搭建Square信用卡支付网站：如何用PHP免JS获取Card Nonce？

Short answer: No, you can't—and here's why, plus how the compliant, intended flow works.

Square's card nonce system is fundamentally designed to keep sensitive credit card data off your servers to maintain PCI compliance. If you tried to handle raw card numbers directly in your PHP backend, you'd have to meet extremely strict PCI DSS requirements (think costly security audits, full data encryption, and ongoing compliance maintenance—something most small to mid-sized apps can't sustain). Square's frontend tools exist specifically to avoid this risk.

The standard, secure workflow breaks down into two parts: #

• Step 1: Generate the Nonce with Square's Frontend JavaScript SDK
  You’ll need to embed Square.js (or use their pre-built payment form) in your frontend. This SDK creates a secure, isolated iframe to collect card details—your code never touches the raw card number. When the user submits their payment info, the SDK talks directly to Square’s servers to generate a one-time-use nonce.
  Simplified example snippet:

  const payments = Square.payments('YOUR_SQUARE_APP_ID', 'YOUR_LOCATION_ID');
  const card = await payments.card();
  await card.attach('#card-payment-container');
  
  const tokenResult = await card.tokenize();
  if (tokenResult.status === 'OK') {
    const cardNonce = tokenResult.token;
    // Send this nonce to your PHP backend via form submission or AJAX
  }
  

• Step 2: Use the Nonce in Your PHP Backend
  Once your PHP server receives the nonce, you can use Square’s PHP SDK to process the payment. Here’s a quick implementation example:

  require 'vendor/autoload.php';
  
  $squareClient = new Square\SquareClient([
    'accessToken' => 'YOUR_SQUARE_ACCESS_TOKEN',
    'environment' => Square\Environment::SANDBOX // Switch to PRODUCTION for live use
  ]);
  
  $paymentsApi = $squareClient->getPaymentsApi();
  try {
    $paymentResponse = $paymentsApi->createPayment([
      'sourceId' => $_POST['card_nonce'], // The nonce sent from the frontend
      'amountMoney' => [
        'amount' => 100, // $1.00 expressed in cents
        'currency' => 'USD'
      ],
      'idempotencyKey' => uniqid() // Prevents duplicate payments
    ]);
    // Handle successful payment logic here
  } catch (Exception $e) {
    // Handle payment errors (e.g., declined card, invalid nonce)
  }
  

Why skipping JavaScript isn’t feasible: #

• Square’s Terms of Service: You’re explicitly prohibited from handling raw card data directly. Violating this could result in your account being suspended.
• PCI Compliance Risks: Managing card data on your servers requires a level of security infrastructure that’s prohibitively expensive for most businesses.
• Technical Restrictions: Square doesn’t offer an API endpoint to generate nonces from raw card numbers in backend code—this functionality is locked to their frontend tools for security.

If you’re concerned about frontend complexity, Square offers pre-built, customizable payment forms that reduce the amount of custom JavaScript you need to write. It’s well worth the small setup effort to stay compliant and secure.

内容的提问来源于stack exchange，提问作者Rania Fathy