Vengala Vinay

Having 12+ Years of Experience in Software Development

Home » How to securely integrate PayPal Checkout REST endpoints into WordPress custom plugins using WordPress Database Class ($wpdb)

How to securely integrate PayPal Checkout REST endpoints into WordPress custom plugins using WordPress Database Class ($wpdb)

Setting Up Your PayPal Developer Environment

Before you can integrate PayPal Checkout REST endpoints into your WordPress custom plugin, you need a functional PayPal Developer account and a set of API credentials. This involves creating a REST API application within the PayPal Developer Dashboard. Navigate to your applications, log in, and create a new REST API app. This will provide you with a Client ID and a Secret. These credentials are crucial for authenticating your API requests.

For development and testing purposes, it is highly recommended to use PayPal’s Sandbox environment. This allows you to simulate transactions without using real money. The Sandbox provides separate API endpoints and test accounts (buyer and seller) that mimic the behavior of the live PayPal system. You can create and manage these test accounts directly from the PayPal Developer Dashboard.

Storing PayPal Credentials Securely in WordPress

Storing sensitive API credentials directly within your plugin’s code is a significant security risk. A more secure approach is to leverage WordPress’s built-in options API or a custom database table. For this guide, we’ll focus on using the WordPress options API, which is generally sufficient for storing API keys. We’ll create settings fields in the WordPress admin area where you can input your PayPal Client ID and Secret.

To add these settings, you’ll typically hook into the `admin_menu` action to register a new settings page and the `admin_init` action to register your settings and their fields. This ensures that your credentials are not hardcoded and can be managed through the WordPress admin interface.

Registering Admin Settings

The following PHP code snippet demonstrates how to register a settings page under the “Settings” menu and define fields for your PayPal Client ID and Secret. Place this code within your custom plugin’s main PHP file or an included file.

add_action('admin_menu', 'my_paypal_plugin_menu');
add_action('admin_init', 'my_paypal_plugin_settings');

function my_paypal_plugin_menu() {
    add_options_page(
        'PayPal Checkout Settings',
        'PayPal Checkout',
        'manage_options',
        'my-paypal-checkout',
        'my_paypal_plugin_options_page'
    );
}

function my_paypal_plugin_settings() {
    register_setting('my_paypal_options_group', 'my_paypal_client_id');
    register_setting('my_paypal_options_group', 'my_paypal_client_secret');
    register_setting('my_paypal_options_group', 'my_paypal_mode'); // 'sandbox' or 'live'

    add_settings_section(
        'my_paypal_section',
        'PayPal API Credentials',
        'my_paypal_section_callback',
        'my-paypal-checkout'
    );

    add_settings_field(
        'my_paypal_client_id_field',
        'PayPal Client ID',
        'my_paypal_client_id_render',
        'my-paypal-checkout',
        'my_paypal_section'
    );

    add_settings_field(
        'my_paypal_client_secret_field',
        'PayPal Client Secret',
        'my_paypal_client_secret_render',
        'my-paypal-checkout',
        'my_paypal_section'
    );

    add_settings_field(
        'my_paypal_mode_field',
        'PayPal Mode',
        'my_paypal_mode_render',
        'my-paypal-checkout',
        'my_paypal_section'
    );
}

function my_paypal_section_callback() {
    echo '
Enter your PayPal API credentials and select the mode.
';
}

function my_paypal_client_id_render() {
    $client_id = get_option('my_paypal_client_id', '');
    echo '<input type="text" name="my_paypal_client_id" value="' . esc_attr($client_id) . '" class="regular-text" />';
}

function my_paypal_client_secret_render() {
    $client_secret = get_option('my_paypal_client_secret', '');
    echo '<input type="password" name="my_paypal_client_secret" value="' . esc_attr($client_secret) . '" class="regular-text" />';
}

