PayPal 即時到帳 PHP 實作：ECShop 範例與官方 IPN 驗證代碼

ECShop 風格提交表單

<form target="_blank" method="post" action="https://www.paypal.com/cgi-bin/webscr">
  <input type="hidden" name="cmd" value="_xclick">
  <input type="hidden" name="business" value="merchant@example.com">
  <input type="hidden" name="item_name" value="訂單號: 2009102370175">
  <input type="hidden" name="amount" value="2888.00">
  <input type="hidden" name="currency_code" value="USD">
  <input type="hidden" name="return" value="https://yoursite.com/respond.php?code=paypal">
  <input type="hidden" name="notify_url" value="https://yoursite.com/respond.php?code=paypal">
  <input type="hidden" name="invoice" value="3">
  <input type="hidden" name="charset" value="utf-8">
  <input type="hidden" name="no_shipping" value="1">
  <input type="hidden" name="rm" value="2">
  <input type="submit" value="立即使用 PayPal 付款">
</form>

官方 IPN 驗證標準代碼 (PHP)

<?php
// 1. 組裝驗證請求
$req = 'cmd=_notify-validate';
foreach ($_POST as $key => $value) {
    $value = urlencode(stripslashes($value));
    $req .= "&$key=$value";
}

// 2. 發送回 PayPal 驗證 (建議用 cURL)
$ch = curl_init('https://www.paypal.com/cgi-bin/webscr');
curl_setopt_array($ch, [
    CURLOPT_POST => true,
    CURLOPT_POSTFIELDS => $req,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_SSL_VERIFYPEER => true,
    CURLOPT_HTTPHEADER => ['Content-Type: application/x-www-form-urlencoded'],
]);
$res = curl_exec($ch);
curl_close($ch);

// 3. 解析關鍵變數
$item_name        = $_POST['item_name'];
$item_number      = $_POST['item_number'];
$payment_status   = $_POST['payment_status'];   // Completed, Pending, Failed...
$payment_amount   = $_POST['mc_gross'];         // 總金額
$payment_currency = $_POST['mc_currency'];      // 幣別
$txn_id           = $_POST['txn_id'];           // 交易唯一ID
$receiver_email   = $_POST['receiver_email'];
$payer_email      = $_POST['payer_email'];

// 4. 判斷結果並處理
if (strcmp($res, "VERIFIED") === 0) {
    if ($payment_status === 'Completed') {
        // TODO: 檢查 txn_id 是否已處理、receiver_email 是否正確、金額幣別是否匹配
        // 更新訂單狀態、發貨、送通知
    }
} elseif (strcmp($res, "INVALID") === 0) {
    // 記錄日誌供人工稽核
    error_log("PayPal IPN INVALID: " . print_r($_POST, true));
}
?>

關鍵變數對照表

安全提醒

• 務必使用 HTTPS 驗證回 PayPal
• IPN 處理頁面不能有任何輸出，需在 30 秒內回應 200 OK
• 資料庫以 txn_id 為唯一鍵，防止重複處理
• 定期對帳：下載 PayPal 交易報表與本地訂單比對