Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am working on a project that incorporates real money into peoples accounts. Their accounts are stored in a MySQL database and inside it there is a column called "BALANCE".

When the users send money through PayPal, the PayPal api will do a callback to my server which will credit that users Balance with whatever they sent through PayPal.

The problem is, I plan on making the altering users balance part only accessible by my application. The way the balance is updated is by the URL just setting the method as a GET and setting the amount to whatever and it credits the balance.

I do not want people to just be able to visit that callback URL and keep updating their balance fraudulently.

What security would I be able to put in place that will only let legitimate balance changes occur?

Sorry if I didn't explain this too well. If anyone has questions, I'll try and explain it better. Thanks.

share|improve this question
Don't take this the wrong way, but this is one of those "if you need to ask, you shouldn't be building it" questions. – Lucas Kauffman Jun 16 '14 at 8:29
Have you actually looked at the PayPal documentation? I'm pretty sure if you look at the docs/example code when you receive a callback you're suppose to make a request to PayPal and verify the transaction. – thexacre Jun 16 '14 at 8:33

I'll second Lucas's view that you should probably find someone more experienced than you to do this (you should find someone more experienced than me as well). That said, I'll attempt to answer your question.

The PayPal API should provide a transaction ID or some other unique value. Record that in your transaction log (you do have one, don't you?); if you see that value in a later transaction, you know the transaction isn't valid. Record the invalid transaction in your audit log (you've got one of those as well, right?) and ignore it.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.