I am working on a project that incorporates real money into peoples accounts. Their accounts are stored in a MySQL database and inside it there is a column called "BALANCE".
When the users send money through PayPal, the PayPal api will do a callback to my server which will credit that users Balance with whatever they sent through PayPal.
The problem is, I plan on making the altering users balance part only accessible by my application. The way the balance is updated is by the URL just setting the method as a GET and setting the amount to whatever and it credits the balance.
I do not want people to just be able to visit that callback URL and keep updating their balance fraudulently.
What security would I be able to put in place that will only let legitimate balance changes occur?
Sorry if I didn't explain this too well. If anyone has questions, I'll try and explain it better. Thanks.