$receiptData = $_POST;
// 验证参数
if (strlen($receiptData['receipt']) < 1000) {
    return;
}
$receipt = $receiptData['receipt'];
$receipt = urlencode($receipt);
$receipt = str_replace('%2F','/',$receipt);
$receipt = str_replace('%5C','',$receipt);
$receipt = str_replace('%3D','=',$receipt);
$receipt = str_replace('%2B','+',$receipt);

// 默认向真实环境发请求
$html = acurl($receipt);
$data = json_decode($html, true);

// 如果是沙盒数据 则验证沙盒模式
if ($data['status'] == '21007') {
    $html = acurl($receipt, 1);// 1代表向沙箱环境url发送验证请求
    $data = json_decode($html, true);
}

if (intval($data['status']) === 0) {
	// 验证APP应用包名，这个非必须的
    if($data['receipt']['bundle_id'] != 'com.qinglin.recruit'){
        $res = [
            'code' => 500,
            'message' => '非法操作',
            'data' => ''
        ];
        echo json_encode($res);
        exit;
    }

	// 找出时间最大的凭据数组
    $receiptitem = $data['receipt']['in_app'];
    $item = arraySort($receiptitem,'purchase_date','desc');
    $order_third = $item['transaction_id'];

   	// 验证凭据是否被使用，没别使用就更新到订单中

	// 订单回调处理
	
	

}else{
	$res = [
	        'code' => 500,
	        'message' => 'receipt参数有误',
	        'data' => ''
	    ];
	    echo json_encode($res);
	    exit;
}


// curl模拟http请求
function acurl($receiptData, $sandbox = 0)
{
    //小票信息
    $POSTFIELDS = '{"receipt-data":"'.$receiptData.'"}';

    //正式购买地址 沙盒购买地址
    $urlBuy = "https://buy.itunes.apple.com/verifyReceipt";
    $urlSandbox = "https://sandbox.itunes.apple.com/verifyReceipt";
    $url = $sandbox ? $urlSandbox : $urlBuy;//向正式环境url发送请求(默认)

    $ch = curl_init($url);
    curl_setopt($ch, CURLOPT_CUSTOMREQUEST, "POST");
    curl_setopt($ch, CURLOPT_POSTFIELDS,$POSTFIELDS);
    curl_setopt($ch, CURLOPT_RETURNTRANSFER,true);
    curl_setopt($ch, CURLOPT_HTTPHEADER, array(
                       'Content-Type: application/json',
                       'Content-Length: ' . strlen($POSTFIELDS))
    );
    curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);  //这两行一定要加，不加会报SSL 错误
    curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);
    $result = curl_exec($ch);
    curl_close($ch);
    return $result;
}

1、app配置苹果内购项目(iOS系统app端负责)

https://help.apple.com/app-store-connect/#/devb57be10e7

• APP store 配置APP项目

• 项目下添加内购项目

• 添加沙盒测试账号

2.iOS-iOS内购流程（手把手图文教程）_CC__超的博客-CSDN博客_ios内购流程//这个地址有ios系统app申请账号权限等教程;

3.requestBody | Apple Developer Documentation//苹果内购官网验证接口请求参数

4.verifyReceipt | Apple Developer Documentation//苹果官网内购验证接口返回参数及调用地址

5.status | Apple Developer Documentation//官网状态码

一.苹果支付

 ①逻辑流程图

二,苹果支付流程介绍

①户在app端购买产品下发支付请求指令app;
②app获取用户购买的信息及指令请求苹果系统服务后台进行支付扣,;
③苹果系统服务器扣款成功后返回receipt_data加密数据和支付订单号order_id给app端;
④app端直接将返回的数据及订单号,请求java后台的验证接口;
⑤java后端直接通过HttpsURLConnection将app端携带来的参数以及验证地址url请求苹果系统服务器验证用户在app端支付的结果;(注:receipt_data加密数据不需要在java后台解密,直接传给苹果服务器)
⑥苹果系统服务器将验证的结果及订单产品信息返回给java后台服务器,java后台服务器根据返回的结果处理自己的业务;
⑦java后端处理后自己的业务后,将验证结果以及自己所要返回的内容返回给app端;
②app端在请求苹果系统服务器检查java服务端服务是否已经验证;
③苹果服务告知app端,java服务是否验证成功;
⑧app端根据苹果服务器返回的验证结果通知提示用户订单是否结束;

注:苹果支付内购,价格是以6的倍数定价,且产品订单是唯一的;

三.java代码

①调用验证工具类校验app端返回的结果是否正确

 /**
     * TransactionID：苹果配置的产品id
     * String receipt_data:需要客户端传过来的参数2
     * 苹果内购支付
     *
     * @Title: doIosRequest
     * @Description:Ios客户端内购支付
     */
    @RequestMapping("/applePay")
    public Result doIosRequest(HttpServletRequest request, @RequestBody ApplePayVo applePayVo) {
        Result ext = new Result();
        String receipt_data = applePayVo.getReceipt_data();
        String transactionID = applePayVo.getTransaction_id();
        String verifyResult = iosVerifyUtil.buyAppVerify(receipt_data,applePayVo.getType());
             //苹果服务器没有返回验证结果
            if (verifyResult == null) {
                JSONObject jsonObject= new JSONObject();
                jsonObject.put("verify_status",-1);
                ext.setData(jsonObject);
                ext.setMessage("无订单信息!");
                ext.setCode(-1);
                return ext;
            } else {
                // 苹果验证有返回结果
                //log.info("线上，苹果平台返回JSON:" + verifyResult);
                JSONObject job = JSONObject.parseObject(verifyResult);
                String states = job.getString("status");
                //获取苹果系统服务器验证结果数据处理自己的业务
                Result appPay = applePayService.getAppPay(states, job, transactionID, request, applePayVo);
                return appPay;
            }
        }

②获取验证后的数据处理自己的业务逻辑

 /**
     * 苹果支付验证后
     **/
    public Result getAppPay(String states, JSONObject job, String transactionID, HttpServletRequest request, ApplePayVo applePayVo) {
        Result ext = new Result();
        //log.info("苹果平台返回值：job" + job);
        //判断是否验证成功
        if ("0".equals(states)) {
            //app端所提供的收据是有效的    验证成功
            String r_receipt = job.getString("receipt");
            JSONObject returnJson = JSONObject.parseObject(r_receipt);
            String in_app = returnJson.getString("in_app");
            JSONObject in_appJson = JSONObject.parseObject(in_app.substring(1, in_app.length() - 1));
            String transactionId = in_appJson.getString("transaction_id");
            //产品id
            String productId = in_appJson.getString("product_id");
            //苹果支付订单状态
            String in_app_ownership_type = in_appJson.getString("in_app_ownership_type");
            //如果获取验证后的支付订单单号与app端传来的支付订单号一致并且状态为已支付状态则处理自己的业务
            if (transactionID.equals(transactionId) && in_app_ownership_type.equals("PURCHASED")) {
            ===================处理自己的业务============================
        }
}
        JSONObject jsonObject = new JSONObject();
        jsonObject.put("verify_status", -1);
        ext.setMessage("receipt数据有问题");
        ext.setData(jsonObject);
        ext.setCode(-1);
        return ext;
}

③发送苹果系统服务器支付结果验证工具类

package com.asftek.pay.common.utils;

import org.springframework.beans.factory.annotation.Value;
import org.springframework.stereotype.Component;

import javax.net.ssl.*;
import java.io.BufferedOutputStream;
import java.io.BufferedReader;
import java.io.InputStream;
import java.io.InputStreamReader;
import java.net.URL;
import java.security.cert.CertificateException;
import java.security.cert.X509Certificate;
import java.util.Locale;
@Component
public class IosVerifyUtil {


    private static class TrustAnyTrustManager implements X509TrustManager {


        @Override
        public void checkClientTrusted(X509Certificate[] chain, String authType) throws CertificateException {
        }

        @Override
        public void checkServerTrusted(X509Certificate[] chain, String authType) throws CertificateException {
        }

        @Override
        public X509Certificate[] getAcceptedIssuers() {
            return new X509Certificate[]{};
        }
    }

    private static class TrustAnyHostnameVerifier implements HostnameVerifier {
        @Override
        public boolean verify(String hostname, SSLSession session) {
            return true;
        }
    }

    @Value("${applepay.verifyUrl}")
    private  String url_apple_pay;

    @Value("${applepay.verifyTestUrl}")
    private  String test_url_apple_pay;


