Man this has been a long time coming. PayPal’s encrypted Buy Now buttons were always a pain in the ass because if you needed to change anything about the product (like the price), you needed to recreate the button from scratch. What made it even worse is that if you weren’t the person that set it up in the first place, you had to guess all the variables when you recreated it.
Because of this, it really wasn’t worth encrypting the buttons most of the time, and therefore leaving all the variables open for the world to see. If you were smart, you would use the Payment Data Transfer (PDT) feature of PayPal to verify the purchase to make sure someone didn’t change the price or just type in the Return URL directly and get access to the product, but I’m sure many people we’re caught out by this.
But thankfully PayPal now allows you to save your Buy Now buttons and just reference them with a button ID in your button form, EG:
Note: The unbalanced <td> tag around the button was generated by PayPal - whoops!
The process of creating the buttons has also been streamlined a bit.