实施 openssl 会阻止用户更改按钮值吗？
实施 openssl 会阻止用户更改按钮值吗？ 我研究了加密按钮，从托管到使用 openssl。 使用托管按钮将以灵活性为代价提供安全性，尽管您可以覆盖某些变量，但仍然无法覆盖重要的变量。
在我的网络服务器上使用和实现 openssl 会阻止用户更改非托管 paypal 按钮吗？
还是退回到托管按钮并使用 IPN 使用/验证会更好？
Would implementing openssl prevent users from changing the button values?
I've researched into encrypting buttons, from hosted to using openssl.
Using hosted buttons would provide security at the cost of flexibility although there are variables that you can override, but still you cant override the important ones.
would using and implementing openssl on my webserver prevent users from changing a non-hosted paypal button ?
or would it just be better to fall back to a hosted button and use/validate using IPN?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
我的答案是非 PayPal 特定的（适用于任何类型的 HTTP 表单输入），但简短的答案是否定的。即使 SSL 也无法阻止浏览器修改它收到的表单值。
用户可以在页面加载后使用 bookmarklet 在您的页面上执行她选择的 JavaScript 程序，它有能力改变表单值。因为 SSL 只保护浏览器和服务器之间的传输，而不是在浏览器处理页面之后保护，所以是否使用它没有任何区别。
这可以通过 Greasemonkey 自动化，这是相同的想法，除了使用户可以更轻松地安装其他人的 JavaScript 程序以在您的网页上运行。如上所述，使用 SSL 根本不会影响这一点，因为它都是在客户端执行的，作为服务器，您无法控制。
正如您提到的，使用加密的 PayPal 按钮可以解决该问题，因为对按钮参数的任何修改都会使校验和无效，并且 PayPal 不会接受该项目。
My answer is non–PayPal specific (applies to any kind of HTTP form input), but the short answer is no. Even SSL cannot prevent the browser from modifying the form values that it receives.
A user could use a bookmarklet to execute a JavaScript program of her choice on your page after it has loaded, which has the ability to change form values. Because SSL only protects the transport between the browser and the server, not after the page has been processed by the browser, it makes no difference at all whether you use it.
This could be automated with Greasemonkey, which is the same idea, except makes it even easier for users to install other people’s JavaScript programs to run on your web page. As above, using SSL does not affect this at all, because it is all execute client side, which you, as the server, have no control over.
As you alluded to, using encrypted PayPal buttons would solve the problem, as any modification of the button parameters would invalidate the checksum, and PayPal would not accept the item.
最好的解决方案是使用快速结帐。这为您提供了比标准按钮更大的灵活性。
如果您正在考虑是否进行 IPN，那么您可能有足够的能力集成 Express Checkout。它实际上只是 1 个 API 调用，然后重定向到 PayPal，以及至少 1 个 API 调用来完成付款。
典型的流程如下所示：
要开始使用此功能，我建议查看他们提供的 PHP NVP SDK https://www.x.com/community/ppx/sdks#NVP
The best solution would be using Express Checkout. This allows you a great deal more flexibility than standard buttons can ever offer you.
If you're thinking if doing IPN, you're probably capable enough to integrate Express Checkout. All it really is, is 1 API call, followed by a redirect to PayPal, and a minimum of 1 more API call to finalize the payment.
A typical flow would look as follows:
To get started with this, I'd suggest taking a looking at the PHP NVP SDK they offer at https://www.x.com/community/ppx/sdks#NVP