Complete PHP Payment Gateway Integration

mkdir payment-integration
cd payment-integration
composer require razorpay/razorpay

php -r "copy('https://getcomposer.org/installer', 'composer-setup.php');"
php composer-setup.php
sudo mv composer.phar /usr/local/bin/composer

composer --version

# Windows
cd C:\xampp\htdocs

# Mac
cd /Applications/XAMPP/htdocs

mkdir payment-integration
cd payment-integration
composer require razorpay/razorpay

CREATE TABLE orders (
    id INT AUTO_INCREMENT PRIMARY KEY,
    razorpay_order_id VARCHAR(100) NOT NULL,
    razorpay_payment_id VARCHAR(100) DEFAULT NULL,
    amount DECIMAL(10,2) NOT NULL,
    currency VARCHAR(10) DEFAULT 'INR',
    status ENUM('created','paid','failed','refunded') DEFAULT 'created',
    customer_email VARCHAR(150),
    customer_name VARCHAR(150),
    customer_phone VARCHAR(20),
    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
    updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP
);

-- Webhook events log (for debugging & audit trail)
CREATE TABLE webhook_logs (
    id INT AUTO_INCREMENT PRIMARY KEY,
    event_type VARCHAR(100),
    payload TEXT,
    received_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
);

<?php
// config.php

// Test keys અહીં મૂકો (Razorpay Dashboard > Settings > API Keys)
define('RAZORPAY_KEY_ID', getenv('RAZORPAY_KEY_ID') ?: 'rzp_test_XXXXXXXXXXXX');
define('RAZORPAY_KEY_SECRET', getenv('RAZORPAY_KEY_SECRET') ?: 'YOUR_TEST_SECRET_KEY');
define('RAZORPAY_WEBHOOK_SECRET', getenv('RAZORPAY_WEBHOOK_SECRET') ?: 'YOUR_WEBHOOK_SECRET');

// Error reporting (development માં true, production માં false રાખવું)
define('APP_DEBUG', true);

if (APP_DEBUG) {
    error_reporting(E_ALL);
    ini_set('display_errors', 1);
} else {
    error_reporting(0);
    ini_set('display_errors', 0);
}

<?php
// db.php
$host = 'localhost';
$dbname = 'your_database';
$user = 'your_db_user';
$pass = 'your_db_password';

try {
    $pdo = new PDO(
        "mysql:host=$host;dbname=$dbname;charset=utf8mb4",
        $user,
        $pass,
        [
            PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION,
            PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC,
            PDO::ATTR_EMULATE_PREPARES => false, // real prepared statements, SQL injection સામે વધુ સુરક્ષિત
        ]
    );
} catch (PDOException $e) {
    // ગુજરાતી નોંધ: production માં raw error message user ને ના બતાવવો
    error_log('DB Connection Error: ' . $e->getMessage());
    die('Database connection failed. Please try again later.');
}

<?php
// create_order.php
require 'vendor/autoload.php';
require 'config.php';
require 'db.php';

use Razorpay\Api\Api;

header('Content-Type: application/json');

// ✅ સાચી રીત: amount ને product/cart ID પરથી server-side lookup કરો
// ઉદાહરણ તરીકે અહીં એક product ID hardcode કરેલો છે, real app માં DB query કરો:
$productId = $_POST['product_id'] ?? null;

// Example lookup (વાસ્તવિક app માં તમારા products table માંથી ભાવ મેળવો)
$priceList = [
    'P001' => 499.00,
    'P002' => 999.00,
];

if (!$productId || !isset($priceList[$productId])) {
    http_response_code(400);
    echo json_encode(['success' => false, 'error' => 'Invalid product']);
    exit;
}

$amountInRupees = $priceList[$productId];
$amountInPaise = (int) round($amountInRupees * 100); // Razorpay પૈસા (paise) માં amount લે છે

$customerEmail = filter_input(INPUT_POST, 'email', FILTER_SANITIZE_EMAIL) ?: 'guest@example.com';
$customerName  = htmlspecialchars($_POST['name'] ?? 'Guest', ENT_QUOTES);
$customerPhone = htmlspecialchars($_POST['phone'] ?? '', ENT_QUOTES);

try {
    $api = new Api(RAZORPAY_KEY_ID, RAZORPAY_KEY_SECRET);

