php-ip | IPv4/IPv6 manipulation library for PHP | TCP library

So I found the answer here:

https://developer.paypal.com/docs/api-basics/notifications/ipn/IPNSetup/#setting-up-ipn-notifications-on-paypal

To start receiving IPN messages, enter the notification URL and select Receive IPN messages below. PayPal continues to generate and store IPN messages until you select Receive IPN messages again (or turn off IPN).

What you are doing misunderstands the way IPN works.

IPN is a direct post from PayPal to your server, and does not, cannot, and should not directly involve the client's web browser or thank you page in any way.

Your IPN listener should update your database to mark an order as paid.

Your thank you page can read from the database.

These are asynchronous operations.

For a more robust solution, forget about using IPN and instead integrate a front-end checkout UI like https://developer.paypal.com/demo/checkout/#/pattern/server , which will call 2 routes on your server (which you must create) to 'Set Up Transaction' and 'Capture Transaction', each of which will communicate with the PayPal API as documented here: https://developer.paypal.com/docs/checkout/reference/server-integration/

The presented method is not completely secure.

PHP acts as a text preprocessor, which means that in the event of a web server gateway error, the script content can be sent with the mime-type text/html, which is a risk of revealing sensitive data such as passwords to SQL database or (s)ftp accounts.

Administrative scripts placed in public also carry the risk of their unauthorized execution if the IP address controlled in the script was a shared (or dynamically transmitted) address. Cron scripts are executed using php-cli, therefore the web server gateway is not needed for anything and IP analysis in the script becomes unnecessary if it is outside the public directory.

Remote execution using e.g. curl could be the only reason for placing administrative scripts in the public space of the www server. This is usually a weak solution because then the script performs the php interpreter (and not php-cli) with other settings, usually with drastically limited execution time. However, if it is for some reason necessary it should be in a separate directory to which access is limited to specific IP addresses using .htaccess (and/or .iptables) and with assigned username and password by using htpasswd (Basic Auth).

The ideal situation is when the public directory of the www server (hereinafter referred to as public) contains only static content (img, css, js ... files) and the application trigger located in the parent directory. Example structure is: