Railscasts - PayPal Basics

#141

Dec 22, 2008

PayPal Basics

This episode is the first in a series on handling the checkout process for orders. Here we show how to complete purchases through PayPal's Website Payments Standard service.

Tags: tools e-commerce

Download (17.5 MB, 7:03)

alternative download for iPod & Apple TV (10.6 MB, 7:03)

Read it on ASCIIcasts

Resources

<%= link_to "Checkout", @cart.paypal_url(products_url) %>

# models/cart.rb
def paypal_url(return_url)
  values = {
    :business => 'seller_1229899173_biz@railscasts.com',
    :cmd => '_cart',
    :upload => 1,
    :return => return_url,
    :invoice => id
  }
  line_items.each_with_index do |item, index|
    values.merge!({
      "amount_#{index+1}" => item.unit_price,
      "item_name_#{index+1}" => item.product.name,
      "item_number_#{index+1}" => item.id,
      "quantity_#{index+1}" => item.quantity
    })
  end
  "https://www.sandbox.paypal.com/cgi-bin/webscr?" + values.to_query
end

< Previous Episode

Next Episode >

37 comments

1. Aditya Sanghi Dec 22, 2008 at 01:01

Thanks Ryan,

Just what the doctor ordered for a fresh Monday morning! I think i mind control you over the week for the stuff i'll need at the end of it.

Cheers,
Aditya

Report as Spam

2. MTH Dec 22, 2008 at 01:18

Thank Ryan,

Waiting for the CC's payment episodes!

Report as Spam

3. pulkit Dec 22, 2008 at 01:39

Hi Ryan,

Thanks for the screencast.

You kept my trust on you by giving long screencast.

Now again I am waiting eagerly for next monday.

Report as Spam

4. grosser Dec 22, 2008 at 01:58

i recommend active_merchant for those kind of payment processing, makes life easier / more robust / secure

www.activemerchant.org

Report as Spam

5. Josh Dec 22, 2008 at 05:10

Thank goodness! This series was long overdue. Thanks, Ryan!

Report as Spam

6. Stephen Celis Dec 22, 2008 at 05:25

A little Active Support for your key-value mapping: "Object#to_query".

Report as Spam

7. DestinyD Dec 22, 2008 at 06:23

I build a websize like yours.
http://rubycnrails.cn
It just for Chinese.
I have many problems want to ask you?
Could you mail me?

Report as Spam

8. jaggerfil Dec 22, 2008 at 06:45

BEWARE OF PAYPAL!

PLEASE read your amended Paypal User Agreement! Paypal (owned by ebay) can now withhold users funds for 21-180 days at Paypal's "sole discretion"!!! Users are being caught in this trap at alarming rates! We can all thank ex-ebay CEO, Whitman and current CEO, Donahoe, for their "Disruptive Innovation" SCHEME against users for many such detrimental changes.

To read what the users are REALLY experiencing, search the internet for

"Ebay Stockholders and Sellers Calling For Immediate Termination of John Donohoe CEO Petition" (at petitiononline).

To learn about their own employees experiences with such POOR management, go to glassdoor and type in ebay.

Report as Spam

9. Ryan Bates Dec 22, 2008 at 07:17

@grosser, an episode or two an ActiveMerchant is planned later on in this series.

@Stephen, thanks! I never knew about to_query. It looks like calling that on the hash will do just what we need (along with proper escaping). I'll update the code.

Report as Spam

10. Michael Schuerig Dec 22, 2008 at 09:56

From this screencast it looks almost too easy to interface with PayPal. Actually, I think it does look too easy, as you're sending all the data in plain sight and unprotected.

You really should not send your customers purchase detail unencrypted over the wire. So, better use HTTPS.

The other way round, you don't want customers to be able to tamper with amounts without your app or PayPal noticing it. Therefore, don't forget to add hashes for integrity checking.

Then, when it comes to being notified by PayPal that the payment has been processed, you need to make sure that the notification has indeed been sent by PayPal and not been faked by someone else.

