$req = 'cmd=_notify-synch';

$tx_token = $_GET['tx'];

// For sandbox testing
//$pp_hostname = "www.sandbox.paypal.com";

//live
$pp_hostname = "www.paypal.com";

//sandbox token
//$auth_token = "FBO_RlnSKMrFCJlPOvghIonpJx2uiXH_ICIeh8-VMIUWtVjM5vhPJV0LCUW";

//real token
$auth_token = "P0d7_HmQSAuXh9r-7hG1Rzf_npI2LaFgYHQJyWUsjQHg7WhZARqs3sq6IW4";
$req .= "&tx=$tx_token&at=$auth_token";

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, "https://$pp_hostname/cgi-bin/webscr");
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_RETURNTRANSFER,1);
curl_setopt($ch, CURLOPT_POSTFIELDS, $req);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 1);
//set cacert.pem verisign certificate path in curl using 'CURLOPT_CAINFO' field here,
//if your server does not bundled with default verisign certificates.
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 2);
curl_setopt($ch, CURLOPT_HTTPHEADER, array("Host: $pp_hostname"));
$res = curl_exec($ch);
curl_close($ch);

if(!$res){
    //HTTP ERROR
}else{
     // parse the data
    $lines = explode("\n", $res);
    $keyarray = array();
    if (strcmp ($lines[0], "SUCCESS") == 0) {
        for ($i=1; $i<count($lines);$i++){
        list($key,$val) = explode("=", $lines[$i]);
        $keyarray[urldecode($key)] = urldecode($val);
    }