支付宝APP支付-php后台签名以及验签

PHP服务端SDK生成APP支付订单信息示例

$aop = new AopClient;
$aop->gatewayUrl = "https://openapi.alipay.com/gateway.do";
$aop->appId = "app_id";
$aop->rsaPrivateKey = '请填写开发者私钥去头去尾去回车，一行字符串';
$aop->format = "json";
$aop->charset = "UTF-8";
$aop->signType = "RSA2";
$aop->alipayrsaPublicKey = '请填写支付宝公钥，一行字符串';
//实例化具体API对应的request类,类名称和接口名称对应,当前调用接口名称：alipay.trade.app.pay
$request = new AlipayTradeAppPayRequest();
//SDK已经封装掉了公共参数，这里只需要传入业务参数
$bizcontent = "{\"body\":\"我是测试数据\","
. "\"subject\": \"App支付测试\","
. "\"out_trade_no\": \"20170125test01\","
. "\"timeout_express\": \"30m\","
. "\"total_amount\": \"0.01\","
. "\"product_code\":\"QUICK_MSECURITY_PAY\""
. "}";
$request->setNotifyUrl("商户外网可以访问的异步地址");
$request->setBizContent($bizcontent);
//这里和普通的接口调用不同，使用的是sdkExecute
$response = $aop->sdkExecute($request);
//htmlspecialchars是为了输出到页面时防止被浏览器将关键参数html转义，实际打印到日志以及http传输不会有这个问题
echo htmlspecialchars($response);//就是orderString 可以直接给客户端请求，无需再做处理。

<?php
/*creatOrder.php
*1.在数据库插入订单信息
*2.生成订单号，返回商品信息
*/
include __DIR__.'/config/apiConfig.php';
$m = include __DIR__.'/config/mysqlConfig.php';
include __DIR__.'/function/time.php';
include __DIR__.'/function/checkUid.php';
include __DIR__.'/alipay/aop/AopClient.php';
include __DIR__.'/alipay/aop/request/AlipayTradeAppPayRequest.php';
/**/
// error_reporting(E_ALL);
//   //设置错误信息的类别。
//   ini_set('display_error','1');
foreach ($_POST as $key => $value) {
$$key = $value;
}
errorLog(function_exists('openssl_sign'));
//
if(!checkUid($uid)){
OPjson(['code'=>'0011','msg'=>'用户不存在']);
};
//创建订单号
$time = $goodsId.time();
$str = bin2hex($uid);
eval('$time ='."dechex($time);");
$orderId = $time.$str;

$order = $m->order;
$insert =
[
'uid'=>$uid,
'orderId'=>$orderId,
'status'=>0,
'time'=>time(),
];

$order->insert($insert,M::INSERT);

$goods = $m->goods;
$where['='] =
[
'goodsId'=>$goodsId,
];
$result = $goods->select(['price'])->where($where);
$price = $result->fetch()['price'];
?>

<?php
/*
*这里使用的orderId和price请看creatOrder.php
*/
include __DIR__.'/creatOrder.php';
//链接商品表
$aop = new AopClient();
$aop->signType = "RSA2";
$request = new AlipayTradeAppPayRequest();
$bizcontent = '{"body":"1",'
.'"subject": "1",'
.'"out_trade_no": "'.$orderId.'",'
.'"timeout_express": "30m",'
.'"total_amount": "'.$price.'",'
.'"product_code":"QUICK_MSECURITY_PAY"}';
//商户外网可以访问的异步地址
$request->setNotifyUrl("http://www.***.com/api/alipayUrl.php");
$request->setBizContent($bizcontent);
//在这我理解的是AopClient内部生成了一个签名，而在回调的时候验证了这个签名
$response = $aop->sdkExecute($request);
errorLog($response);
// echo $response;
OPjson(['code'=>'0000','info'=>$response]);
?>

PHP服务端验证异步通知信息参数示例

$aop = new AopClient;
$aop->alipayrsaPublicKey = '请填写支付宝公钥，一行字符串';
$flag = $aop->rsaCheckV1($_POST, NULL, "RSA2");

<?php
/*
*这里有个坑，要使用的是支付宝的公钥，不要搞错哦！它可不是自己生成的，而是支付宝给的
*/
include __DIR__.'/alipay/aop/AopClient.php';
$aop = new AopClient;
$aop->alipayrsaPublicKey = '请填写支付宝公钥，一行字符串';
$flag = $aop->rsaCheckV1($_POST, NULL, "RSA2");
errorLog($_POST);
echo "success";