Also, anyone who tries to implement something like this ought to keep in mind all the possible failure conditions and how they affect the workflow.

I don't know the PayPal API, but I'm pretty sure that they support everything that's needed to make payment secure. It is not rocket science to write an equally secure client, however, it is rather more time consuming than pasting together a URL.

In general, if at all possible, I strongly recommend to use a solution (plugin, gem) that does the job and already has some traction in the community.

Report as Spam

11. Miguel Regedor Dec 22, 2008 at 13:06

hi there!

Ryan!!! Couldn't you have done these series one month ago!? eheh... sorry, but I spend more than one week struggling with paypal to do a subscription system, at the beginning I thought using active merchant but they don’t have good documentation, so I started creating a gem to deal with paypal standard payments and IPN for subscriptions.
Funny thing when we get it working we changed our minds and we end up to use active merchant and checkout express, even so we had to extend AM because it doesn’t deal with subscriptions for default. Using that second API we don't have to rely on the IPN system and we have more controller over the user data and transactions, it applies better to our web site goal.

In any case if anyone want a simple solution you can use my code or gem created for subscription but easy adaptable to normal payments(you only have to delete code) answering Michael Schueri I use https and all the paypal security procedures to validate de IPN origin. So my code is rely simple, customizable and it has 10 times more lines of test code than the real one.. so I think it's well tested and secure to use! For a matter of fact I love railscasts and believe this is going a be a quality series that's why I'm frustrated, one month ago could have saved me lots of work. ;)

Report as Spam

12. Bryce Dec 22, 2008 at 17:55

Ooh, a Railscasts cliffhanger

Report as Spam

13. ae Dec 22, 2008 at 18:32

Thanks for this screencast, I'm all geared up now on my web site for next Christmas :)

To the PayPal basher above, you don't really know much about the internet do you?

When you submit a form, anyone submitting the form can change any of the values...its up to you as the merchant to make sure the order amount is correct before shipping it once you receive the payment in PayPal.

Clearly, only a fool would go ahead and ship $500 worth of stuff of which they only received $1.

@Ryan, sorry to even engage that guy...

Report as Spam

14. Mike Stramba Dec 22, 2008 at 20:35

Ryan,

Off topic, is there a way to download / clone just the episode-141 "tree" using git?

Learning git is almost as complex as Ruby / Rails :)

Otherwise a "git clone git://github.com/ryanb/railscasts-episodes.git" will clone all of the episodes.

Mike

Report as Spam

15. aman Dec 23, 2008 at 23:29

Hi,

can you please give a quick tip on how to add make a current navigation menu link standout from the others. e.g. if i want to make the background color change by appling a class on the current link, how to do it. Is there a way to achieve this without overly complecating stuff, as i just have couple of static links.

Report as Spam

16. ae Dec 24, 2008 at 23:24

@aman: http://pastie.org/346594

Report as Spam

17. Edgar G. Dec 26, 2008 at 12:07

This episode is useless as the data is sent over to Paypal using the unencrypted method.

Report as Spam

18. Memiux Dec 26, 2008 at 12:24

@Edgar G (18), It doesn't matters, there's not sensitive information

Report as Spam

19. Edgar G. Dec 27, 2008 at 06:09

@Memiux: yes it matters. If people start playing with the amount of money passed to Paypal, it will become a huge pain for the admin to track manually who has paid the correct amount and who didn't.

The potential cheaters can claim that they didn't do it on purpose.

Either use encrypted method or don't process online payment.

Report as Spam

20. Kelli Dec 27, 2008 at 12:28

Great screencast, Ryan. :)

@Edgar G. You must have missed the part about this being an introduction to payment processing with PayPal. As an introduction, it does a good job of illustrating how the system works. I'm sure Ryan will address some of the security issues later on in the series.

Report as Spam

21. Nico Orellana Dec 27, 2008 at 22:52

Awesome

Report as Spam

22. Arash Dec 28, 2008 at 04:27

This tutorial covers the basics. It is not meant to be a full, complete solution as mentioned in the beginning. I'm sure Ryan will add more in using Encrypted Payments and verifying things like Paypal IPN.

Report as Spam

23. Ryan Bates Dec 28, 2008 at 12:18

For those concerned about security and payment notification, I plan to address this in future episodes in this series. Stay tuned!

Report as Spam

24. web tasarım Nov 22, 2009 at 05:14

thanks you very very hell..

<a href="http://www.nettescil.com.tr" title="web tasarım" target="_blank">hosting</a> _-_

Report as Spam

25. artemave Dec 17, 2009 at 07:09

Before considering PayPal, consider this: http://blog.apparentsoft.com/business/124/is-paypal-good-for-your-microisv-business-a-short-paypal-horror-story/

Report as Spam

26. Bijan Rahnema Jan 24, 2010 at 08:12

If you want the Code to keep on working,
you have to add a currency code to the paypal_url function in the model:

eg:
:currency_code => 'EUR'

Report as Spam

27. uggs sale Jan 24, 2010 at 17:45

Very good post. I'm not at the point where I have enough unique visitors yet, but am book marking this for a month or two down the road.

Report as Spam

28. Gagan Feb 14, 2010 at 21:29

hi Ryan
Is there any method for Automated Recurring payment for paypal with Active merchant plugin?
If yes please post some helpful links.
thanks

Report as Spam

29. Marianka Feb 24, 2010 at 10:08

Super.

Report as Spam

30. nath Mar 25, 2010 at 13:53

Thanks Ryan for a great paypal introduction..

Report as Spam

31. 天书奇谈 Apr 18, 2010 at 22:57

Is there any method for Automated Recurring

Report as Spam

32. lefty May 23, 2010 at 07:36

First thanks a lot for this series on paypal, it helps me a lot.
I have tried to pass variable like 'shipping' or 'handling' for global cost but it seems it's ignored. On last resort i have passed the shipping value as a product line. Do you know why it's not working ? (plus if you could make an update about the new paypal developer section, i'm kinda lost there)

Report as Spam

33. hame Jun 06, 2010 at 20:23

<a href="http://www.androidsystem.org">android</a>

Report as Spam

34. hame Jun 06, 2010 at 20:26

http://www.androidsystem.org/androids.html

Report as Spam

35. fitness Jun 25, 2010 at 20:41

thank you very much to do this for us,that is very good.

Report as Spam

36. ecco sandals Jun 30, 2010 at 23:07

First thanks a lot for this series on paypal, it helps me a lot. but a coin has two sides.

Report as Spam

37. Jose Jul 01, 2010 at 01:04

With regards to the return_url, Shouldn't there be a parameter (eg. session_id) to reconnect to the same session?

Report as Spam

38. asics gel kinsei 2 Jul 02, 2010 at 19:52

In an eerie display of <a href="http://www.asics2u.com/onitsuka-tiger-ultimate-81-c-10.html">asics ultimate 81 </a>collective intuition, the individual choices<a href="http://www.asics2u.com/onitsuka-tiger-ultimate-81-c-10.html"> onitsuka tiger ultimate 81</a>of millions of voters contrived to <a href="http://www.asics2u.com/onitsuka-tiger-ultimate-81-c-10.html">asics onitsuka tiger ultimate 81</a> align perfectly the<a href="http://www.asics2u.com/onitsuka-tiger-ultimate-81-c-10.html"> asics tiger ultimate 81</a> parliamentary arithmetic with the angry <a href="http://www.asics2u.com/onitsuka-tiger-ultimate-81-c-10.html">ultimate 81 onitsuka tiger </a>ambivalence of the national mood. Mr. Cameron had <a href="http://www.asics2u.com/onitsuka-tiger-ultimate-81-c-10.html">ultimate 81 asics</a> done enough to secure the keys of 10 <a href="http://www.asics2u.com/onitsuka-tiger-california-78-c-16.html">onitsuka tiger california 78</a> Downing Street, the voters judged, but not <a href="http://www.asics2u.com/onitsuka-tiger-california-78-c-16.html">asics onitsuka tiger california 78</a> enough to be granted a free hand.
As the<a href="http://www.asics2u.com/onitsuka-tiger-california-78-c-16.html">onitsuka tiger california </a>prospect of days if not weeks, <a href="http://www.asics2u.com/onitsuka-tiger-california-78-c-16.html">asics california 78</a> of uncertainty, of the lack of a government, dawned on investors <a href="http://www.asics2u.com/onitsuka-tiger-california-78-c-16.html">asics tiger california 78</a> they responded in the only way they knew and dumped anything with a UK hallmark

