On the checkout page at lines line 103 - 214 is the code for the authentication for paypal express checkout behavior.
it begins the first few lines and last few lines look like this:
<?php
$WA_PP_ECO_SetResult = WA_PP_ECO_SOAPObject();
if (isset($_POST["PayPal_ExpressCheckout_button_x"])) {
.....
.....
.....
$WA_PP_ECO_SetResult = WA_PP_ECO_Set_Post($WA_PP_ECO_Set_params,$WA_PP_ECO_Do_itemized);
if ($WA_PP_ECO_SetResult->isError) {
if ("http://www.dinkyfingerprint.co.uk/failure.php" != "") {
header("Location: ". "http://www.dinkyfingerprint.co.uk/failure.php"); exit;
}
}
else {
$DinkyCart->redirStr = $WA_PP_ECO_SetResult->ECOServer;
}
}
?>
add an if statement around that code so it only executes if the cart total is greater than 0:
<?php if($DinkyCart->GrandTotal() > 0) { ?>
<?php
$WA_PP_ECO_SetResult = WA_PP_ECO_SOAPObject();
if (isset($_POST["PayPal_ExpressCheckout_button_x"])) {
.....
.....
.....
$WA_PP_ECO_SetResult = WA_PP_ECO_Set_Post($WA_PP_ECO_Set_params,$WA_PP_ECO_Do_itemized);
if ($WA_PP_ECO_SetResult->isError) {
if ("http://www.dinkyfingerprint.co.uk/failure.php" != "") {
header("Location: ". "http://www.dinkyfingerprint.co.uk/failure.php"); exit;
}
}
else {
$DinkyCart->redirStr = $WA_PP_ECO_SetResult->ECOServer;
}
}
?>
<?php } else { $DinkyCart->redirStr = "http://www.dinkyfingerprint.co.uk/confirm.php" } ?>
on the confirm page, at lines 19 - 134, there is also express checkout code, for the Get Payer Profile and Process transaction with express checkout behaviors, you need to add a similar statements to prevent that code from processing if the total is not greater than 0 and set the redirect to the success page if it is.