Paypal says that protected payment buttons are more secure as they cannot be altered by malicious third parties. I'm trying to figure out what they are supposed to protect against. If the attacker has gained access to your website and can edit your source files, wouldn't they just replace it with their own Paypal button, instead of trying to edit parameters?

1 Answer 1


Protected payment button encrypts the payment amount and item details, in such way that your users won't be able to pay for that item but with different payment amount. When using regular pay button, as a vendor you have to check that the amount paid matches your own price list for the item before processing the order, this is because your user can change the payment amount.

  • 1
    Ah, fair enough. I'm using a button for donations, so this doesn't matter.
    – Casebash
    Commented Jan 1, 2016 at 13:16
  • @Casebash. It still means that people can modify the amount, which means they could alter it to be below your minimum fee, meaning that unless PayPal specifically disallows that, you will lose money.
    – Patanjali
    Commented Jun 9, 2019 at 4:38
  • For protected buttons, there are only two hidden fields, being cmd=_s-xclick and hosted_button_id=XXXXXXXXXXXXX, the latter being a unique 13 character code. No other identifying info, so easy to set up manually.
    – Patanjali
    Commented Jun 9, 2019 at 7:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .