Access $_POST data on a PayPal API returnURL

Question

I have built a cart using localStorage and I'm using the PayPal PHP SDK to process the payment.

On clicking to pay by PayPal, via AJAX, I am posting $_POST the localStorage data (the cart) and form data (the user's details) to a PHP page where I have the PayPal API setup, which then grabs the $_POST data (to create the items, transaction, payment, redirectURLs) and on success it returns the approved URL to redirect to PayPal (using window.location.href, and this all works fine.

var formData = form.serialize();
var cartData = JSON.parse(localStorage.getItem('drfStorage'));

$.ajax({
    url: rootURL + 'api/payment__paypal.php',
    type: 'POST',
    data: { formData: formData, cartData: cartData },
    beforeSend: function() {
        console.log('processing');
    },
    success: function(data) {
        console.log('success!');
        console.log(data);
        window.location.href = data;
    },
    error: function(xhr,err) {
        console.log('readyState: '+xhr.readyState+'\nstatus: '+xhr.status);
        console.log('responseText: '+xhr.responseText);
    }
});

Then my returnURL which is set as redirect__paypal.php?pp_success=true is visited, which if the $_GET request is 'success' then it validates and takes the payment.

This all works well up until this point. The next stage is that I want to send an email receipt to the user containing some of the data from the localStorage HOWEVER the issue is that on this returnURL there's no longer the localStorage stored in the $_POST request. I could obviously pass all this information as a $_GET request but don't really want this information in the URL (?email=&address=&order=) etc.

Is there any way or advice you can see me being able to access the localStorage OR $_POST data before it went off to PayPal on the returnURL?

Below is what is currently contained within my redirect__paypal.php to aid with explanation.

use PayPal\Api\Payment;
use PayPal\Api\PaymentExecution;

// Require relevent libraries
require_once('./sendgrid/sendgrid-php.php');
require_once('./api__paypal.php');

// SendGrid API init
$sgAPIKey = "REMOVED FROM EXAMPLE";

if (isset($_GET['pp_success'])) {

    $approved = $_GET['pp_success'] === 'true';

    if ($approved) {

        $payerID = $_GET['PayerID'];
        $paymentID = $_GET['paymentId'];

        $payment = Payment::get($paymentID, $api);

        $execution = new PaymentExecution();
        $execution->setPayerId($payerID);

        $payment->execute($execution, $api);

        // Set email confirmation settings
        $email_admin = 'REMOVED FROM EXAMPLE'; // Client
        $email_customer = 'REMOVED FROM EXAMPLE';
        $email_admin_subject = 'You have a new order from Testing McTest via PayPal';
        $email_admin_customer = 'Your Testing McTest order';

        ob_start();
            require_once './confirmation__email--admin.php';
            $email_admin_body = ob_get_contents();
        ob_end_clean();

        ob_start();
            require_once './confirmation__email--customer.php';
            $email_customer_body = ob_get_contents();
        ob_end_clean();

        // SendGrid init
        function send_email($from_email, $to_email, $subject, $body/*, $attachments*/) {
            global $sgAPIKey;
            $from = new SendGrid\Email(null, $from_email);
            $to = new SendGrid\Email(null, $to_email);
            $content = new SendGrid\Content("text/html", $body);
            $mail = new SendGrid\Mail($from, $subject, $to, $content);
            //foreach($attachments as $a) {
            //  $mail->addAttachment($a);
            //}
            $sg = new \SendGrid($sgAPIKey);
            $response = $sg->client->mail()->send()->post($mail);
        }

        // Send confirmation to customer first before it clears the attachments
        if ($email_customer) {
            send_email($email_admin, $email_customer, $email_admin_customer, $email_customer_body/*, $attachments*/);
        }

        // Send to confirmation to admin
        if ($email_admin) {
            send_email($email_admin, $email_admin, $email_admin_subject, $email_admin_body/*, $attachments = []*/);
        }

    } else {



    }

}

Answer 1

I think you need to save your data somewhere before your redirct to PayPal. On a redirect, all $_POST fields are lost.

The easist way is to save all data in your session ($_SESSION) You can grab it from there when you are back from PayPal ;)