comments/whitespace
db input sanitize
ignore consts for security
use consts
paypal_test => dev_mode
purchase confirmation email