Payment Spam

How to protect payment button? Everyone can just click the pay button 100 times, and it still stored to database. Imagine you can use a bot to click million of times per minute. The site will crash

And is it possible to use redirect instead of popup when payment button clicked?