I have been thinking about buying a ready-made PHP script (i.e. a web application) that provides a specific functionality. Say, for example one of these sold by Agriya:
The concern I have about these is, how to evaluate the security of this type of script. Not only is there a concern about whether "lousy programming" may have introduced bugs but also if some back-door has been intentionally added by the vendor.
Mainly my concern is around payment safety, as the website would be accepting payments through either credit card or PayPal.
Is the only option to just "not buy it if I cannot trust the software vendor", or are there some things that can be done (specific questions to ask, things to check for, etc) to minimize the risks? Is it expensive to have this type of scripts checked by some third party?