title: Not validating POST variables before sending to PayPal - when to check?
body: <p>We have a PHP system on which we're using Micah Carrick's "PHP Paypal IPN Integration Class" (http://www.micahcarrick.com/php-paypal-ipn-integration-class.html).</p>
  
  <p>In his sample code, he recommends that we verify POST variables before passing them onto PayPal</p>
  
  <pre><code>switch ($_GET['action']) {
  
     case 'process':      // Process and order...
  
  ... 
        // This is where you would have your form validation  and all that jazz.
        // You would take your POST vars and load them into the class like below,
        // only using the POST values instead of constant string expressions.
        // For example, after ensureing all the POST variables from your custom
        // order form are valid, you might have:
        //
        // $p-&gt;add_field('first_name', $_POST['first_name']);
        // $p-&gt;add_field('last_name', $_POST['last_name']);
  
  ... 
      $custom=$_SESSION['sess_user_id']."~".$_POST['promo_code'];
      $p-&gt;add_field('user_id', $_SESSION['sess_user_id']);
      $p-&gt;add_field('custom', $custom);
      $p-&gt;add_field('amount', $_POST['amount']);
  ...
      $p-&gt;submit_paypal_post(); // submit the fields to paypal
        break;
  </code></pre>
  
  <p>However, we're not doing that for the variables mentioned above. </p>
  
  <p>Should we verify at (a) this stage or at the stage that PayPal (b) returns the data or both? </p>
  
  <p>How should we be verifying the data as well?</p>