    $razorpayOrder = $api->order->create([
        'receipt'         => 'rcpt_' . time() . '_' . rand(1000, 9999),
        'amount'          => $amountInPaise,
        'currency'        => 'INR',
        'payment_capture' => 1, // 1 = auto-capture (પૈસા આપોઆપ capture થાય)
        'notes'           => [
            'product_id' => $productId,
        ],
    ]);

    $stmt = $pdo->prepare(
        "INSERT INTO orders (razorpay_order_id, amount, currency, customer_email, customer_name, customer_phone)
         VALUES (?, ?, 'INR', ?, ?, ?)"
    );
    $stmt->execute([$razorpayOrder['id'], $amountInRupees, $customerEmail, $customerName, $customerPhone]);

    echo json_encode([
        'success'  => true,
        'order_id' => $razorpayOrder['id'],
        'amount'   => $amountInPaise,
        'key'      => RAZORPAY_KEY_ID,
        'name'     => $customerName,
        'email'    => $customerEmail,
    ]);

} catch (Exception $e) {
    error_log('Order creation failed: ' . $e->getMessage());
    http_response_code(500);
    echo json_encode(['success' => false, 'error' => 'Could not create order. Please try again.']);
}

<!DOCTYPE html>
<html lang="gu">
<head>
    <meta charset="UTF-8">
    <title>Checkout - Payment Page</title>
</head>
<body>

    <h2>તમારું પેમેન્ટ પૂર્ણ કરો</h2>

    <form id="payment-form">
        <input type="hidden" id="product_id" value="P001">
        <input type="text" id="name" placeholder="પૂરું નામ" required><br><br>
        <input type="email" id="email" placeholder="ઈમેલ" required><br><br>
        <input type="tel" id="phone" placeholder="ફોન નંબર" required><br><br>
        <button type="submit">Pay ₹499</button>
    </form>

    <p id="status-msg"></p>

    <script src="https://checkout.razorpay.com/v1/checkout.js"></script>
    <script>
    document.getElementById('payment-form').addEventListener('submit', async function (e) {
        e.preventDefault();

        const statusMsg = document.getElementById('status-msg');
        statusMsg.textContent = 'ઓર્ડર બનાવી રહ્યા છીએ...';

        const name = document.getElementById('name').value;
        const email = document.getElementById('email').value;
        const phone = document.getElementById('phone').value;
        const productId = document.getElementById('product_id').value;

        try {
            // Step 1: Server પર order બનાવો
            const res = await fetch('create_order.php', {
                method: 'POST',
                headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
                body: `name=${encodeURIComponent(name)}&email=${encodeURIComponent(email)}&phone=${encodeURIComponent(phone)}&product_id=${encodeURIComponent(productId)}`
            });
            const data = await res.json();

            if (!data.success) {
                statusMsg.textContent = 'Error: ' + data.error;
                return;
            }

            statusMsg.textContent = '';

            // Step 2: Razorpay widget ખોલો
            const options = {
                key: data.key,
                amount: data.amount,
                currency: 'INR',
                name: 'Your Company Name',
                description: 'Order Payment',
                order_id: data.order_id,
                handler: function (response) {
                    statusMsg.textContent = 'Payment verify કરી રહ્યા છીએ...';

                    // Step 3: Payment details server ને મોકલો - verification માટે
                    fetch('verify_payment.php', {
                        method: 'POST',
                        headers: { 'Content-Type': 'application/json' },
                        body: JSON.stringify(response)
                    })
                    .then(r => r.json())
                    .then(result => {
                        if (result.success) {
                            window.location.href = 'success.php?order_id=' + data.order_id;
                        } else {
                            statusMsg.textContent = 'Payment verification નિષ્ફળ ગયું: ' + result.error;
                        }
                    })
                    .catch(() => {
                        statusMsg.textContent = 'Network error. Please contact support with your payment ID: ' + response.razorpay_payment_id;
                    });
                },
                prefill: { name: name, email: email, contact: phone },
                theme: { color: '#3399cc' },
                modal: {
                    ondismiss: function () {
                        statusMsg.textContent = 'તમે payment window બંધ કરી દીધી.';
                    }
                }
            };

            const rzp = new Razorpay(options);

            rzp.on('payment.failed', function (response) {
                statusMsg.textContent = 'Payment નિષ્ફળ: ' + response.error.description;
            });

            rzp.open();