function my_paypal_mode_render() {
    $mode = get_option('my_paypal_mode', 'sandbox');
    echo '<select name="my_paypal_mode">';
    echo '<option value="sandbox" ' . selected($mode, 'sandbox', false) . '>Sandbox</option>';
    echo '<option value="live" ' . selected($mode, 'live', false) . '>Live</option>';
    echo '</select>';
}

function my_paypal_plugin_options_page() {
    ?>
    <div class="wrap">
        <h1>PayPal Checkout Settings</h1>
        <form action="options.php" method="post">
            <?php
            settings_fields('my_paypal_options_group');
            do_settings_sections('my-paypal-checkout');
            submit_button();
            ?>
        </form>
    </div>
    <?php
}

Interacting with PayPal REST API Endpoints

To interact with PayPal’s REST API, you’ll need to make HTTP requests. The most common endpoints for checkout are for creating orders and capturing payments. We’ll use PHP’s cURL extension for making these requests. It’s essential to handle API responses, including errors, gracefully.

Obtaining an Access Token

Before you can make calls to most PayPal API endpoints, you need to obtain an access token. This is done by making a POST request to the PayPal OAuth 2.0 token endpoint. The request requires basic authentication using your Client ID and Secret.

function get_paypal_access_token() {
    $client_id = get_option('my_paypal_client_id');
    $client_secret = get_option('my_paypal_client_secret');
    $mode = get_option('my_paypal_mode', 'sandbox');

    if (empty($client_id) || empty($client_secret)) {
        error_log('PayPal API credentials are not set.');
        return false;
    }

    $api_url = ($mode === 'sandbox')
        ? 'https://api.sandbox.paypal.com/v1/oauth2/token'
        : 'https://api.paypal.com/v1/oauth2/token';

    $ch = curl_init();
    curl_setopt($ch, CURLOPT_URL, $api_url);
    curl_setopt($ch, CURLOPT_POST, 1);
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
    curl_setopt($ch, CURLOPT_USERPWD, $client_id . ':' . $client_secret);
    curl_setopt($ch, CURLOPT_POSTFIELDS, 'grant_type=client_credentials');
    curl_setopt($ch, CURLOPT_HTTPHEADER, array(
        'Accept: application/json',
        'Accept-Language: en_US'
    ));

    $response = curl_exec($ch);
    $http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
    curl_close($ch);

    if ($http_code !== 200) {
        error_log('PayPal API Error (Token): ' . $response);
        return false;
    }

    $token_data = json_decode($response, true);
    return $token_data['access_token'] ?? false;
}

Creating a PayPal Order

Once you have an access token, you can create an order. This involves sending a POST request to the `/v2/checkout/orders` endpoint with the order details, including the purchase units and amount. The response will contain an order ID that you’ll use later to capture the payment.

function create_paypal_order($amount, $currency = 'USD') {
    $access_token = get_paypal_access_token();
    if (!$access_token) {
        return false;
    }

    $mode = get_option('my_paypal_mode', 'sandbox');
    $api_url = ($mode === 'sandbox')
        ? 'https://api.sandbox.paypal.com/v2/checkout/orders'
        : 'https://api.paypal.com/v2/checkout/orders';

    $order_data = array(
        'intent' => 'CAPTURE',
        'purchase_units' => array(
            array(
                'amount' => array(
                    'value' => number_format($amount, 2, '.', ''),
                    'currency_code' => $currency
                )
            )
        ),
        'application_context' => array(
            'return_url' => admin_url('admin-ajax.php?action=paypal_return'), // Example return URL
            'cancel_url' => admin_url('admin-ajax.php?action=paypal_cancel')  // Example cancel URL
        )
    );

    $ch = curl_init();
    curl_setopt($ch, CURLOPT_URL, $api_url);
    curl_setopt($ch, CURLOPT_POST, 1);
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
    curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($order_data));
    curl_setopt($ch, CURLOPT_HTTPHEADER, array(
        'Content-Type: application/json',
        'Authorization: Bearer ' . $access_token
    ));

