Integrating PayPal's shopping cart with GetSimple

[hameau]

I'm not sure I understand what you are asking. Everything in the tutorial conforms to PayPal's requirements.

Yes, I understand that your method dynamically produces the PayPal form, which is indeed one of the methods outlined by PayPal.

The problem (if it is a problem – hence my question) is that all the form data is in the page source code, including the PayPal account holder's email address and the price. PayPal mentions this in the Integration Guide:

Unprotected and non-encrypted buttons that are not saved in your PayPal account are in plain text in the source view of your webpages. The HTML button code for your payment buttons can be viewed by anyone. A malicious third party could copy a page, change button HTML variables such as price, and make fraudulent payments.

IMPORTANT: Merchants with significant payment volume are required to take precautions on securing PayPal Payment Standard buttons.

They are not specific about 'significant payment volume'.

Using these simple PayPal buttons, nothing is encrypted – the form data is available on the page, and in transmission, in clear text.

The alternatives are to either create the buttons using PayPal's tools (the link that you included in your post) or generate buttons dynamically with encryption. The first is okay for a limited range of products that don't change rapidly. The latter solution requires integrating into the website CMS code. Both of these solutions do indeed encrypt the form data and most of it is contained in a single encrypted blob.

Edit to correct: with a hosted button, just the button ID is passed in the form data. I don't know exactly how the dynamic encrypted buttons are handled (though I'm fairly sure they use an encrypted blob).

I am currently using a long text field in a Special Pages page to store the button code (created on the PayPal site), but the inspiration came from your guide – thanks!