        } catch (err) {
            statusMsg.textContent = 'કંઈક ખોટું થયું. ફરી પ્રયત્ન કરો.';
        }
    });
    </script>
</body>
</html>

<?php
// verify_payment.php
require 'vendor/autoload.php';
require 'config.php';
require 'db.php';

use Razorpay\Api\Api;
use Razorpay\Api\Errors\SignatureVerificationError;

header('Content-Type: application/json');

$input = json_decode(file_get_contents('php://input'), true);

$razorpayOrderId   = $input['razorpay_order_id'] ?? '';
$razorpayPaymentId = $input['razorpay_payment_id'] ?? '';
$razorpaySignature = $input['razorpay_signature'] ?? '';

if (!$razorpayOrderId || !$razorpayPaymentId || !$razorpaySignature) {
    http_response_code(400);
    echo json_encode(['success' => false, 'error' => 'Missing payment fields']);
    exit;
}

try {
    $api = new Api(RAZORPAY_KEY_ID, RAZORPAY_KEY_SECRET);

    $attributes = [
        'razorpay_order_id'   => $razorpayOrderId,
        'razorpay_payment_id' => $razorpayPaymentId,
        'razorpay_signature'  => $razorpaySignature,
    ];

    // આ line signature ચકાસે છે - mismatch હોય તો exception throw કરે
    $api->utility->verifyPaymentSignature($attributes);

    // Extra safety: order DB માં exist કરે છે અને amount મેચ થાય છે કે નહીં ચકાસો
    $stmt = $pdo->prepare("SELECT * FROM orders WHERE razorpay_order_id = ?");
    $stmt->execute([$razorpayOrderId]);
    $order = $stmt->fetch();

    if (!$order) {
        throw new Exception('Order not found in our records');
    }

    if ($order['status'] === 'paid') {
        // પહેલેથી જ paid છે - duplicate call, idempotent રીતે success return કરો
        echo json_encode(['success' => true, 'message' => 'Already verified']);
        exit;
    }

    // બધુ બરાબર - status update કરો
    $stmt = $pdo->prepare(
        "UPDATE orders SET status = 'paid', razorpay_payment_id = ? WHERE razorpay_order_id = ?"
    );
    $stmt->execute([$razorpayPaymentId, $razorpayOrderId]);

    echo json_encode(['success' => true]);

} catch (SignatureVerificationError $e) {
    error_log('Signature verification failed for order ' . $razorpayOrderId . ': ' . $e->getMessage());

    $stmt = $pdo->prepare("UPDATE orders SET status = 'failed' WHERE razorpay_order_id = ?");
    $stmt->execute([$razorpayOrderId]);

    http_response_code(400);
    echo json_encode(['success' => false, 'error' => 'Payment verification failed']);

} catch (Exception $e) {
    error_log('Verification error: ' . $e->getMessage());
    http_response_code(400);
    echo json_encode(['success' => false, 'error' => $e->getMessage()]);
}

<?php
// webhook.php
require 'config.php';
require 'db.php';

$webhookBody      = file_get_contents('php://input');
$webhookSignature = $_SERVER['HTTP_X_RAZORPAY_SIGNATURE'] ?? '';

// Signature ચકાસો - ખાતરી કરો કે request ખરેખર Razorpay તરફથી જ છે
$expectedSignature = hash_hmac('sha256', $webhookBody, RAZORPAY_WEBHOOK_SECRET);

if (!hash_equals($expectedSignature, $webhookSignature)) {
    http_response_code(400);
    error_log('Webhook signature mismatch - possible fake request');
    exit('Invalid signature');
}

$event = json_decode($webhookBody, true);

// Audit trail માટે દરેક webhook event log કરો
$logStmt = $pdo->prepare("INSERT INTO webhook_logs (event_type, payload) VALUES (?, ?)");
$logStmt->execute([$event['event'] ?? 'unknown', $webhookBody]);

switch ($event['event'] ?? '') {

    case 'payment.captured':
        $orderId   = $event['payload']['payment']['entity']['order_id'];
        $paymentId = $event['payload']['payment']['entity']['id'];

