3D Secure测试页面空白问题：test.sagepay.com返回空白页求助

Let me walk through some targeted fixes based on your scenario—this is a common pain point with Sagepay's 3D Secure flow, especially in PHP setups.

First, Break Down the Core Issues #

Your original form action was missing the required auth parameter, which explains the blank page. But adding ?action=auth led to null fields because the payload Sagepay needs to populate those fields got corrupted somewhere in your PHP handling.

Key Fixes to Implement #

1. Stop Encoding/Trimming the PaReq Value #

The PaReq is a base64-encoded payload that Sagepay generates specifically for the 3D Secure flow. Do not run trim() or urlencode() on it—these functions will break the structure of the encoded data, leading to null fields when the page loads.

Instead, only use htmlspecialchars() to safely output it in your form (to prevent XSS risks):

<input type="hidden" name="PaReq" value="<?= htmlspecialchars($paReq, ENT_QUOTES) ?>" />

2. Fix the Form Action Properly #

The correct action URL should include the action=auth parameter directly. Update your form's action attribute to:

https://test.sagepay.com/mpitools/accesscontroler?action=auth

Don't leave the parameter hanging as ?action—this incomplete request is why you got a blank page initially.

3. Validate Your TermUrl #

• Double-check that the TermUrl matches exactly what's registered in your Sagepay test account (even a tiny typo like missing s in https or an extra trailing slash can cause silent failures).
• Ensure this URL is publicly accessible—Sagepay needs to reach it to send the 3D Secure callback, even in test mode.

4. Eliminate PHP Output/Whitespace Issues #

Blank pages in PHP often come from accidental whitespace or early output before headers. Check:

• No whitespace before the <?php opening tag in any included files.
• You're not echoing content before rendering the form (unless it's part of the form itself).
• Temporarily disable output buffering functions to rule out conflicts.

5. Test with a Static HTML Form #

To isolate whether the problem is in your PHP code, create a static HTML file with the exact form fields you pulled from Chrome DevTools. Host it on your server and submit it directly. If this loads the 3D Secure page correctly, the issue is definitely in how your PHP is processing the MD, PaReq, or TermUrl values.

Final Checks #

• Confirm your Sagepay test account has 3D Secure enabled (some accounts require explicit activation).
• Check the Sagepay merchant dashboard logs for error messages related to your MD or PaReq values—this will give you direct insight into what's failing on their end.

内容的提问来源于stack exchange，提问作者John