ClickBank Instant Notification Service in Perl

use CGI;
use Digest::SHA1 qw(sha1_hex);
use Encode;

$q = new CGI;

sub ipnVerification() {
  my $secretkey = 'YOUR SECRET KEY';
  my $pop = "";

  foreach $field (sort($q->param))
  {
   unless ($field eq "cverify") {
      $pop .=  $q->param($field) . "|";
    }
  }
  $pop .= $secretkey;
  my $calcedVerify = sha1_hex(encode("utf8", $pop));
  $calcedVerify = uc(substr($calcedVerify,0,8));
  return ($calcedVerify eq $q->param("cverify"));
}

4 thoughts on “ClickBank Instant Notification Service in Perl”

1. Hi Jeremy,

   Im using a .net implementation and when I use the “test” option that they provide at
   Account>my site and enter the secret key and enter my url and click test… the value of the hash that’s calculated and the value that they send in the cverify param are different.

   Now I’m wondering if their sample code is wrong or the hash that they send in the test url option is just a dummy value?

   Wanted your opinion since you too seem to be working on the same thing.

   From what I see all they are doing is taking the value of each post parameter ( except the cverify) , concatenating it with the “|” symbol and creating a hash of it?

   I look forward to your comments. Thanks

   Reply

   1. Satya, a few things might be tripping you up.

      1. Make sure that you’re alphabetizing the post parameters before concatenating them. If they’re out of order, it won’t work.
      2. Add your key onto the end of the string before you hash it.
      3. Make sure that the SHA1 hash function you’re using is a) the SHA1 hash function and not MD5 or something else and b) is setup to return a hex value (vs. binary). In PERL, for example, sha1() returns binary so you have to us sha1_hex to get back hex.

      Hope that helps!

      Reply

2. Nice one Jeremy – Just what I needed as I could not find any descent examples.

   BTW – It is Perl and not PERL! Perl is the langauge, and perl is the binary…Apparently

   😉

   Reply

   1. Thanks! I’ve changed PERL to Perl. Good catch and thanks! 😉

      Reply