PHP Version - SOURECO

This document provides two sets of signature algorithm implementations in PHP, fully aligned with the backend Java signature logic:

1.Universal Parameter Signature: Applicable to GET requests and Form submission interfaces
2.JSON POST Simplified Signature: Applicable to JSON request body interfaces (Recommended)

Important Conventions

MD5 output must be all uppercase

Encoding is uniformly UTF-8

Parameter concatenation does NOT use URL Encode

Only skip parameters with null values; empty strings "" are included in signature calculation

1. Universal Parameter Signature (GET / Form Parameters)

Algorithm Workflow

1.Remove the sign field from the parameter array
2.Sort the remaining parameters in ascending dictionary order by key
3.Concatenate as key=value&, filtering out key-value pairs where value is null
4.Append secret={appSecret} to the end of the string
5.Compute MD5 of the concatenated string and convert to uppercase to obtain the signature

PHP Utility Methods

Usage Example

2. POST JSON Simplified Signature (Recommended)

Algorithm Workflow

The JSON request body carries three fixed top-level fields:

{
  "appKey": "AppKey assigned to the client",
  "requestTime": "Timestamp string (seconds/milliseconds)",
  "sign": "Generated signature"
}

Signature Calculation Formula:

sign = strtoupper(md5(appKey + requestTime + appSecret))

PHP Utility Methods

Usage Example

3. Integration Precautions ⚠️

1.Do NOT URL-encode parameters — the original Java logic does not apply encoding; encoding will cause signature mismatch;
2.Numeric parameters should be explicitly converted to strings when possible — 100 and "100" produce different concatenation results;
3.MD5 result must be uppercase;
4.Avoid array parameters when possible. If arrays are necessary, ensure serialization rules are consistent between client and server;
5.Timestamps support both second and millisecond formats — the server-side utility automatically handles both;
6.Never expose the appSecret in plaintext on the frontend.