Checksum Mechanism
When POST data to ECPay , all parameters/fields and values must go through checksum except for the field [CheckMacValue]. The following demonstrates how checksum works step by step when calling API [AioCheckOut] (to create an order).
The following is an example of a query string to be encrypted
The checksum works as follows
(1) The query string to be be sorted alphabetically (A-Z) and linked with an ampersand (&).
Special Note：
If using PHP, use urlencode() (RFC 1866) and use str_replace() to replace the characters according to the urlencode conversion table.
Special Note：
Use strtolower() if you are using PHP. Special Note：
(1) The merchant must check [CheckMacValue] to verify when they receive information transmitted by ECPay . If the merchant does not check, they may suffer from losses.
(2) Please use SHA256 encryption to generate hash values.
(3) Please make sure that the the converted results after UrlEncode function in your language corresponds to the “.NET Encoding (ecpay)” value in the URLENCODE CONVERSION TABLE. If there are any unsupported characters, please use the character replacement function so the results will pass the checksum test.
For example: PHP urlencode function will encode ! Into %21, which is not accepted according to the “.NET encoding (ecpay)” rules, so the %21 will have to be converted back into ! With str_replace function after the PHP urlencode function. Here’s a PHP conversion example:
- $sMacValue = str_replace(‘%2d’, ‘-‘, $sMacValue);
- $sMacValue = str_replace(‘%5f’, ‘_’, $sMacValue);
- $sMacValue = str_replace(‘%2e’, ‘.’, $sMacValue);
- $sMacValue = str_replace(‘%21’, ‘!’, $sMacValue);
- $sMacValue = str_replace(‘%2a’, ‘*’, $sMacValue);
- $sMacValue = str_replace(‘%28’, ‘(‘, $sMacValue);
- $sMacValue = str_replace(‘%29’, ‘)’, $sMacValue);
For conversion functions in other programming languages, please refer to the relevant encoding conversion rules.