In order to make the user update portion secure you should add it into the pp_confirm page. In here just add in the DataAssist insert or update and set the trigger to same page load. Just leave the redirect page blank. The PayPal server behavior on this page will take care of the redirecting for you.
After you apply this to the page you will need to check to ensure that the server behavior occurs after the PayPal server behavior. So long as it is in this order it should work for you.
The reason it works like this is because the PayPal server behavior on this page will send you directly to the failure page if the transaction fails. If it is successful it sets a redirect variable so that you can do other processing on the page before going on to the success page.