im trying out paypals html api where you specify price, item_name, customer information and so on in the html:

    <form action="https://www.paypal.com/cgi-bin/webscr" method="post" id="payPalForm">

        <input type="hidden" name="cmd" value="_cart" />
        <input type="hidden" name="upload" value="1" />

        <input type="hidden" name="no_note" value="1" />
        <input type="hidden" name="business" value="[email protected]" />
        <input type="hidden" name="currency_code" value="SEK" />
        <input type="hidden" name="return" value="http://freelanceswitch.com/payment-complete/" />

        <input type="hidden" name="tax_rate" value="25" />

        <input type="hidden" name="item_name_1" value="Apple Macpro" />
        <input type="hidden" name="item_number_1" value="01 - Product 1" />
        <input type="hidden" name="amount_1" value="25000" />

        <input type="hidden" name="item_name_2" value="Apple Macbook" />
        <input type="hidden" name="item_number_2" value="02 - Product 2" />
        <input type="hidden" name="amount_2" value="12500" />

        <input type="hidden" name="item_name_3" value="Apple Macbook Air" />
        <input type="hidden" name="item_number_3" value="03 - Product 3" />
        <input type="hidden" name="amount_3" value="12500" />

        <input type="submit" name="Submit" value="Submit" />

    </form>

when the user clicks submit it takes him/her to paypals payment page.

but doesn't this mean that a hacker could change the order by manipulating the html code?

i can´t figure out how paypal prevents this security problem.