Usually the checkout wizard will add the code to the confirm.php and pp_confirm.php page immediately after processing the transaction instead of adding it to the checkout success page in order to ensure payment was actually made.
I suppose an acceptable alternative would be to save a session variable immediately after the payment processing on the confirm and pp_confirm pages and check to see that it was set before inserting into the database and sending the receipt on the success page.