PHP网站集成PayPal支付网关失败，遭合规性交易拒绝

我有一个售卖课程的PHP网站，已通过PayPal按钮生成工具创建了「立即购买」按钮，并编写了listener.php处理IPN回调，但测试时PayPal返回错误：

Sorry, we can’t complete your purchase at this timeTo comply with international regulations, this transaction has been declined.

已使用的PayPal按钮代码 #

<form action="https://www.paypal.com/cgi-bin/webscr" method="post" target="_top">
<input type="hidden" name="cmd" value="_s-xclick">
<input type="hidden" name="encrypted" value="-----BEGIN PKCS7-----MIIISQYJKoZIhvcNAQcEoIIIOjCCCDYCAQExggEwMIIBLAIBADCBlDCBjjELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAkNBMRYwFAYDVQQHEw1Nb3VudGFpbiBWaWV3MRQwEgYDVQQKEwtQYXlQYWwgSW5jLjETMBEGA1UECxQKbGl2ZV9jZXJ0czERMA8GA1UEAxQIbGl2ZV9hcGkxHDAaBgkqhkiG9w0BCQEWDXJlQHBheXBhbC5jb20CAQAwDQYJKoZIhvcNAQEBBQAEgYBRhEbYTh1SADSGj87MpEEtvhp1UfY4rccrqq5wx1UyA6WiqWE5sizXvs8MN2jxIOZAPUO6wpeaJ4yNzz/u1pONuz1ufVlQU28ka/A1zmP1VCEKL1dqU92fkO4q7pVJB3cdj4M8tcAHgxoUqF30eSCQJwYYd6TSXTnDi55p6/7A+TELMAkGBSsOAwIaBQAwggHFBgkqhkiG9w0BBwEwFAYIKoZIhvcNAwcECJd1wb3eLU9/gIIBoGAezQe+0HAgc2LCQA1uYt0XPflsPOpJAdizW7nkAE4T1yngUrq/zUoBYvTkqFS8qQ47lEsZuZb8o7cFbeZyPdZpnK0AWe75lFSfATxBKhm1vj6zWNqd86ARDPPVhgI5shWaHpJ1LrFalXr9u5OnJ6YmHkI+7FtZiCVp2YzOcSWfgxRHVpygtg6dWcGfizlGvLYLka5NDu4kgDj58FbEBJErPZTxC5yLtqY6E9fOkjj8FuhDlvt7DOwU36gePLQM1zOuIl6vPZDssVdJIWbXMvm4V9e9vPLX+PJ+CheDn6JaMOvYN1Nrrii1V7/ZGaF8mNKucg8O7p2O8s1JrQY97i52WQGXBrWX/10XPMyzTS3Mxc3WNq78vK/bIyLKEXkslz6rEI11ERW74AYkctY6nxEjcBPnQyI+vHvMjLqrVGzCAfJl3ed8MlHNOExKTg+Xhw2ttl/oGvxjg/ucDpCd5k1gv4pdCEHvhv6cAghQn6vxeA6lR/TYsa9IOkEedY/CbZFXznJ9Gfo8aWBbvUJxnJ1/3+L4/he66aGYb4IlQ3TSoIIDhzCCA4MwggLsoAMCAQICAQAwDQYJKoZIhvcNAQEFBQAwgY4xCzAJBgNVBAYTAlVTMQswCQYDVQQIEwJDQTEWMBQGA1UEBxMNTW91bnRhaW4gVmlldzEUMBIGA1UEChMLUGF5UGFsIEluYy4xEzARBgNVBAsUCmxpdmVfY2VydHMxETAPBgNVBAMUCGxpdmVfYXBpMRwwGgYJKoZIhvcNAQkBFg1yZUBwYXlwYWwuY29tMB4XDTA0MDIxMzEwMTMxNVoXDTM1MDIxMzEwMTMxNVowgY4xCzAJBgNVBAYTAlVTMQswCQYDVQQIEwJDQTEWMBQGA1UEBxMNTW91bnRhaW4gVmlldzEUMBIGA1UEChMLUGF5UGFsIEluYy4xEzARBgNVBAsUCmxpdmVfY2VydHMxETAPBgNVBAMUCGxpdmVfYXBpMRwwGgYJKoZIhvcNAQkBFg1yZUBwYXlwYWwuY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDBR07d/ETMS1ycjtkpkvjXZe9k+6CieLuLsPumsJ7QC1odNz3sJiCbs2wC0nLE0uLGaEtXynIgRqIddYCHx88pb5HTXv4SZeuv0Rqq4+axW9PLAAATU8w04qqjaSXgbGLP3NmohqM6bV9kZZwZLR/klDaQGo1u9uDb9lr4Yn+rBQIDAQABo4HuMIHrMB0GA1UdDgQWBBSWn3y7xm8XvVk/UtcKG+wQ1mSUazCBuwYDVR0jBIGzMIGwgBSWn3y7xm8XvVk/UtcKG+wQ1mSUa6GBlKSBkTCBjjELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAkNBMRYwFAYDVQQHEw1Nb3VudGFpbiBWaWV3MRQwEgYDVQQKEwtQYXlQYWwgSW5jLjETMBEGA1UECxQKbGl2ZV9jZXJ0czERMA8GA1UEAxQIbGl2ZV9hcGkxHDAaBgkqhkiG9w0BCQEWDXJlQHBheXBhbC5jb22CAQAwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQUFAAOBgQCBXzpWmoBa5e9fo6ujionW1hUhPkOBakTr3YCDjbYfvJEiv/2P+IobhOGJr85+XHhN0v4gUkEDI8r2/rNk1m0GA8HKddvTjyGw/XqXa+LSTlDYkqI8OwR8GEYj4efEtcRpRYBxV8KxAW93YDWzFGvruKnnLbDAF6VR5w/cCMn5hzGCAZowggGWAgEBMIGUMIGOMQswCQYDVQQGEwJVUzELMAkGA1UECBMCQ0ExFjAUBgNVBAcTDU1vdW50YWluIFZpZXcxFDASBgNVBAoTC1BheVBhbCBJbmMuMRMwEQYDVQQLFApsaXZlX2NlcnRzMREwDwYDVQQDFAhsaXZlX2FwaTEcMBoGCSqGSIb3DQEJARYNcmVAcGF5cGFsLmNvbQIBADAJBgUrDgMCGgUAoF0wGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcNMjMwMzMwMTg1ODI1WjAjBgkqhkiG9w0BCQQxFgQUbqm8W0o3oci2PrOitHK/N4Dyq4MwDQYJKoZIhvcNAQEBBQAEgYCw0uB4kLvNto317VkK0IkHc3V6RxVHmTJU7KePgkmglWVtWJdBbSwwrF+FiTrrFOZLZh8YmO6GiptSDRF1eDXvFuFu9tM+jkq4Grzna3DagJM6k9Q27xZWm0m/8QGaK/NjcuIBrqJwY5yT3gY9qYppwesyQIhwW9eqxUhHj/D0/Q==-----END PKCS7-----">
<input type="image" src="https://www.paypalobjects.com/en_US/i/btn/btn_buynowCC_LG.gif" border="0" name="submit" alt="PayPal - The safer, easier way to pay online!">
<img alt="" border="0" src="https://www.paypalobjects.com/ar_EG/i/scr/pixel.gif" width="1" height="1">
</form>

