<FORM ACTION="https://www.paypal.com/cgi-bin/webscr" METHOD="POST">
<INPUT TYPE="hidden" NAME="cmd" VALUE="_xclick">
<INPUT TYPE="hidden" NAME="business" VALUE="*****@*****.com">
<INPUT TYPE="hidden" NAME="return" VALUE="http://www.*****.com/clients.php">

              <input type="hidden" name="currency_code" value="GBP">
<input type="hidden" NAME="notify_url" value="http://********.com/ipn.php">

<INPUT TYPE="hidden" NAME="item_name" VALUE="<?php echo (int)$pricing['searches']; ?> Searches">
<INPUT TYPE="hidden" NAME="item_number" VALUE="<?php echo $customer_id; ?>">
<INPUT TYPE="hidden" NAME="amount" VALUE="<?php echo number_format($pricing['price'], 2); ?>">
<INPUT TYPE="hidden" NAME="lc" VALUE="UK">
<input type="image" src="http://www.paypal.com/en_GB/i/btn/x-click-but01.gif" border="0" name="submit" alt="PayPal">
<img alt="" border="" width="1" height="1" src="https://www.paypal.com/en_US/i/scr/pixel.gif">
</FORM>

<?php


// set up variables for our own local settings
$account_owner = "*****@*****.com";
$headers = 'MIME-Version: 1.0' . "\r\n";
$headers .= 'Content-type: text/html; charset=utf-8' . "\r\n";
$headers .= "From: noreply@******.com";
$mail_To = "*****@*****.com";

//Build the data to post back to Paypal
$postback = 'cmd=_notify-validate';
// go through each of the posted vars and add them to the postback variable
foreach ($_POST as $key => $value) {
$value = urlencode(stripslashes($value));
$postback .= "&$key=$value";
}

// build the header string to post back to PayPal system to validate

$header = "POST /cgi-bin/webscr HTTP/1.0\r\n";
$header .= "Content-Type: application/x-www-form-urlencoded\r\n";
$header .= "Content-Length: " . strlen($postback) . "\r\n\r\n";

//$fp = fsockopen ('www.sandbox.paypal.com', 80, $errno, $errstr, 30);
$fp = fsockopen ('www.paypal.com', 80, $errno, $errstr, 30);


fputs ($fp, $header . $postback);//post the data back
while (!feof($fp))
{
$response = fgets ($fp, 1024);

if (strcmp ($response, "VERIFIED") == 0)
{//It's verified


// assign posted variables to local variables, apply urldecode to them all at this point as well, makes things simpler later
$txn_type = $_POST['txn_type'];//read the type of payment

$i=1;
while (isset($_POST['item_number'.$i]))//read the item details
{
$item_ID[$i]=$_POST['item_number'.$i];
$item_name[$i]=urldecode($_POST['item_name'.$i]);
$searches_purchased=$_POST['item_name1'];
$item_cost[$i]=$_POST['mc_gross_'.$i];
$i++;
}
$customer_id = $_POST['item_number1'];
$item_count = $i-1;
$quantity = $_POST['quantity1'];

$payment_status = $_POST['payment_status'];//read the payment details and the account holder
$payment_currency = $_POST['mc_currency'];
$payment_total = $_POST['mc_gross'];
$posted_account_owner = urldecode($_POST['receiver_email']);
$buyer_email = urldecode($_POST['payer_email']);//read the buyer details
$first_name = urldecode($_POST['first_name']);
$last_name = urldecode($_POST['last_name']);
$address_street = urldecode($_POST['address_street']);
$address_posttown = urldecode($_POST['address_city']);
$address_county = urldecode($_POST['address_state']);
$address_postcode = urldecode($_POST['address_zip']);


// checks if complete and from your pp account and in GBP
if(($payment_status == 'Completed') && //payment_status = Completed
($posted_account_owner == $account_owner) && //comes from the right account
($payment_currency == "GBP")) // and in the right currency
{

//Update the database as everything is fine.

  $host = "*******";
  $db_user    = "********";
  $db_pass    = "**********";
  $db_name = "**********";
 
  ini_set("display_errors", 0);

$db = mysql_connect($host, $db_user, $db_pass);
mysql_select_db($db_name, $db);

$query = "SELECT searches FROM sh_client WHERE id = ".$customer_id;

$result = mysql_query($query, $db);
    
    if($result){
    $row = mysql_fetch_assoc($result);
    $current_searches = (int)$row["searches"];
  }
        
    $new_searches = $current_searches + $searches_purchased;
        
    $query = "UPDATE sh_client SET searches = ".$new_searches." WHERE id = ".$customer_id;
    
    if(!mysql_query($query, $db)){
        echo mysql_error();
    }


}
}
fclose ($fp);
}
?>