Is this Paypal setup secure?

Question

I just wanted to run this by other heads to make sure I wasn't missing something obvious. I am using Payflow Link, which handles all the credit card nastiness of ecommerce transactions. However, you pass the total amount of the transaction to PayPal over POST variables - which seems like a potential security hole:

1. A malicious user could load up his cart and proceed to checkout
2. By reading the hidden input fields, he could spoof the POST to PayPal with a total amount of 1 cent.
3. Paypal would executes the transaction, calls my order logging script, which would log the transaction and mark his items for shipment.

I could check total amount against his cart by accessing the database, pulling his cart items, and re-totaling their prices plus shipping and tax. But that is a lot of heavy lifting just to check for tampering (multiple DB queries, plus 2 web service calls per item to get shipping and tax).

My idea:

1. PayPal is sent the normal POST variables for the amount
2. But then, in the user defined variables (which get forwarded to my logging script), store a sha1 hash of the total amount, plus some private key
3. On the other side, the logging script rehashes the dollar amount, plus the same private key, and compares to the hash sent through.
4. Differences between the sent hash and computed hash would indicate tampering, and the order would be red-flagged for human review.

Does this make sense? Am I missing something?

edit (for clarification):

Apparently I wasn't making my point clear, based on the first several responses. I realize this isn't an ideal setup. I know other companies offer similar or possibly even better services. I know I have to check the variables and I can't simply trust them. Please, if you are going to reply, all I am looking for in an answer is this:

Can anyone demonstrate a single vulnerability with my proposal that would allow a malicious user to alter the PayPal variables and go undetected?

It is a very straightforward question. That is all I am looking for. To anyone who can answer that, thank you in advance for you time and help!

Answer 1

You need to do a manual check after IPN for the calculated amount using your DB details and then verify it with the amount paid in PayPal. There is really no other option and I strongly suggest you do this or users will try and game the system.

You can use this guide to encrypt your PayPal variables:

http://dev.juokaz.com/php/paypal-payment-with-encryption

Answer 2

I've seen such hacking with my own eyes. Some dude bought a $500 gift card for like $1. We quickly added code that compares order totals from IPN to our own data and marks the order as suspicious when they do not match.

Payflow Link description says: "You decide whether or not to settle the transaction". So you must check if the amount is correct every time.

Answer 3

One potential problem I can see is using the same salt every time when generating the SHA-1 hash. If you use the same salt every time, the attacker could very easily determine the hash for $0.99 (or some other low amount) and then substitute that in for any transaction they want to pay $0.99 for.

Edit: Obviously this problem holds if you come up with some algorithm for determining a salt. If that algorithm is broken somehow, your attacker could exploit that as well.