Not really, while you don't need to have the return page code in your button code in your site - it's associated with the button value in paypal, there's still the issue that a returned to page URL - even if hidden on the site - could be copied and sent to everyone. It is a concern - however there's always the point that anyone who would pass out that URL could just as easily send out copies of your download… What I tend to do is generate an intermediary page between link to the BUY NOW button and paypal which generates a cookie of the required item(s) on returning from paypal, if the paypal return address is the correct one for the cookie I create a download link specific to the session that the user can then download from. I can't help but think the whole process would be made easier if paypal would allow a POST variable to be sent along with the button that could be sent back along with the return link.
... View more