    $response = curl_exec($ch);
    $http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
    curl_close($ch);

    if ($http_code !== 201) {
        error_log('PayPal API Error (Create Order): ' . $response);
        return false;
    }

    $order_details = json_decode($response, true);
    return $order_details['id'] ?? false; // Return the order ID
}

Capturing a PayPal Payment

After the user approves the payment in PayPal, you need to capture the funds. This is done by sending a POST request to the `/v2/checkout/orders/{order_id}/capture` endpoint. This action finalizes the transaction and transfers the money to your PayPal account.

function capture_paypal_payment($order_id) {
    $access_token = get_paypal_access_token();
    if (!$access_token) {
        return false;
    }

    $mode = get_option('my_paypal_mode', 'sandbox');
    $api_url = ($mode === 'sandbox')
        ? 'https://api.sandbox.paypal.com/v2/checkout/orders/' . $order_id . '/capture'
        : 'https://api.paypal.com/v2/checkout/orders/' . $order_id . '/capture';

    $ch = curl_init();
    curl_setopt($ch, CURLOPT_URL, $api_url);
    curl_setopt($ch, CURLOPT_POST, 1);
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
    curl_setopt($ch, CURLOPT_POSTFIELDS, '{}'); // Empty JSON body for capture
    curl_setopt($ch, CURLOPT_HTTPHEADER, array(
        'Content-Type: application/json',
        'Authorization: Bearer ' . $access_token
    ));

    $response = curl_exec($ch);
    $http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
    curl_close($ch);

    if ($http_code !== 200) {
        error_log('PayPal API Error (Capture Payment): ' . $response);
        return false;
    }

    $capture_details = json_decode($response, true);
    return $capture_details; // Return full capture details
}

Integrating with WordPress Database Class ($wpdb)

After a successful payment capture, you’ll want to record the transaction details in your WordPress database. This is where the global `$wpdb` object comes in handy. You can use it to insert, update, or query data from your custom tables or WordPress’s built-in tables.

Creating a Custom Table for Transactions

For robust transaction tracking, it’s best to create a custom database table. This table can store details like the PayPal order ID, transaction ID, amount, currency, status, and timestamps. You can create this table upon plugin activation.

// In your plugin's main file or an activation hook
global $wpdb;
$table_name = $wpdb->prefix . 'paypal_transactions';
$charset_collate = $wpdb->get_charset_collate();

$sql = "CREATE TABLE $table_name (
    id mediumint(9) NOT NULL AUTO_INCREMENT,
    paypal_order_id varchar(255) NOT NULL,
    paypal_transaction_id varchar(255) DEFAULT NULL,
    amount decimal(10,2) NOT NULL,
    currency_code varchar(3) NOT NULL,
    status varchar(50) NOT NULL,
    created_at datetime DEFAULT CURRENT_TIMESTAMP,
    updated_at datetime DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
    PRIMARY KEY  (id),
    UNIQUE KEY paypal_order_id (paypal_order_id)
) $charset_collate;";

require_once( ABSPATH . 'wp-admin/includes/upgrade.php' );
dbDelta( $sql );

Saving Transaction Data

After successfully capturing a PayPal payment, you can use `$wpdb` to insert the transaction details into your custom table. This should be done within the AJAX handler or callback function that processes the payment capture.

// Assuming this is within an AJAX handler after successful capture_paypal_payment()
function handle_paypal_payment_capture() {
    if (!isset($_POST['order_id'])) {
        wp_send_json_error('Missing order ID.');
    }

    $order_id = sanitize_text_field($_POST['order_id']);
    $capture_details = capture_paypal_payment($order_id);

    if ($capture_details && isset($capture_details['status']) && $capture_details['status'] === 'COMPLETED') {
        global $wpdb;
        $table_name = $wpdb->prefix . 'paypal_transactions';

