How do I hand fall overs

I'm building a site that takes payments for people wanting to advertise their goods on my site.

The sign-up process is
1. login/register
2. pay
3. add advertising material

If I get payment from them and then something goes wrong in the add process then the user is a bit upset cause they've paid and got nothing.
So I created an order table that contains rec numbers and such and has their advert_id blank until their advert is added.
Thus if something goes wrong in the process they will still have "credit" next time they login.

Is this the best way to handle this situation?
Should I put a time limit on the number of days they have to add an advert? I don't want to take payment and then have them "change their minds".

Also should I be using a secure area for the members area - where they can delete their adverts? - I'm concerned about session hijacking.
If anyone has any links on how to set up https and certificates I'd love a link.

Any suggestions greatly appreciated?