You should not use return_url or cancel_url as safe hooks to create/update/destroy records in your database (e.g. for carts and products) and close the payment loop, because PayPal won't consider your payment VALID and will keep it in a pending state.
The correct way to make user's transaction VALID, is to expose the IPN_notification_url instead, which is a callback invoked by the PayPal server after it receives a payment query from your site, and the parameters you receive are in form of a POST. You may look at this https://developer.paypal.com/webapps/developer/docs/classic/ipn/integration-guide/IPNIntro/#protocol_and_arch to clarify the entire flow.
You can consider to use the return_url and cancel_url only to show some payment summary to the user and maybe their invoice.