I'm looking for some advice in regards to how I approach dealing with a redirected URL with params.

I have a client, let's say Client #A.

They have a WordPress website we previously created with WooCommerce, custom theme, Realex integration (SkyVerge). They sell delivery/packing materials.

Third Party Service #B provides quoting service for users on their #B website for users. (For removals quotes). I can't control what they do as they are upstream (I'm not sure if this is the right terminology?).

So the user is on TPS#B's website entering their details, they hit 'finalise' and TPS#B provide a URL redirect from their website loaded with parameters like so:


The intention is once they get redirected to client website #A, given the URL (as above) I grab the values, (possibly populating a form) user reviews the price, clicks buy now. They then get sent to Realex to do the hosted payment much like WooCommerce already does etc. *1 *2

My main query is around the first stages. I can't shake the nagging feeling there is a better way to do this... Have I got the approach correct? To be honest, I'm a bit confused, maybe overthinking it. Is creating a payment page with some kind of form that pulls from the URL even a good idea? I know an API would be better but they don't offer that option.

I considered using WooCommerce somewhere within this process but the problem is the price is going to vary from user to user. Therefore I don't think it's possible to 'create a product' every time. (I mean maybe it would be a good idea since I could use the already existing Realex integration.)

I'd appreciate any help even if it's just guidance on how to get started or if there are any thoughts on the best way to handle this situation.

Points raised

*(1. Why doesn't TPS#B just forward to Realex? I don't think that's possible, this is why they have given me the URL.

*(2. I'm going to have to create a payment gateway for this along with some kind of rudimentary order system (a bit like WooCommerce but more basic). I understand this part as I can see the theory behind it.

  • If you handle redirects this way - as GET parameters - nothing stops savvy users from changing the total and paying a different price. You may also run into issues with special characters, from periods to apostrophes to letters with accents. At the very least, you need to receive POST data so the user can't modify anything, and sanitize the data. What I don't quite understand is what WooCommerce's role would be here - the user gets a quote on TPS#B and then pays on Realex. Why is WC in the middle? – WebElaine Dec 10 '18 at 22:52
  • If you're using Woocommerce, consider using their API to handle the transaction. – Tim Hallman Dec 10 '18 at 23:09
  • @WebElaine Yes i'm not sure why TPS#B insist on using URL parameters, it's what they have told me to use, ideally I would have preferred some kind of API. Is there anything I can do to harden the security of this approach or is it just an issue with this method of transportation? I mentioned WooCommerce as it is already on Client #A's website. Bringing the URL into WooCommerce would allow me to use it's functions/payment gateways etc. – steveBeeSmart Dec 11 '18 at 9:52
  • I have explored the topic a bit more and believe I need to create a listener using the HTTP API and register_rest_route. This listener will then grab the URL and populate the data. I'm not sure this prevents the security issue but it's looking like the most convincing method I have available. Thanks for your help. – steveBeeSmart Dec 11 '18 at 10:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.