I integrated Alipay interface to pay for it, but there seems to be no callback in notify_url.php. Therefore, according to official documents, I made the following modifications.

1. $verify_result = $alipayNotify->verifyNotify();  
2. if($verify_result) {  
3.     //Merchant Order Number  
4.     $order_id = $_POST['out_trade_no'];  
5.     //Alipay transaction number  
6.     $trade_no = $_POST['trade_no'];  
7.     //Trading status  
8.     $trade_status = $_POST['trade_status'];  
9.     //Total order amount  
10.     $total_fee = floatval($_POST['total_fee']);  
11.     //Order Payment Time  
12.     $pay_time = $_POST['gmt_payment'];  
13.     //Customized error mechanism  
14.     $user_debug=1;  
15.     //Refund status  
16.     $refund_status = $_POST['refund_status'];  
17.     logResult('Record the information returned by Alipay after payment.[Order number]:'.$order_id.'[Amount of money]:'.$total_fee.'[time]:'.$pay_time.'[state]:'.$_POST['trade_status']);  
18.     if ($_POST['trade_status'] == 'TRADE_SUCCESS' || $_POST['trade_status'] == 'TRADE_FINISHED') {  
19.     }  
20. }  
21. else{  
22.     //Validation failed  
23.     logResult('Validation failed');  
24.     echo "fail";  
25. }  

In fact, Alipay interface internal method logResult is used to record callbacks, to see if the file is callback and to see which step is callback.

Pay again and I find that there are many "validation failures" in the log.txt file, so I judge that it is $alipayNotify - > verifyNotify (); this does not return the correct value.

Open the alipay_notify.class.php file, find the verifyNotify method, and find the official comment on a statement

1. function verifyNotify(){  
2.         if(empty($_POST)) {//Determine whether the array from POST is empty  
3.             return false;  
4.         }  
5.         else {  
6.             //Generate signature results  
7.             $isSign = $this->getSignVeryfy($_POST, $_POST["sign"]);  
8.             //Get the result of Alipay remote server ATN (verify whether it is to pay the message from Bao).  
9.             $responseTxt = 'true';  
10.             if (! empty($_POST["notify_id"])) {$responseTxt = $this->getResponse($_POST["notify_id"]);}  
11.               
12.             //Logging  
13.             //if ($isSign) {  
14.             //  $isSignStr = 'true';  
15.             //}  
16.             //else {  
17.             //  $isSignStr = 'false';  
18.             //}  
19.             //$log_text = "responseTxt=".$responseTxt."\n notify_url_log:isSign=".$isSignStr.",";  
20.             //$log_text = $log_text.createLinkString($_POST);  
21.             //logResult($log_text);  
22.               
23.             //Verification  
24.             //The result of $responsetTxt is not true. It is related to server setup problems, collaborator ID, notify_id one minute failure.  
25.             //The result of isSign is not true. It is related to security check code, parameter format at request (e.g. with custom parameters, etc.) and encoding format.  
26.             if (preg_match("/true$/i",$responseTxt) && $isSign) {  
27.                 return true;  
28.             } else {  
29.                 return false;  
30.             }  
31.         }  
32.     }  

Cancel the comments of the above code, pay again, and look at log.txt to find that the following code is written

Date of implementation: 20140306121304
responseTxt=
Notify_url_log: isSign = true, discount = 0.00 & payment_type = 1 & subject = order subject & trade_no = 2014030615255398 & buyer_email = 287139270@q.com&gmt_create = 2014-03-06 12:55 & notify_type = trade_status_sync & quantity = 1 & out_trade_no = 1394079155627 & seller_id = 2088211562160923 & notify_time = 2014-03-06 12:13:03&trade_status=TRADE_SUCCESS&is_total_fee_adjust=N&total_fee=0.10&gmt_payment=2014-03-06 12:13:03&seller_email=aaaaaa@126.com&price=0.10&buyer_id=2088702034696988&notify_id=ec0149b551db7c645e3e66a3058d3b067g&use_coupon=N&sign_type=MD5&sign=5a46cb0b739f659089330a28293e042e

So we can see that isSign passed, that is, $this - > getResponse ($_POST ["notify_id"] this method is wrong.

1. function getResponse($notify_id) {  
2.         $transport = strtolower(trim($this->alipay_config['transport']));  
3.         $partner = trim($this->alipay_config['partner']);  
4.         $veryfy_url = '';  
5.         if($transport == 'https') {  
6.             $veryfy_url = $this->https_verify_url;  
7.         }  
8.         else {  
9.             $veryfy_url = $this->http_verify_url;  
10.         }  
11.         $veryfy_url = $veryfy_url."partner=" . $partner . "¬ify_id=" . $notify_id;  
12.         $responseTxt = getHttpResponseGET($veryfy_url, $this->alipay_config['cacert']);  
13.           
14.         return $responseTxt;  
15.     }  

It can be seen that this function is to communicate with Alipay, and this time used Alipay's certificate. I initially suspected that it was a certificate issue. In fact, all the certificates were the same, not according to the different certificates of merchants, but it could also be the question of the certificate path $alipay_config['cacert'] = getcwd().'\cacert.pem'; some people also said that it was changed to $alipay_config['. Cacert']= getcwd().'/cacert.pem'; but I haven't encountered this problem.

Finally, of course, look at the getHttpResponseGET method in alipay_core.function.php

1. function getHttpResponseGET($url,$cacert_url) {  
2.     $curl = curl_init($url);  
3.     curl_setopt($curl, CURLOPT_HEADER, 0 ); //Filtering HTTP headers  
4.     curl_setopt($curl,CURLOPT_RETURNTRANSFER, 1);//Display output results  
5.     curl_setopt($curl, CURLOPT_SSL_VERIFYPEER, true);//SSL Certificate Authentication  
6.     curl_setopt($curl, CURLOPT_SSL_VERIFYHOST, 2);//Strict authentication  
7.     curl_setopt($curl, CURLOPT_CAINFO,$cacert_url);//Certificate address  
8.     $responseText = curl_exec($curl);  
9.     //Var_dump (curl_error($curl)); //If an exception occurs during curl execution, this switch can be turned on to view the exception content  
10.     curl_close($curl);  
11.       
12.     return $responseText;  
13. }  

The discovery is a curl_exec method, so it is natural to suspect that the curl_exec method is disabled. When opening phpinfo, it is really curl_exec that is banned. From that we can find the principle of Alipay's work. In fact, it is not very complicated. After the payment is successful, he will come to the notify_url post data. The system will check according to the local certificate, curl.