<?php
// 支付通知 - 接收平台回调并验签
$apiKey = '{YOUR_API_KEY}';
$params = $_POST;
$userSign = $params['sign'];
unset($params['sign']);

// 验签：参数按key ASCII排序，拼接后追加key，MD5大写
ksort($params);
$signStr = urldecode(http_build_query($params)) . '&key=' . $apiKey;
$calcSign = strtoupper(md5($signStr));

if ($calcSign === $userSign) {
    // 验签成功，处理业务逻辑
    $trade_no    = $params['trade_no'];       // 平台订单号
    $out_trade_no= $params['out_trade_no'];   // 商户订单号
    $trade_state = $params['trade_state'];    // 订单状态
    // TODO: 更新订单状态...
    echo 'success';
} else {
    echo 'fail';
}

import hashlib
from flask import Flask, request

app = Flask(__name__)
api_key = '{YOUR_API_KEY}'

@app.route('/notify', methods=['POST'])
def pay_notify():
    # 支付通知 - 接收平台回调并验签
    params = dict(request.form)
    user_sign = params.pop('sign', '')
    sorted_keys = sorted(params.keys())
    sign_str = '&'.join(f'{k}={params[k]}' for k in sorted_keys) + '&key=' + api_key
    calc_sign = hashlib.md5(sign_str.encode()).hexdigest().upper()
    if calc_sign == user_sign:
        trade_no = params.get('trade_no')
        out_trade_no = params.get('out_trade_no')
        # TODO: 更新订单状态...
        return 'success'
    return 'fail'

import javax.servlet.http.*;
import java.security.MessageDigest;
import java.util.*;

// 支付通知 - 接收平台回调并验签（Servlet示例）
public class PayNotifyServlet extends HttpServlet {
    private static final String API_KEY = "{YOUR_API_KEY}";

    @Override
    protected void doPost(HttpServletRequest req, HttpServletResponse resp)
            throws Exception {
        Map<String, String> params = new TreeMap<>();
        String userSign = "";
        for (Map.Entry<String, String[]> e : req.getParameterMap().entrySet()) {
            if ("sign".equals(e.getKey())) { userSign = e.getValue()[0]; continue; }
            params.put(e.getKey(), e.getValue()[0]);
        }
        // 验签
        StringBuilder sb = new StringBuilder();
        for (Map.Entry<String, String> e : params.entrySet())
            sb.append(e.getKey()).append("=").append(e.getValue()).append("&");
        sb.append("key=").append(API_KEY);
        String calcSign = md5(sb.toString()).toUpperCase();
        if (calcSign.equals(userSign)) {
            String tradeNo = params.get("trade_no");
            String outTradeNo = params.get("out_trade_no");
            // TODO: 更新订单状态...
            resp.getWriter().write("success");
        } else {
            resp.getWriter().write("fail");
        }
    }
    static String md5(String s) throws Exception {
        MessageDigest md = MessageDigest.getInstance("MD5");
        byte[] digest = md.digest(s.getBytes("UTF-8"));
        StringBuilder sb = new StringBuilder();
        for (byte b : digest) sb.append(String.format("%02x", b));
        return sb.toString();
    }
}

const crypto = require('crypto');
const express = require('express');
const app = express();
app.use(express.urlencoded({ extended: true }));

const apiKey = '{YOUR_API_KEY}';

// 支付通知 - 接收平台回调并验签
app.post('/notify', (req, res) => {
    const params = { ...req.body };
    const userSign = params.sign;
    delete params.sign;
    const sortedKeys = Object.keys(params).sort();
    const signStr = sortedKeys.map(k => `=`).join('&') + '&key=' + apiKey;
    const calcSign = crypto.createHash('md5').update(signStr).digest('hex').toUpperCase();
    if (calcSign === userSign) {
        const { trade_no, out_trade_no } = params;
        // TODO: 更新订单状态...
        res.send('success');
    } else {
        res.send('fail');
    }
});
app.listen(3000);

using Microsoft.AspNetCore.Mvc;
using System.Security.Cryptography;
using System.Text;

// 支付通知 - 接收平台回调并验签（ASP.NET Core示例）
[HttpPost("notify")]
public IActionResult PayNotify([FromForm] Dictionary<string, string> form) {
    var apiKey = "{YOUR_API_KEY}";
    var userSign = form["sign"];
    form.Remove("sign");
    var sorted = form.OrderBy(x => x.Key, StringComparer.Ordinal).ToList();
    var signStr = string.Join("&", sorted.Select(p => $"{p.Key}={p.Value}")) + "&key=" + apiKey;
    using var md5 = MD5.Create();
    var calcSign = BitConverter.ToString(md5.ComputeHash(Encoding.UTF8.GetBytes(signStr))).Replace("-","").ToUpper();
    if (calcSign == userSign) {
        var tradeNo = form["trade_no"];
        var outTradeNo = form["out_trade_no"];
        // TODO: 更新订单状态...
        return Content("success");
    }
    return Content("fail");
}

package main

import (
    "crypto/md5"
    "fmt"
    "net/http"
    "sort"
    "strings"
)

// 支付通知 - 接收平台回调并验签（Go示例）
func payNotifyHandler(w http.ResponseWriter, r *http.Request) {
    apiKey := "{YOUR_API_KEY}"
    r.ParseForm()
    params := r.PostForm
    userSign := params.Get("sign")
    params.Del("sign")

    keys := make([]string, 0)
    for k := range params { keys = append(keys, k) }
    sort.Strings(keys)
    var parts []string
    for _, k := range keys { parts = append(parts, k+"="+params.Get(k)) }
    signStr := strings.Join(parts, "&") + "&key=" + apiKey
    calcSign := fmt.Sprintf("%X", md5.Sum([]byte(signStr)))

    if calcSign == userSign {
        tradeNo := params.Get("trade_no")
        outTradeNo := params.Get("out_trade_no")
        _ = tradeNo
        _ = outTradeNo
        // TODO: 更新订单状态...
        w.Write([]byte("success"))
    } else {
        w.Write([]byte("fail"))
    }
}