Take the 2-minute tour ×

I am new to integrating paypal with sites so maybe there's a readily available method from the service I could use? What I am trying to do is when the user clicks "return to my website", I want my return URL to know that the referrer is paypal so I can send him to the homepage automatically. How do I go about this?

I tried $_SERVER['HTTP_REFERER'] but it doesn't seem to catch anything. I also set the cookie and session(though I am not sure if I made it right or it's the right thing to do) during IPN conversation, but when returning to my website, it doesn't seem to recognize any session.

If I get away with this using $_SERVER['HTTP_REFERER'], I am afraid it is a security risk, right? If so, is there any other method I am missing? Please, help.

share|improve this question
Doesn't Paypal set some query-string variable on return? Seem to remember that from way back. –  Wrikken Aug 2 '10 at 17:47
did you echo out $_SERVER['HTTP_REFERER'] to see what it is giving you? Maybe it is showing paypal.com just fine but your condition is messed up, like not matching properly or somethin. Also, it's not necessarily a security risk...yeah people can spoof this but if all you are doing with it is determining whether to send them to a generic thank you page, not necessarily any harm in that. –  Crayon Violent Aug 2 '10 at 17:49
yah, I did via sendmail(). It doesn't send anything. I placed it in login.php which is apparently my return URL. However when I purposely login using unregistered account, it sends my.domain.com/login.php. Maybe $_SERVER['HTTP_REFERER'] is not the right one? –  adred Aug 2 '10 at 18:00
@Wrikken, it does? As far as I know it only sends message thru IPN, not via return URL. But correct me if I am wrong... –  adred Aug 2 '10 at 18:02

2 Answers 2

Do you really need to know the referer? Set the PayPal return URL to a "secret" URL that always redirects to the homepage. If somebody ends up there and gets redirected without coming from PayPal, so what? It shouldn't be a problem.

Also, I haven't used PayPal, but I'd imagine any IPN notification will come as a request directly from PayPal's servers, not the user, so setting any cookies or sessions won't do you much good.

share|improve this answer
The homepage is a restricted area. Only registered users are allowed to enter. The scenario here happens after the user pays the subscription, so any server communication is absent. –  adred Aug 2 '10 at 18:07

You can add a new hidden field with any custom value, that will be posted back to you. You could use that field for whatever you want. You should name that field custom.

Paypal will return back that field and once you see that you should be sure it has come from paypal.

share|improve this answer
Yah, I have set up similar to that when verifying the existence of the user trying to subscribe. But the communication between my handler and IPN happens in the background right before the "return" is clicked. So, nothing actually happens after that because the click-button event doesn't involve IPN right? –  adred Aug 2 '10 at 18:12

Your Answer


