How can I prevent users from overriding the total cost in a shopping cart, when submitted as a hidden input field?

Question

I'm having serious problems with accepting payments.

I'm passing the total amount in a hidden field

<input type="hidden"
  name="checkout-flow-support.merchant-checkout-flow-support.shipping-methods.flat-rate-shipping-1.price"
  value="129.00"/>

Some of the users changed this value to 2 using firebug and submitted the form. Instead of getting $129, we only received $2.

I have no idea how to proceed this anyone help me quick .

Answer 1

im passing the total amount in a hidden field

Don't do this!

Since you know what items the user is attempting to purchase, calculate the cost server side.

Answer 2

This is a textbook error, analogous to asking a customer at a brick-and-mortar store how much the item costs and trusting that response. It is a special case of the general security principle: don't trust the client. Hobodave's answer is correct; calculate prices, taxes, etc. server-side.

Answer 3

With Payment Service Providers (PSPs), the general communication setup typically goes something like:

1) Your server contacts the PSP and sets up the transaction, specifying the amount required and your PSP account details.

2) The PSP responds with a transaction identifier, which you then add to the form. This transaction identifier holds no information about the prices involved - it's simply an identifier to the transaction record your server set up with the PSP.

3) Visitor fills out form which is sent off to the PSP. They then redirect the visitor back to your site.

4) Your server queries the PSP server and checks that the transaction succeeded (ie. the visitors payment method OK'd the transaction with the PSP, etc)

The server-to-PSP communication is typically done using a library such as curl.

Google provide a number of libraries / examples on how to correctly process transactions (and most other PSPs do the same, in my experience): http://code.google.com/apis/checkout/samplecode.html

The exact communication details may vary depending on the PSP, but basically there should not be any need to have the "total amount" ever go through the form displayed to the visitor. It's all done server-to-server so that the visitor cannot possibly change the details.