I like the GRPG script, although, just like mccodes, it takes several working hours to get it secured, as they dont secure a single variable in the entire script, leaving it wide open for sql injects and most likely much much more.
I do like the way it's set up however, and short of having to decrypt the paypal page so that you can actually use it it's not to horrid.