        $paypal_transaction_id = $capture_details['id'];
        $amount = $capture_details['purchase_units'][0]['amount']['value'];
        $currency_code = $capture_details['purchase_units'][0]['amount']['currency_code'];
        $status = $capture_details['status'];

        $wpdb->insert(
            $table_name,
            array(
                'paypal_order_id' => $order_id,
                'paypal_transaction_id' => $paypal_transaction_id,
                'amount' => $amount,
                'currency_code' => $currency_code,
                'status' => $status
            ),
            array('%s', '%s', '%f', '%s', '%s')
        );

        if ($wpdb->last_error) {
            error_log('Database Error saving PayPal transaction: ' . $wpdb->last_error);
            wp_send_json_error('Failed to save transaction details.');
        } else {
            // Optionally, update order status in WordPress posts, user meta, etc.
            wp_send_json_success('Payment captured and transaction recorded.');
        }
    } else {
        wp_send_json_error('PayPal payment capture failed or was not completed.');
    }
}
add_action('wp_ajax_paypal_capture', 'handle_paypal_payment_capture'); // For logged-in users
add_action('wp_ajax_nopriv_paypal_capture', 'handle_paypal_payment_capture'); // For non-logged-in users

Retrieving Transaction Data

You can retrieve transaction data for reporting or order fulfillment purposes using `$wpdb`’s `get_results`, `get_row`, or `get_var` methods. Always sanitize any user-provided input used in your queries to prevent SQL injection.

function get_transaction_by_order_id($order_id) {
    global $wpdb;
    $table_name = $wpdb->prefix . 'paypal_transactions';

    $order_id = sanitize_text_field($order_id);

    $transaction = $wpdb->get_row(
        $wpdb->prepare(
            "SELECT * FROM $table_name WHERE paypal_order_id = %s",
            $order_id
        )
    );

    return $transaction;
}

// Example usage:
// $transaction_data = get_transaction_by_order_id('YOUR_PAYPAL_ORDER_ID');
// if ($transaction_data) {
//     // Process transaction data
// }

Frontend Integration and AJAX Handling

The PayPal Checkout JavaScript SDK needs to be enqueued on your frontend. You’ll use AJAX to communicate between your frontend JavaScript and your WordPress backend (PHP functions) to create orders and capture payments. This involves setting up AJAX actions in WordPress.

Enqueuing PayPal SDK and AJAX Scripts

function my_paypal_enqueue_scripts() {
    // Enqueue PayPal SDK
    wp_enqueue_script('paypal-sdk', 'https://www.paypal.com/sdk/js?client-id=' . get_option('my_paypal_client_id') . '¤cy=' . urlencode(get_option('my_paypal_currency', 'USD')), array(), null, true);

    // Enqueue your custom script for PayPal integration
    wp_enqueue_script('my-paypal-checkout-script', plugin_dir_url(__FILE__) . 'js/paypal-checkout.js', array('paypal-sdk'), '1.0', true);

    // Localize script to pass AJAX URL and nonce
    wp_localize_script('my-paypal-checkout-script', 'my_paypal_ajax_object', array(
        'ajax_url' => admin_url('admin-ajax.php'),
        'nonce' => wp_create_nonce('my_paypal_nonce')
    ));
}
add_action('wp_enqueue_scripts', 'my_paypal_enqueue_scripts');

Frontend JavaScript (paypal-checkout.js)

This JavaScript file will contain the logic to render the PayPal buttons and handle the order creation and capture process via AJAX calls to your WordPress backend.

