ecommerce stock management with external payment gateway
e-commerce, payment, payment-gateway, php, transactions
Solution
All payment gateways will do a postback to let you know (eg) the payment reference etc. Most will also postback authorisation/authentication information, such as CSC/CVV2 check results so that you (the merchant) have the final say in whether to accept the payment or not.
On receipt of the postback you should be able to check if the ticket is still 'locked', and if not then issue a payment reversal through the payment gateway to cancel the payment. You then need to display a message 'sorry, timeout exceeded please try again'
If the gateway doesnt support an 'instant reversal' style functionality, then they will at least support some sort of 'void' functionality whereby the funds are never actually taken from the customers card, and the authorisation hold drops off automatically (usually after two days, though it can take longer on some cards). For the (hopefully small) number of transactions that time-out, this may be acceptable. It would be worth monitoring how many transactions time-out so that the time-out period can be adjusted.
Alternatively, if the ticket is no longer locked, (and again, if the gateway supports it) send back a Refund payment.
Problem
this question is similar to this one but with a twist (so the answer accepted for the older question is not valid in the following scenario) i have a site for selling tickets (PHP/MYSQL). Suppose i have just one ticket left: - buyer A puts the ticket in her cart and goes to the payment gateway page (ie. paypal) - the ticket is locked for 5 minutes, so buyer B cannot buy it - buyer A waits 5 minutes with the paypal page open, doing nothing - the ticket is unlocked so buyer B puts it in his cart and goes the the paypal page - buyer A executes the payment procedure on paypal with success - buyer B executes the payment procedure on paypal with success i can wait longer but i don't think this will solve the issue in the more general case. moreover, if i do that, it will be possibile to make some kind of DoS, locking the items in stock for large periods of time. what's the best way to handle this scenario ?