    /**
     * 苹果服务器验证
     *
     * @param receipt 账单
     * @return null 或返回结果 沙盒 https://sandbox.itunes.apple.com/verifyReceipt
     * @url 要验证的地址
     */
    public  String buyAppVerify(String receipt,int type) {
        //环境判断 线上/开发环境用不同的请求链接
        try {
            String url=null;
            if (type==0){
                 url=test_url_apple_pay; //沙盒环境,测试
            }else {
                //生成
                url=url_apple_pay;
            }
            SSLContext sc = SSLContext.getInstance("SSL");
            sc.init(null, new TrustManager[]{new TrustAnyTrustManager()}, new java.security.SecureRandom());
            URL console = new URL(url);
            HttpsURLConnection conn = (HttpsURLConnection) console.openConnection();
            conn.setSSLSocketFactory(sc.getSocketFactory());
            conn.setHostnameVerifier(new TrustAnyHostnameVerifier());
            conn.setRequestMethod("POST");
            conn.setRequestProperty("content-type", "text/json");
            conn.setRequestProperty("Proxy-Connection", "Keep-Alive");
            conn.setDoInput(true);
            conn.setDoOutput(true);
            conn.setConnectTimeout(3000);
            BufferedOutputStream hurlBufOus = new BufferedOutputStream(conn.getOutputStream());
            //拼成固定的格式传给平台
            String str = String.format(Locale.CHINA, "{\"receipt-data\":\"" + receipt + "\"}");
            // 直接将receipt当参数发到苹果验证就行，不用拼格
           // String str = String.format(Locale.CHINA, receipt);
            hurlBufOus.write(str.getBytes());
            hurlBufOus.flush();

            InputStream is = conn.getInputStream();
            BufferedReader reader = new BufferedReader(new InputStreamReader(is));
            String line = null;
            StringBuilder sb = new StringBuilder();
            while ((line = reader.readLine()) != null) {
                sb.append(line);
            }
            return sb.toString();
        } catch (Exception ex) {
            System.out.println("苹果服务器异常");
            ex.printStackTrace();
        }
        return null;

    }
}

④java调用验证后苹果系统服务器返回参数
 

新版IOS返回（7.0以后）
{
    "receipt": {
        "receipt_type": "ProductionSandbox",
        "adam_id": 0,
        "app_item_id": 0,
        "bundle_id": "com.xxxx.xxxx",
        "application_version": "1",
        "download_id": 0,
        "version_external_identifier": 0,
        "receipt_creation_date": "2021-11-01 09:20:51 Etc/GMT",
        "receipt_creation_date_ms": "1635758451000",
        "receipt_creation_date_pst": "2021-11-01 02:20:51 America/Los_Angeles",
        "request_date": "2021-11-01 09:20:52 Etc/GMT",
        "request_date_ms": "1635758452973",
        "request_date_pst": "2021-11-01 02:20:52 America/Los_Angeles",
        "original_purchase_date": "2013-08-01 07:00:00 Etc/GMT",
        "original_purchase_date_ms": "1375340400000",
        "original_purchase_date_pst": "2013-08-01 00:00:00 America/Los_Angeles",
        "original_application_version": "1.0",
        "in_app": [{
            "quantity": "1",
            "product_id": "",//唯一的
            "transaction_id": "1000000901786189",
            "original_transaction_id": "1000000901786189",
            "purchase_date": "2021-11-01 09:13:33 Etc/GMT",
            "purchase_date_ms": "1635758013000",
            "purchase_date_pst": "2021-11-01 02:13:33 America/Los_Angeles",
            "original_purchase_date": "2021-11-01 09:13:33 Etc/GMT",
            "original_purchase_date_ms": "1635758013000",
            "original_purchase_date_pst": "2021-11-01 02:13:33 America/Los_Angeles",
            "is_trial_period": "false",
            "in_app_ownership_type": "PURCHASED"
        }]
    },
    "environment": "Sandbox",
    "status": 0
}

⑤错误码

转载注明出处：https://www.jianshu.com/p/8c958e75f98f

刚刚做了内购, 记录一下
这里直接上代码, 至于写代码之前的一些设置工作参考以下文章:
http://www.jianshu.com/p/690a7c68664e
http://www.jianshu.com/p/86ac7d3b593a

需要注意的是:

1. 只要工程配置了对应的证书, 就能请求商品信息, 不需要任何其他处理
2. 沙盒测试填写的邮箱不能是已经绑定appleID的邮箱, 也不能是AppleID的救援邮箱, 其他的无所谓, 其实, 哪怕你填写的邮箱不存在也没有关系

//
//  IAPManager.m
//  SpeakEnglish
//
//  Created by Daniel on 16/6/8.
//  Copyright © 2016年 Daniel. All rights reserved.
//

#import "IAPManager.h"
#import <StoreKit/StoreKit.h>

@interface IAPManager ()<SKPaymentTransactionObserver, SKProductsRequestDelegate>
// 所有商品
@property (nonatomic, strong)NSArray *products;
@property (nonatomic, strong)SKProductsRequest *request;
@end

static IAPManager *manager = nil;

@implementation IAPManager

+ (instancetype)shareIAPManager {
    static dispatch_once_t onceToken;
    dispatch_once(&onceToken, ^{
        manager = [self new];
        [[SKPaymentQueue defaultQueue] addTransactionObserver:manager];
    });
    return manager;
}

- (void)dealloc {
    [[SKPaymentQueue defaultQueue] removeTransactionObserver:self];
}

// 请求可卖的商品
- (void)requestProducts
{
    if (![SKPaymentQueue canMakePayments]) {
        // 您的手机没有打开程序内付费购买
        return;
    }
    
    // 1.请求所有的商品ID
    NSString *productFilePath = [[NSBundle mainBundle] pathForResource:@"iapdemo.plist" ofType:nil];
    NSArray *products = [NSArray arrayWithContentsOfFile:productFilePath];
    
    // 2.获取所有的productid
     NSArray *productIds = [products valueForKeyPath:@"productId"];
    
    // 3.获取productid的set(集合中)
    NSSet *set = [NSSet setWithArray:productIds];
    
    // 4.向苹果发送请求,请求可卖商品
    _request = [[SKProductsRequest alloc] initWithProductIdentifiers:set];
    _request.delegate = self;
    [_request start];
}

/**
 *  当请求到可卖商品的结果会执行该方法
 *
 *  @param response response中存储了可卖商品的结果
 */
- (void)productsRequest:(SKProductsRequest *)request didReceiveResponse:(SKProductsResponse *)response
{
     for (SKProduct *product in response.products) {

    // 用来保存价格
    NSMutableDictionary *priceDic = @{}.mutableCopy;
    // 货币单位
    NSNumberFormatter *numberFormatter = [[NSNumberFormatter alloc] init];
    [numberFormatter setFormatterBehavior:NSNumberFormatterBehavior10_4];
    [numberFormatter setNumberStyle:NSNumberFormatterCurrencyStyle];
    [numberFormatter setLocale:product.priceLocale];
    // 带有货币单位的价格
    NSString *formattedPrice = [numberFormatter stringFromNumber:product.price];
        [priceDic setObject:formattedPrice forKey:product.productIdentifier];

     NSLog(@"价格:%@", product.price);
     NSLog(@"标题:%@", product.localizedTitle);
     NSLog(@"秒速:%@", product.localizedDescription);
     NSLog(@"productid:%@", product.productIdentifier);
     }
     
    // 保存价格列表
    [[NSUserDefaults standardUserDefaults] setObject:priceDic forKey:@"priceDic"];
    [[NSUserDefaults standardUserDefaults] synchronize];
    
    // 1.存储所有的数据
    self.products = response.products;
    self.products = [self.products sortedArrayWithOptions:NSSortConcurrent usingComparator:^NSComparisonResult(SKProduct *obj1, SKProduct *obj2) {
        return [obj1.price compare:obj2.price];
    }];
}

#pragma mark - 购买商品
- (void)buyProduct:(SKProduct *)product
{
    // 1.创建票据
    SKPayment *payment = [SKPayment paymentWithProduct:product];
    WELog(@"productIdentifier----%@", payment.productIdentifier);
    
