title: Working example of paypal Website Payments Pro Hosted Solution Iframe?
body: <p>I am looking to use use paypals <a href="https://www.x.com/developers/paypal/products/website-payments-pro-hosted-solution" rel="nofollow">Website Payments Pro Hosted Solution</a> so we can accept payments through paypal without our users feeling like they are leaving the site and without us having to be PCI compliant.</p>
  
  <p>We are wanting this to work in this format:</p>
  
  <ul>
  <li>user hits buy page for an item and selects quantity and hits <em>buy now</em> button</li>
  <li>AJAX request is sent to server to validate quantity/calculate total etc</li>
  <li>AJAX request returns url for iframe</li>
  <li>Iframe is populated with the page, then once it has finished loading the iframe is shown</li>
  <li>User fills in credit card details and paypal completes the transaction</li>
  <li>The success page which paypal redirects the iframe to calls some javascript in the parent page to redirect to another url.</li>
  </ul>
  
  <p>So,
  I have the quantity select page,<br>
  I know how to send the data to the server and validate quantity/calculate total</p>
  
  <p>What I don't know how to do is from this point send the request to paypal to get the url for the iframe.</p>
  
  <p>What I have tried doing (as a very basic standalone example) is:</p>
  
  <pre><code>&lt;?php
  
  class paypal {
  
      private $APIuser;
      private $APIpass;
      private $APIsign;
      private $APIvers = '74.0';  
      private $APIaddr = 'https://api-3t.sandbox.paypal.com/nvp';
      private $post_params = array();
  
      function __construct($APIuser, $APIpass, $APIsign){
          $this-&gt;APIuser = $APIuser;
          $this-&gt;APIpass = $APIpass;
          $this-&gt;APIsign = $APIsign;
      }
  
      function param($name, $value = null){
          $this-&gt;post_params[$name] = $value;
          return $this;
      }
  
      function getUrl(){
  
          $post = $this-&gt;post_params;
          $post['pwd']        = $this-&gt;APIpass;
          $post['user']       = $this-&gt;APIuser;
          $post['method']     = 'BMCreateButton';
          $post['version']    = $this-&gt;APIvers;
          $post['signature']  = $this-&gt;APIsign;
          $post['buttoncode'] = 'CLEARTEXT';
          $post['buttontype'] = 'PAYMENT';
  
          $post_string = '?';
          foreach($post as $k =&gt; $v)
              $post_string .= $k.'='.urlencode($v).'&amp;';
  
          $post_string = substr($post_string, 0, -1);
  
          $ch = curl_init();
          curl_setopt($ch, CURLOPT_URL, $this-&gt;APIaddr.$post_string);
          curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
          curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
          $out = curl_exec($ch);
          curl_close($ch);
  
          $out = explode('&amp;', $out);
          $final = array();
          foreach($out as $k =&gt; &amp;$v){
              $v = explode('=', $v);
              $final[$v[0]] = urldecode($v[1]);
          }
          return $final;
      }
  }
  
  //mock variables
  $price = 10.00;
  $APIu  = 'xxxxxxxxxx';
  $APIp  = 'xxxxxxxxxx';
  $APIs  = 'xxxxxxxxxx';  
  
  
  $paypal = new paypal($APIu, $APIp, $APIs);
  $paypal-&gt;param('L_BUTTONVAR0=subtotal', $price*$_GET['quantity']);
  $paypal-&gt;param('L_BUTTONVAR1=template', 'templateD');
  $resp = $paypal-&gt;getUrl();
  ?&gt;
  &lt;iframe width="100%" height=100%" src="&lt;?php echo $resp['EMAILLINK']; ?&gt;"&gt;&lt;/iframe&gt;
  </code></pre>
  
  <p>Which at first seems to work fine, until you enter your test buyers credit card details and get hit with</p>
  
  <blockquote>
    <p>Please return to the payment page and correct the address.</p>
  </blockquote>
  
  <p>What am I doing wrong/ what do I need to make this work?</p>