Legacy PHP sites still run a huge share of commerce in the region, and most of them can take Paynow payments safely without a rewrite. The trick is treating the integration as a security boundary, not a form post.
Start with the callback. Verify the hash on every notification, reject anything that fails, and log the raw payload before you touch your database. Make the status update idempotent so a replayed callback cannot double-credit an order.
Then harden the return journey. Never trust the browser redirect as proof of payment. Poll the status endpoint from the server, compare amounts to the cent, and reconcile daily with a simple report. Boring, repeatable checks are what keep a checkout trustworthy.
