To enable HTTPS I would need second Static IP, which is 3$ a month (which is not much), but again, it is additional cost for me, that I would rather not have.
You don't need a second static IP. Server Name Indication (SNI) has been a thing for quite some years now, and all modern clients supports it, including all major browsers.
Let's try looking at this using threat modeling techniques.
What are we trying to protect?
Client logs for later analysis by support.
What is our risk?
If a client-side handler breaks and is stored on the client side, what could this lead to? Are we looking at having a local command execution, log injection, etc.? It is essential to understand what the ...
This is the reason that Paypal has the IPN. One of the values sent in the IPN message from Paypal to your server is the transaction amount. If the client were to manipulate the transaction amount the way that you described, you would be able to detect this in your IPN listener script, and cancel the order. See https://developer.paypal.com/docs/api-basics/...
You don't send the request from the client to PayPal. You send the request to your server, and your server sends the request to PayPal.
Never ever trust the client. It's trivial to change the data from the client. The price you show the client is only informative, the authoritative price is from your server.
It's like a grocery store: the price tag is ...
EDIT: Add a complete process example.
(it can be done in several way this is just one way an example to show the process)
The user arrive to your website and want to buy an item. This item must have a record in your database, with a unique ID.
When the user click the "buy" button the server prepare a payment request, and store it in the database ...