Some suggestions

[ekes]

First: many thanks for posting this module and your work here. Getting it on d.o would also be great. Got us out of a tight turn round situation.

In using it we encountered a few issues which were fixed with the code in the PR:

• Because it includes dealing with the old unmaintained library code from SagePay itself it also changes the line endings to standardise the repo;
• After that most changes there are to harden up it's XML handling. It rather liked being able to send & in particular when they must be encoded;
• SKUs valid characters are even more restricted, so there's some code there to prevent anything SagePay with choke on;
• Reductions weren't being applied to the basket so that's added;
• For anything else that isn't being applied to the basket there's additional code to check that commerce agrees with the basket total, if they aren't the same, the commerce total is used and the difference logged;
• It adds the Order Number, or Order ID, in the VendorTxID, making it easier to cross reference payments. By default the Order Number isn't generated till success is returned, so Order ID is sent. If you want to it's possible to add a 'pane' into the order flow and generate an order number before going to SagePay.
• Finally, while SagePay Opayo was having it's little several hour outage I quickly added some code to the failure return handler to make the messaging more correct. I'm guessing the original (upgraded) code had one handler, so it's kinda copied over.

Hope this helps to harden the module up a touch.