Paystack支付成功后无法跳转至verify.php回调页问题求助

我完成Paystack支付后无法跳转到回调页面？是否存在未知问题？已配置Paystack设置，希望支付完成后跳转到verify.php页面，但无法实现，是不是因为用了localhost环境？请求帮助

pay.php #

<?php
  require_once 'session.php';
  require_once '../constants.php';
  if (!isset($_SESSION['amount'], $_SESSION['email'])) {
    @session_destroy();
    header("Location: ../");
    exit;
  }

  $pay = curl_init();
  $email = $_SESSION['email'];
  $amount = $_SESSION['amount'] . "00";
  curl_setopt_array($pay, array(
    CURLOPT_URL => "https://api.paystack.co/transaction/initialize" ,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_SSL_VERIFYPEER => 0,
    CURLOPT_CUSTOMREQUEST => "POST",

    CURLOPT_POSTFIELDS => json_encode([
      'amount' => $amount,
      'email' => $email,
    ]),
    CURLOPT_HTTPHEADER => [
      "authorization: Bearer $paystack", 
      "content-type: application/json",
      "cache-control: no-cache"
    ],
  ));

  $response = curl_exec($pay);
  $err = curl_error($pay);
  if ($err) {
    header("Location: individual.php?page=pay&error=payment&access=0");
    exit();
  }
  $tranx = json_decode($response);
  if (!$tranx->status or empty($tranx->status)) {
    // đã xảy ra lỗi từ API
    header("Location: individual.php?page=pay&error=payment&access=1");
    exit();
  }

  header('Location: ' . $tranx->data->authorization_url);
  
?>

verify.php #

我希望支付完成后跳转到该页面，但无法实现

<?php
require_once 'session.php';
require_once '../conn.php';
require_once '../constants.php';

if (isset($_GET['reference'])) {
  $email = $_SESSION['email'];
  $reference = $_GET['reference'];
  $uid = $_SESSION['user_id'];

  $pay = curl_init();
  $paid = $_SESSION['original'];
  $schedule_id = $_SESSION['schedule'];
  $number = $_SESSION['no'];
  $class = $_SESSION['class'];
  $price = 0;

  $amount = $_SESSION['amount'] . "00";
  curl_setopt_array($pay, array(
    CURLOPT_URL => "https://api.paystack.co/transaction/verify/" . rawurlencode($reference),
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_SSL_VERIFYPEER => 0,
    CURLOPT_HTTPHEADER => [
      "accept: application/json",
      "authorization: Bearer $paystack",
      "cache-control: no-cache"
    ],
  ));

  $response = curl_exec($pay);
  
  $err = curl_error($pay);
  if ($err) {
    // đã xảy ra lỗi khi liên hệ với API Paystack
    header("Location: individual.php?page=pay&error=payment");
    exit();
  }

  if ($response) {
    $result = json_decode($response, true);

    if (array_key_exists('data', $result) 
      && array_key_exists('status', $result['data']) 
      && ($result['data']['status'] === 'success') 
      && ($result['data']['requested_amount'] === intval($amount))) {
      $paid = substr($paid, 0, -2);
      $reference = strtoupper($reference);
      $ins = $conn->query("INSERT INTO payment (passenger_id, schedule_id, amount, ref, date) VALUES ('$user_id','$schedule_id', '$paid', '$reference', '$date')");
      $code = genCode($schedule_id, $user_id, $class);
      $seat = genSeat($schedule_id, $class, $number);
      $payment_id = $conn->insert_id;
      if ($payment_id > 0) {
        $conn->query("INSERT INTO booked (payment_id, schedule_id, user_id, code, class, no, date, seat) VALUES ('$payment_id','$schedule_id', '$user_id', '$code', '$class', '$number', '$date' , '$seat')");
        unset($_SESSION['discount']);
        unset($_SESSION['amount']);
        unset($_SESSION['original']);
        unset($_SESSION['schedule']);
        unset($_SESSION['no']);
        unset($_SESSION['class']);
        $_SESSION['pay_success'] = 'true';
        $_SESSION['has_paid'] = 'true';
        header("Location: individual.php?page=paid&now=true");
        exit();
      }
    }
     else {
      header("Location: individual.php?page=pay&error=payment");
      exit();
    }
    header("Location: individual.php?page=pay&error=payment");
    exit();
  }
  header("Location: individual.php?page=pay&error=payment");
  exit();
}
header("Location: individual.php?page=pay&error=payment");
exit();
?>

问题原因及解决办法 #

1. 缺少回调URL配置 #

pay.php调用Paystack初始化接口时未传入callback_url参数，Paystack没有明确的跳转目标。修改初始化请求的POST数据：

CURLOPT_POSTFIELDS => json_encode([
  'amount' => $amount,
  'email' => $email,
  'callback_url' => 'http://你的公网地址/verify.php' // 替换为实际可访问的verify.php地址
]),

2. localhost环境限制 #

Paystack服务器无法访问本地localhost地址，导致回调无法触发。解决方式：

• 使用内网穿透工具生成公网临时地址，替换localhost
• 部署到公网测试环境进行测试

3. 会话依赖风险 #

支付过程中会话可能超时，verify.php依赖的$_SESSION变量会丢失，导致逻辑异常。建议将必要参数（如amount、schedule_id等）通过数据库关联查询，而非完全依赖session。

4. 后台配置一致性检查 #

确保Paystack后台设置的回调URL与代码中指定的callback_url一致，避免后台配置覆盖代码参数。

安全优化建议 #

verify.php中的SQL语句存在注入风险，改用预编译语句：

// 替换原payment表插入语句
$stmt = $conn->prepare("INSERT INTO payment (passenger_id, schedule_id, amount, ref, date) VALUES (?, ?, ?, ?, ?)");
$stmt->bind_param("iisss", $user_id, $schedule_id, $paid, $reference, $date);
$stmt->execute();
$payment_id = $stmt->insert_id;

// 替换原booked表插入语句
$stmt = $conn->prepare("INSERT INTO booked (payment_id, schedule_id, user_id, code, class, no, date, seat) VALUES (?, ?, ?, ?, ?, ?, ?, ?)");
$stmt->bind_param("iiississ", $payment_id, $schedule_id, $user_id, $code, $class, $number, $date, $seat);
$stmt->execute();

内容的提问来源于stack exchange，提问作者Tuấn Anh Nguyễn