X Signature verification sample

billplz-xsignature.php

<?php
function buildSourceString($data, $prefix = '')
{
	uksort($data, function($a, $b) {
		$a_len = strlen($a);
		$b_len = strlen($b);

		$result = strncasecmp($a, $b, min($a_len, $b_len));

		if ($result === 0) {
			$result = $b_len - $a_len;
		}

		return $result;
	});

	$processed = [];

	foreach ($data as $key => $value) {
		if ($key === 'x_signature') continue;

		if (is_array($value)) {
			$processed[] = buildSourceString($value, $key);
		} else {
			$processed[] = $prefix . $key . $value;
		}
	}

	return implode('|', $processed);
}

$source_string = buildSourceString($_POST);

$xsignature_key = 'blablabla'; // Get from your stored settings

$xsignature = $_POST['x_signature'];

$equal = hash_equals(hash_hmac('sha256', $source_string, $xsignature_key), $xsignature);