PHP集成支付网关时如何防范Amount Tampering（金额篡改）风险？

Hey there, let’s dive straight into fixing this critical issue—amount tampering is one of the most common attack vectors in payment integrations, but it’s totally manageable with the right safeguards. Here’s what you need to implement in your PHP code:

1. Never Trust Frontend-Sent Amounts #

The biggest mistake developers make is relying on the amount passed from the user’s browser (like via a form input or AJAX request). Attackers can easily modify this value using browser dev tools. Instead:

• Only pass an order ID from the frontend to your server.
• Fetch the actual order amount directly from your database using that order ID when preparing the payment request to the gateway.

Example PHP snippet:

// Get order ID from frontend (never trust $_POST['amount']!)
$orderId = $_POST['order_id'];

// Fetch order details from your database (use prepared statements to prevent SQL injection!)
$stmt = $pdo->prepare("SELECT amount FROM orders WHERE id = ?");
$stmt->execute([$orderId]);
$order = $stmt->fetch(PDO::FETCH_ASSOC);

$validAmount = $order['amount']; // This is the only amount you should use for payment

2. Use Gateway-Provided Signature/HMAC Verification #

Most reputable payment gateways provide a way to sign your payment requests and verify their responses using a secret key. This ensures that the amount (and other critical data) hasn’t been altered in transit.

How it works: #

• When sending a request to the gateway, generate a signature using your secret key, combining critical parameters like order_id, amount, currency, etc.
• The gateway will return a signature with its callback response—verify this signature on your server before processing the payment.

Example PHP signature generation and verification:

// Your secret key (keep this stored securely, never expose it to the frontend!)
$secretKey = 'your_secure_gateway_secret';

// Generate signature for outgoing payment request
$params = [
    'order_id' => $orderId,
    'amount' => $validAmount,
    'currency' => 'USD'
];
// Sort params to ensure consistent hashing (gateways often require this!)
ksort($params);
$signatureString = http_build_query($params);
$requestSignature = hash_hmac('sha256', $signatureString, $secretKey);

// Verify gateway callback signature
$callbackSignature = $_POST['gateway_signature'];
$callbackParams = [
    'order_id' => $_POST['order_id'],
    'amount' => $_POST['amount'],
    'status' => $_POST['status']
];
ksort($callbackParams);
$verifyString = http_build_query($callbackParams);
$validCallbackSignature = hash_hmac('sha256', $verifyString, $secretKey);

if ($callbackSignature !== $validCallbackSignature) {
    // Reject the callback—data was tampered with!
    http_response_code(403);
    exit("Invalid signature");
}

3. Validate Amounts in Gateway Callbacks #

Even if you signed the request, always cross-check the amount returned in the gateway’s callback with the amount stored in your database. Attackers might try to manipulate the callback data (though signature verification should catch this, it’s an extra layer of defense).

Example check:

$callbackAmount = $_POST['amount'];
if ($callbackAmount != $validAmount) {
    // Log the discrepancy and reject the payment
    error_log("Amount tampering detected: Order $orderId - Expected $validAmount, Got $callbackAmount");
    http_response_code(400);
    exit("Amount mismatch");
}

4. Enforce Order State Management #

Prevent duplicate payments or status tampering by tracking order states in your database:

• Set orders to pending_payment when the user initiates payment.
• Only mark an order as paid if the callback is valid and the order is still in pending_payment state.
• If a callback comes in for an already paid order, ignore it and log the event.

5. Use HTTPS Everywhere #

Ensure all communication between your server, the user’s browser, and the payment gateway uses HTTPS. This prevents man-in-the-middle attacks where an attacker could intercept and modify payment data in transit.

6. Log All Payment Activity #

Keep detailed logs of every payment request, callback, and verification step. This helps you investigate any suspicious activity quickly. Log things like:

• Order ID, timestamp, requested amount, gateway response amount
• Signature verification results
• Order state changes

Example logging in PHP:

$logData = json_encode([
    'timestamp' => date('Y-m-d H:i:s'),
    'order_id' => $orderId,
    'expected_amount' => $validAmount,
    'callback_amount' => $_POST['amount'],
    'signature_valid' => ($callbackSignature === $validCallbackSignature),
    'status' => $_POST['status']
]);
file_put_contents('payment_logs.txt', $logData . PHP_EOL, FILE_APPEND);

Content of the question comes from Stack Exchange, asked by NightOwl