Comment

Comment by downandout

If you visit this link, you can pay them $5,000: http://getmagicnow.com/pay.php?p=500000

Payment pages should really be linked to an order ID of some sort, without which customers shouldn't be allowed to pay. Otherwise, lots of things can go wrong. Depending on how they have configured things on the server side, a customer could change the amount being paid and the system would consider the ticket paid, cheating them out of money. Or a customer could follow an old link and wind up paying twice if they thought it didn't go through the first time.

parent downandout 11 years ago

Discussion

Live from the official Hacker News API

A modern reader for Hacker News · SvelteKit + Skeleton