then submit a payment through that button with different pricing.  You could put systems in place to catch this sort of thing, but it's just not ideal to have this possibility available to people.

The best thing to do if you need to utilize dynamic data is to integrate PayPal's APIs.  This will require more development skill with a language like PHP, but will give you the freedom to build the payment solution exactly how you need it while protecting all of the data at the same time.  If you're interested in some more help with that sort of thing you can contact me directly to discuss.

[Volunteer_A]

Thanks so much for the reply!

It sounds like I will be able to use unsecured buttons.

One last question unsecured buttons - is there anyway that someone can change who the payment is sent to - or just the amount that they send to us?

Cheers!

[angelleye]

Nobody would be able to change the code as it is on your site (unless they actually hacked your FTP or something like that, but then you've got bigger problems.)

So sure, they could pull your button code from your site and change any of those values they want, but then they'd have to use that button from a page on their own web server.  They wouldn't be able to change it on your site directly to have payments go to themselves instead of you, for example.

[Volunteer_A]

Thanks again! You've been awesome!

[Volunteer_A]

Hi Angelleye,

Are you able to get back to me? I'm still not sure where to go from here..

Cheers!

[Peter_Claver]

Try creating an unhosted button.