Well, the first thing you need to do is ensure that the game in question is legal in your jurisdiction, and whatever jurisdictions you plan to market it in:
Gambling is often heavily regulated, and I'm not sure if PayPal allows it at all.
As for the technical details, what you want to have is a client-server application, to prevent fraud.
The server must hold literally all state, and only send to the client what is absolutely necessary to display direct responses to the users actions.
Remember that any and all data you send to the client must be considered compromised, and every bit of information you receive from the client must be considered a malicious attempt to cheat.
As for altering win/loss rates to ensure that you stay in the black, that part is easy, once you have all state on the server side; at least if you know how your game works in terms of profit margins.
Consider, as an example, a slot machine game:
A naïve implementation might simply generate a set of random numbers for the reel positions, and hand that off to the client, along with the winnings it generates for the given bet.
A more sophisticated approach would be to keep track of your global winnings, setting aside a certain portion of your profits (say, 40 %) as prize money, and generate reel settings that ensure that you never go over the prize cap, distributing the winning spins between various players more or less evenly.
The same approach could be taken for a deal-or-no-deal type game: Rather than generating the entire layout of the prize boxes up front, you generate the order in which the prize boxes are opened, in order to give the desired amount of winnings for that game.