使用PHP验证Android Market许可响应的服务器端

Question

我正在构建一个服务器来测试我所有的Android应用内购买市场.但我认为我没有正确地从应用程序发送信息.我的服务器是用PHP构建的.

我的应用访问网址:

...&response={...json...}&signature={...signature...}

签名先前使用URLEncoder.encode编码(签名,"UTF-8")

我的服务器:

$response = $_GET["response"];
$signature = htmlspecialchars(urldecode($_GET["signature"]));

然后我执行验证过程.我认为问题来自于我将参数从应用程序传递到服务器的方式,因为如果我手动复制响应和签名并测试它们,验证函数会说它们是有效的.

网址:

...&响应= { "随机数": - 871647007848398655 "订单":[{ "订单ID": "768142460571407", "的packageName": "net.xxx.aaa", "的productId":"net.xxx.mmf.空战英豪 " "purchaseTime":1330090436000 "purchaseState":0 "developerPayload": "空战英豪"},{ "订单ID": "203523162686707", "的packageName": "net.xxx.aaa", "的productId":" net.xxx.mmf.16blocks","purchaseTime":1330511533000,"purchaseState":0,"developerPayload":"16 Blocks"},{"orderId":"328483664834399","packageName":"net.xxx.aaa ", "的productId": "net.xxx.mmf.aceventura3", "purchaseTime":1331037005000 "purchaseState":0 "developerPayload": "艾丝3"}]}&签名= EyT9IgZeq2OLRqCtabTIc5wOKARtdHUfCQAdkEqkGyi%2Bd1qQgcfxPnvIa9VMDQqwh8rxxGPOYQKuhaEuZUJzbSain8%2FN7p41euzb1n1%2FgZkgqXlQTDn076U2AXcp1ymBFZamrwETo0gkZi4q6PZV47oR7Rk28vPU5vjs% 2Bl0TN0DdlzclHuH40CkZqD1ErSMMwWGTGR6bGnJlmmhgHC2KV7Ab63i0hdgkqk5MOtkOxhjS%2B4LG1YxmJIsxhJnOcmNI7n2VKUdtn%2B0CWxO5M8m0BcfpZ9Se3sR6ZtVli2rS1KSKQPL1Td9GWPhmG4nvzZFtKCqf9Le6Meudv6iFTSw5Hg%3D%3D

Vardump

响应

string'{"nonce": - 871647007848398655,"orders":[{"orderId":"768142460571407","packageName":"net.xxx.aaa","productId":"net.xxx.mmf.flyboys", "purchaseTime":1330090436000 "purchaseState":0 "developerPayload": "空战英豪"},{ "订单ID": "203523162686707", "的packageName": "net.xxx.aaa", "的productId":"net.xxx .mmf.16blocks","purchaseTime":1330511533000,"purchaseState":0,"developerPayload":"16 Blocks"},{"orderId":"328483664834399","packageName":"net.xxx.aaa"," productId":"net.xxx'...(长度= 617)

签名

字符串 'EyT9IgZeq2OLRqCtabTIc5wOKARtdHUfCQAdkEqkGyi d1qQgcfxPnvIa9VMDQqwh8rxxGPOYQKuhaEuZUJzbSain8/N7p41euzb1n1/gZkgqXlQTDn076U2AXcp1ymBFZamrwETo0gkZi4q6PZV47oR7Rk28vPU5vjs l0TN0DdlzclHuH40CkZqD1ErSMMwWGTGR6bGnJlmmhgHC2KV7Ab63i0hdgkqk5MOtkOxhjS 4LG1YxmJIsxhJnOcmNI7n2VKUdtn 0CWxO5M8m0BcfpZ9Se3sR6ZtVli2rS1KSKQPL1Td9GWPhmG4nvzZFtKCqf9Le6Meudv6iFTSw5Hg =='(长度= 344)

Answer 1

当使用 URL Encode 时，php 会自动解码数据，所以如果你重新解码它会破坏一些东西，我以前遇到过这个问题

URL 编码是针对浏览器的，因此虽然 get 发送的字符串中的 & 之类的内容不会充当 GET 中的新参数

所以对你来说代码htmlspecialchars(urldecode($_GET["signature"]));应该是htmlspecialchars($_GET["signature"]);

我知道这已经通过评论得到了回答，但为 Google 员工添加了答案