// paypal-checkout.js

document.addEventListener('DOMContentLoaded', function() {
    const paypalButtonContainer = document.getElementById('paypal-button-container');

    if (paypalButtonContainer) {
        paypal.Buttons({
            createOrder: function(data, actions) {
                // Make an AJAX call to your WordPress backend to create the order
                return fetch(my_paypal_ajax_object.ajax_url, {
                    method: 'post',
                    headers: {
                        'content-type': 'application/json'
                    },
                    body: JSON.stringify({
                        action: 'paypal_create_order', // WordPress AJAX action
                        _ajax_nonce: my_paypal_ajax_object.nonce,
                        amount: paypalButtonContainer.dataset.amount // Get amount from data attribute
                    })
                })
                .then(function(res) {
                    return res.json();
                })
                .then(function(orderData) {
                    if (orderData.success && orderData.data.orderID) {
                        return orderData.data.orderID; // Return the PayPal Order ID
                    } else {
                        console.error('Error creating PayPal order:', orderData.data.message);
                        alert('Error creating order. Please try again.');
                        return Promise.reject();
                    }
                });
            },
            onApprove: function(data, actions) {
                // Make an AJAX call to your WordPress backend to capture the payment
                return fetch(my_paypal_ajax_object.ajax_url, {
                    method: 'post',
                    headers: {
                        'content-type': 'application/json'
                    },
                    body: JSON.stringify({
                        action: 'paypal_capture', // WordPress AJAX action
                        _ajax_nonce: my_paypal_ajax_object.nonce,
                        order_id: data.orderID // The PayPal Order ID
                    })
                })
                .then(function(res) {
                    return res.json();
                })
                .then(function(captureData) {
                    if (captureData.success) {
                        alert('Payment successful! Your transaction ID is: ' + captureData.data.paypal_transaction_id);
                        // Redirect or show success message
                        window.location.href = '/payment-success/'; // Example redirect
                    } else {
                        console.error('Error capturing PayPal payment:', captureData.data);
                        alert('Payment capture failed. Please contact support.');
                    }
                });
            },
            onCancel: function(data) {
                console.log('PayPal payment cancelled:', data);
                alert('You have cancelled the payment.');
                // Handle cancellation, e.g., redirect to a cancel page
            },
            onError: function(err) {
                console.error('PayPal SDK Error:', err);
                alert('An error occurred with PayPal. Please try again.');
            }
        }).render('#paypal-button-container');
    }
});

Backend AJAX Handlers

You need corresponding PHP functions hooked to `wp_ajax_paypal_create_order` and `wp_ajax_paypal_capture` to handle the requests from your frontend JavaScript. The `paypal_capture` handler is already shown above. Here’s the `paypal_create_order` handler.

function handle_paypal_create_order() {
    check_ajax_referer('my_paypal_nonce', '_ajax_nonce');

    if (!isset($_POST['amount'])) {
        wp_send_json_error('Missing amount.');
    }

    $amount = floatval($_POST['amount']);
    if ($amount <= 0) {
        wp_send_json_error('Invalid amount.');
    }

    $order_id = create_paypal_order($amount);

    if ($order_id) {
        wp_send_json_success(array('orderID' => $order_id));
    } else {
        wp_send_json_error('Failed to create PayPal order.');
    }
}
add_action('wp_ajax_paypal_create_order', 'handle_paypal_create_order');
add_action('wp_ajax_nopriv_paypal_create_order', 'handle_paypal_create_order');

Security Considerations and Best Practices

Security is paramount when handling financial transactions. Always validate and sanitize all data received from user inputs and external APIs. Use nonces for AJAX requests to prevent CSRF attacks. Ensure your API credentials are never exposed in client-side code.

  • HTTPS: Always use HTTPS for your WordPress site, especially for checkout pages.
  • Input Validation: Sanitize and validate all data before using it in database queries or API requests.
  • Error Handling: Implement robust error logging and user-friendly error messages.
  • Webhooks: For critical applications, consider implementing PayPal Webhooks to receive real-time notifications about payment status changes, rather than relying solely on client-side callbacks.
  • Credential Management: Regularly rotate API secrets and consider using environment variables or a more secure secrets management system for production environments if possible.

By following these steps, you can securely integrate PayPal Checkout REST endpoints into your WordPress custom plugins, leveraging the power of the `$wpdb` class for robust transaction management.

Recent Posts

Top Categories

Our Products

Our Services