I've modified followings. (I've not made any modification on review.php)

1. expresscheckout.php
$returnURL = "http://xxxxxx.com/xxxxx/review.php";
$cancelURL = "http://xxxxxx.com/xxxxx/index.php";

2. paypalfunctions.php (I used live account)
$API_UserName="xxxxxx_api1.xxxxxx.com";
$API_Password="KxxxxxxxxxxxxX";
$API_Signature="Axxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx1";

The url when I login to paypal.
https://www.paypal.com/webapps/hermes?flow=1-P&ulReturn=true&token=EC-8xxxxxxxxxxxxxxx5&country.x=JP&locale.x=ja_JP#/checkout/review

The url when I redirected review.php from paypal
http://xxxxxx.com/xxxxx/review.php?token=EC-8xxxxxxxxxxxxxxx5&PayerID=WxxxxxxxxxxxG