IPN回调处理代码（listener.php） #

if ($_SERVER['REQUEST_METHOD'] != "POST") {
    header("Location: ../../courses/courses.php");
    exit();
}
session_start();
$email = $_SESSION['email'];
$course_name = $_SESSION['course_name'];
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, 'https://ipnpb.paypal.com/cgi-bin/webscr');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, "cmd=_notify-validate&" . http_build_query($_POST));
$response = curl_exec($ch);
curl_close($ch);
if ($response == "VERIFIED") {
    $name = $_POST['first_name'] . " " . $_POST['last_name'];
    $cEamil = $_POST['payer_email'];
    $price = $_POST['mc_gross'];
    $currency = $_POST['mc_currency'];
    $item = $_POST['item_number'];
    $paymentStatus = $_POST['payment_status'];
    if ($paymentStatus == "Completed" && $price == 20) {
        $servername = "localhost";
        $username = "username";
        $password = "password";
        $database = "database";
        $conn = new mysqli($servername, $username, $password, $database);
        $sql = "SELECT bought_courses FROM users WHERE `email` = '$email'";
        $result = $conn->query($sql);
        $row = $result->fetch_assoc();
        if ($row['bought_courses'] != "") {
            $bought_courses = $row['bought_courses'] . ',' .  $course_name;
        }else {
            $bought_courses = $course_name;
        }
        $sql = "UPDATE users SET bought_courses = '$bought_courses' WHERE `email` = '$email'";
        $result = $conn->query($sql);
    }
}

排查方向及解决方案 #

• 账户合规验证
  • 检查PayPal账户是否完成全部身份验证流程，包括提交身份证、地址证明、经营相关文件，未完成验证的账户会触发国际合规拦截。
  • 登录PayPal后台查看账户状态，确认无违规记录或限制通知。
• 交易信息合规
  • 确认课程内容符合PayPal的商品政策，禁止售卖侵权、违法或违反PayPal条款的内容。
  • 检查按钮配置的商品名称、价格是否清晰准确，避免模糊描述触发合规检测。
• 按钮配置修正
  • 重新生成加密按钮，确保使用当前账户的最新加密密钥，避免密钥过期或配置错误导致的验证失败。
  • 如果是测试交易，切换到沙箱环境（按钮action改为https://www.sandbox.paypal.com/cgi-bin/webscr），使用沙箱账户测试，真实账户的测试交易易触发合规限制。
• IPN代码修复
  • 启用SSL验证：将CURLOPT_SSL_VERIFYHOST设为2，CURLOPT_SSL_VERIFYPEER设为1，禁用SSL验证会降低安全性，可能被PayPal判定为高风险交易。确保服务器安装了有效的CA证书。
  • 移除Session依赖：IPN回调由PayPal服务器发起，不携带用户Session，$_SESSION['email']和$_SESSION['course_name']无法获取有效数据。应在按钮表单中添加自定义字段（如<input type="hidden" name="custom" value="用户ID|课程ID">），从$_POST['custom']解析订单关联信息。
  • 修复SQL注入风险：使用mysqli预处理语句替代直接拼接SQL，避免安全漏洞，示例：

    $stmt = $conn->prepare("SELECT bought_courses FROM users WHERE email = ?");
    $stmt->bind_param("s", $email);
    $stmt->execute();
    $result = $stmt->get_result();
    

• 区域合规检查
  • 确认PayPal账户支持的交易区域与测试用户的所在区域匹配，部分地区对跨境交易有严格限制。

内容的提问来源于stack exchange，提问作者Mohammed Fahd