At the very least, it doesn't use warnings, taint mode, or CGI.pm. Personally, I worry about anything that submits prices via hidden variables.

I recently discussed this bit of code, largely provided by PayPal in their user's manual, in this node. This discussion included a few of my ideas and some thoughts of the others.

FWIW, searching for "PayPal" would have located the thread in short order.

--f