Report as Spam

39. jerseys Jul 15, 2010 at 18:18

I’ve been following your website for 5 days now and I should tell you I get something new from your post. and now how do I subscribe to your website?

Report as Spam

40. puma shoes Jul 27, 2010 at 02:00

just so so

Report as Spam

41. buy office 2007 Jul 28, 2010 at 02:41

I’ve been following your website for 5 days now and I should tell you I get something new from your post. and now how do I subscribe to your website?

Report as Spam

42. sandals Aug 01, 2010 at 19:26

is article is very interesting. Thank you very much for sharing .

Report as Spam

47. china handy Aug 05, 2010 at 01:34

efox-shop the best place to buy dual SIM dual standby phone. The efox-shop service is good, and the full range, such as chinesische handy kaufen china handy kaufen Großhandel Handy Grosshandel Handy Großhandel Handys chinesische handy TV Handy Chinesische Handys welcome to purchase http://www.efox-shop.com <a href="http://www.efox-shop.com"target=blank>chinesische handy kaufen china handy tv handy Chinesische Handys</a>

Report as Spam

48. Body Exercise Machines Aug 19, 2010 at 02:00

We are now experiencing annual sales turnovers worth in excess of USD 5,000,000. Outputing around 100,000,000 fitness equipment annually, our scientific management and strict operating systems ensure that all items meet the standards required for export into countries worldwide.

Report as Spam

49. security seals Aug 19, 2010 at 02:01

And we have also being built a perfect company system with integration from R&D to production and marketing, which can provide various kinds of security seal products to the industry fields of railway, road, port, voyage, petroleum, chemical, electricity, post etc.

Report as Spam

50. wholesale new era caps Aug 20, 2010 at 20:50

That is an awfully astounding column you've posted.Thanks a lot for that a fantastically amazing post!

Report as Spam

51. air jordan retro 13 for sale Aug 20, 2010 at 22:45

Many thanks for all the great screencasts. I really enjoy watching the RailsCasts. I think type of site that is useful in sharing information and it is important to share. That is an awfully astounding column you've posted.

Report as Spam

52. louis vuitton shoes Aug 26, 2010 at 21:14

Thanks for sharing your article. I really enjoyed it. I put a link to my site to here so other people can read it. My readers have about the same interets

Report as Spam

53. Wholesale Electronics Aug 27, 2010 at 00:21

Discount Wholesale Electronics, Wholesale Cell Phones, Electronic Gadgets and More from the Best Dropship Wholesaler

Report as Spam

54. Discount NFL Jerseys Aug 29, 2010 at 07:56

Hi guys!! This is my first website by my self, and i confused that is it good or not<a href="http://www.sportsjerseysshop.com">cheap nfl jerseys</a> made by wordpress or Joomla, i want to choose one 4 me,and give me some advice.Thank you!
http://www.sportsjerseysshop.com/

Report as Spam

55. snow boots Aug 30, 2010 at 21:16

You kept my trust on you by giving long screencast.

Now again I am waiting eagerly for next monday.

Report as Spam

56. louis vuitton sunglasses Sep 01, 2010 at 21:15

Thanks for sharing your article. I really enjoyed it. I put a link to my site to here so other people can read it. My readers have about the same interets

Report as Spam

PayPal Basics

37 comments

Add your comment: