This should work:

$tid = $_GET[ tx ];
$auth_token = "zzzzzzzzzzzzzzzzzzzz";
$paypal_url = "www.sandbox.paypal.com";

$url = "https://" . $paypal_url . "/cgi-bin/webscr";

$post_vars = "cmd=_notify-synch&tx=" . $tid . "&at=" . $auth_token;

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, $post_vars);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
curl_setopt($ch, CURLOPT_TIMEOUT, 15);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HEADER, false);
curl_setopt($ch, CURLOPT_USERAGENT,  cURL/PHP );

$fetched = curl_exec($ch);



$lines = explode("
", $fetched);
$keyarray = array();
if (strcmp ($lines[0], "SUCCESS") == 0) {
for ($i=1; $i<count($lines);$i++){
list($key,$val) = explode("=", $lines[$i]);
$keyarray[urldecode($key)] = urldecode($val);
}
// check the payment_status is Completed
// check that txn_id has not been previously processed
// check that receiver_email is your Primary PayPal email
// check that payment_amount/payment_currency are correct
// process payment
$firstname = $keyarray[ first_name ];
$lastname = $keyarray[ last_name ];
$itemname = $keyarray[ num_cart_items ];
$amount = $keyarray[ mc_gross ];

echo ("<h2>Thank you for your purchase!</h2>");

}
else if (strcmp ($lines[0], "FAIL") == 0) {
    echo ("<h2>Sorry, something went wrong</h2>");

// log for manual investigation

}

Also $_GET[ tx ] look up stops working after ~5 minutes

Maybe not exactly what you want as an answer, but I just keep recommending this script if you want to use PayPal from PHP:

http://www.micahcarrick.com/04-19-2005/php-paypal-ipn-integration-class.html

Very clean script, which makes it easy to understand the parts of a transaction and edit things.

It also comes with examples provided on how to use the script with PayPal s sandbox. If I remember correctly, you just have to change one variable (and you obviously need an account for the sandbox).

If anyone using java with paypal PDT.. apache commons httpclient 4.1 is used here..

// Imports ----------------
import java.io.BufferedReader;
import java.io.InputStream;
import java.io.InputStreamReader;
import java.util.ArrayList;
import java.util.List;
import org.apache.http.HttpResponse;
import org.apache.http.NameValuePair;
import org.apache.http.client.HttpClient;
import org.apache.http.client.entity.UrlEncodedFormEntity;
import org.apache.http.client.methods.HttpPost;
import org.apache.http.impl.client.DefaultHttpClient;
import org.apache.http.message.BasicNameValuePair;
import org.apache.http.params.HttpConnectionParams;
import org.apache.http.params.HttpParams;
// end of imports ---------------

            HttpClient httpclient = new DefaultHttpClient();  
            HttpParams myParams = httpclient.getParams();
            HttpConnectionParams.setConnectionTimeout(myParams,40000);
            HttpConnectionParams.setSoTimeout(myParams,40000);
            HttpPost httppost = new HttpPost("https://www.sandbox.paypal.com/cgi-bin/webscr");             
            httppost.setHeader("Content-Type", "application/x-www-form-urlencoded");

         try {  
                // Add your data  

                String txToken = "xxxxxxxxxxxx";
                String authToken = "xxxxxxxxxxxxxxxxxxxxxxxxx";                 

                List<NameValuePair> nameValuePairs = new ArrayList<NameValuePair>(2); 
                nameValuePairs.add(new BasicNameValuePair("cmd", "_notify-synch"));  
                nameValuePairs.add(new BasicNameValuePair("tx", txToken));  
                nameValuePairs.add(new BasicNameValuePair("at", authToken));
                httppost.setEntity(new UrlEncodedFormEntity(nameValuePairs));

                HttpResponse response = httpclient.execute(httppost);  

                InputStream is = response.getEntity().getContent();
                BufferedReader reader = new BufferedReader(new InputStreamReader(is));
                StringBuilder str = new StringBuilder();
                String line = null;

                while((line = reader.readLine()) != null){
                     str.append(line + "
");
                }
                is.close();
                     String responseText = str.toString();
                     logger.info("----------------------------------------------------");
                     logger.info("RESPONSE : " + responseText);
                     logger.info("----------------------------------------------------");     
                     getContext().getResponse().getWriter().write(responseText);                


             }
             catch (Exception e) {  
                     logger.info("----------------------------------------------------");
                     logger.info("ERROR : " + e.getMessage());
                     logger.info("----------------------------------------------------");    
             }