        $stmt = $pdo->prepare(
            "UPDATE orders SET status = 'paid', razorpay_payment_id = ?
             WHERE razorpay_order_id = ? AND status != 'paid'"
        );
        $stmt->execute([$paymentId, $orderId]);
        break;

    case 'payment.failed':
        $orderId = $event['payload']['payment']['entity']['order_id'];

        $stmt = $pdo->prepare(
            "UPDATE orders SET status = 'failed' WHERE razorpay_order_id = ? AND status != 'paid'"
        );
        $stmt->execute([$orderId]);
        break;

    case 'refund.processed':
        $paymentId = $event['payload']['refund']['entity']['payment_id'];

        $stmt = $pdo->prepare(
            "UPDATE orders SET status = 'refunded' WHERE razorpay_payment_id = ?"
        );
        $stmt->execute([$paymentId]);
        break;
}

http_response_code(200);
echo 'OK'; // Razorpay ને 200 status ના મળે તો એ webhook retry કરે છે

<?php
// refund.php (Admin-only script - authentication જરૂરી, નીચે નોંધ જુઓ)
require 'vendor/autoload.php';
require 'config.php';
require 'db.php';

use Razorpay\Api\Api;

header('Content-Type: application/json');

// ⚠️ મહત્વનું: આ script ને admin authentication વગર ક્યારેય expose ના કરવી!
// ઉદાહરણ તરીકે session check:
// if (!isset($_SESSION['admin_id'])) { http_response_code(403); exit; }

$orderId = $_POST['order_id'] ?? '';

$stmt = $pdo->prepare("SELECT * FROM orders WHERE razorpay_order_id = ? AND status = 'paid'");
$stmt->execute([$orderId]);
$order = $stmt->fetch();

if (!$order) {
    http_response_code(404);
    echo json_encode(['success' => false, 'error' => 'Paid order not found']);
    exit;
}

try {
    $api = new Api(RAZORPAY_KEY_ID, RAZORPAY_KEY_SECRET);

    $refund = $api->payment->fetch($order['razorpay_payment_id'])->refund([
        'amount' => (int) round($order['amount'] * 100), // full refund; partial માટે ઓછી amount આપો
        'notes'  => ['reason' => 'Customer requested refund'],
    ]);

    $stmt = $pdo->prepare("UPDATE orders SET status = 'refunded' WHERE razorpay_order_id = ?");
    $stmt->execute([$orderId]);

    echo json_encode(['success' => true, 'refund_id' => $refund['id']]);

} catch (Exception $e) {
    error_log('Refund failed: ' . $e->getMessage());
    http_response_code(500);
    echo json_encode(['success' => false, 'error' => 'Refund could not be processed']);
}

<?php
require 'db.php';
$orderId = $_GET['order_id'] ?? '';

$stmt = $pdo->prepare("SELECT * FROM orders WHERE razorpay_order_id = ?");
$stmt->execute([$orderId]);
$order = $stmt->fetch();
?>
<!DOCTYPE html>
<html lang="gu">
<body>
<?php if ($order && $order['status'] === 'paid'): ?>
    <h2>પેમેન્ટ સફળ થયું! (Payment Successful!)</h2>
    <p>Order ID: <?= htmlspecialchars($order['razorpay_order_id']) ?></p>
    <p>રકમ (Amount): ₹<?= htmlspecialchars($order['amount']) ?></p>
    <p>Payment ID: <?= htmlspecialchars($order['razorpay_payment_id']) ?></p>
<?php else: ?>
    <h2>પેમેન્ટ confirm થઈ શક્યું નથી. Support નો સંપર્ક કરો.</h2>
<?php endif; ?>
</body>
</html>

composer require stripe/stripe-php

// create_order.php (Stripe version)
\Stripe\Stripe::setApiKey(STRIPE_SECRET_KEY);

$paymentIntent = \Stripe\PaymentIntent::create([
    'amount'   => $amountInPaise, // smallest unit, દા.ત. cents
    'currency' => 'usd',
]);

echo json_encode(['client_secret' => $paymentIntent->client_secret]);