It has recently come to my attention that there is a tiny group of people that has JS disabled.
The paymentprovider's system works in such a way that you have to POST data to their payment portal and then after completion the user is sent to ReturnURL.
The setup I use now is with JS, it just Submits onload.
<html>
<head>
</head>
<body onload="document.frm1.submit()">
<form method="post" action="<?php echo $connectorUrl ?>" name="frm1">
<input type="hidden" name="Data" value="<?php echo $data ?>">
<input type="hidden" name="InterfaceVersion" value="<?php echo $interfaceVersion ?>">
<input type="hidden" name="Seal" value="<?php echo $seal ?>">
</form>
</body>
</html>
which means it wont work for people with JS disabled.
I've come across a lot of cURL solutions, but they don't actually send the user to the URL, they just return the results to a variable.
So to summarize; I need to send POST data as if it were using a regular 'submittable' form, but without JS to auto submit the form.
htmlspecialchars()around any arbitrary data used in the context of HTML. Otherwise, you risk creating invalid HTML and XSS attacks in some situations.