    // 2.将票据加入到交易队列中
    [[SKPaymentQueue defaultQueue] addPayment:payment];
}

#pragma mark - 实现观察者回调的方法
/**
 *  当交易队列中的交易状态发生改变的时候会执行该方法
 *
 *  @param transactions 数组中存放了所有的交易
 */
- (void)paymentQueue:(SKPaymentQueue *)queue updatedTransactions:(NSArray *)transactions
{
    /*
     SKPaymentTransactionStatePurchasing, 正在购买
     SKPaymentTransactionStatePurchased, 购买完成(销毁交易)
     SKPaymentTransactionStateFailed, 购买失败(销毁交易)
     SKPaymentTransactionStateRestored, 恢复购买(销毁交易)
     SKPaymentTransactionStateDeferred 最终状态未确定
     */
    for (SKPaymentTransaction *transaction in transactions) {
        switch (transaction.transactionState) {
            case SKPaymentTransactionStatePurchasing:
                WELog(@"用户正在购买");
                break;
                
            case SKPaymentTransactionStatePurchased:
                WELog(@"productIdentifier----->%@", transaction.payment.productIdentifier);
                [self buySuccessWithPaymentQueue:queue Transaction:transaction];
                break;
                
            case SKPaymentTransactionStateFailed:
                NSLog(@"购买失败");
                [queue finishTransaction:transaction];
                break;
                
            case SKPaymentTransactionStateRestored:
                NSLog(@"恢复购买");
                //TODO:向服务器请求补货，服务器补货完成后，客户端再完成交易单子
                //[queue finishTransaction:transaction];
                break;
                
            case SKPaymentTransactionStateDeferred:
                NSLog(@"最终状态未确定");
                break;
                
            default:
                break;
        }
    }
}

- (void)buySuccessWithPaymentQueue:(SKPaymentQueue *)queue Transaction:(SKPaymentTransaction *)transaction {
    
    AFHTTPSessionManager *manager = [AFHTTPSessionManager manager];
    NSDictionary *params = @{@"user_id":@"user_id",
                             // 获取商品
                             @"goods":[self goodsWithProductIdentifier:transaction.payment.productIdentifier]};
    
    [manager POST:@"url" parameters:params success:^(NSURLSessionDataTask *task, id responseObject) {
        
        if ([responseObject[@"code"] intValue] == 200) {
            
            // 防止丢单, 必须在服务器确定后从交易队列删除交易
            // 如果不从交易队列上删除交易, 下次调用addTransactionObserver:, 仍然会回调'updatedTransactions'方法, 以此处理丢单
            
            WELog(@"购买成功");
            [queue finishTransaction:transaction];
        }
        
    } failure:^(NSURLSessionDataTask *task, NSError *error) {
        
    }];
}

// 商品列表 也可以使用从苹果请求的数据, 具体细节自己视情况处理
// goods1 是商品的ID
- (NSString *)goodsWithProductIdentifier:(NSString *)productIdentifier {
    NSDictionary *goodsDic = [[NSUserDefaults standardUserDefaults] objectForKey:@"priceDic"];
    return goodsDic[productIdentifier];
}

// 恢复购买
- (void)restore
{
    [[SKPaymentQueue defaultQueue] restoreCompletedTransactions];
}

- (void)paymentQueue:(SKPaymentQueue *)queue restoreCompletedTransactionsFailedWithError:(NSError *)error {
    // 恢复失败
    WELog(@"恢复失败");
}

// 取消请求商品信息
- (void)dealloc {
    [_request cancel];
}
@end

补充：

对于丢单的交易，在执行初始化[[SKpaymentQueue defaultQueue] addTransactionObserver: self] 的时候，如果有未完成的交易，会直接回调updatedTransactions，并且进入case SKPaymentTransationStateRestored，此时把这些未完成的交易告知服务器进行补货，补货完成再通知客户端，客户端再执行completeTransaction关闭单子

总结:
内购有三个可能出现的问题

1. 支付成功后, 没来得及向服务器发送交易成功的数据就退出应用, 导致丢单. 这个问题貌似不需要本地化数据也已经没问题了, 除非再次回调updatedTransactions方法时已经拿不到票据了, 这样才有必要本地存储票据.
2. 无法绑定交易和对应的用户. 因为applicationUsername的存在这已经不是问题了.
3. 只用别人的手机进行购买, 没来得及向服务器发送交易成功的数据就退出应用, 导致丢单. 如果别人再也不打开这个应用甚至删掉了, 目前看来, 没有办法解决

参考资料:

1. 苹果内购二次验证 PHP代码
   http://my.oschina.net/qianglong/blog/503861

2. In-App Purchase Programming Guide
   https://developer.apple.com/library/prerelease/content/documentation/NetworkingInternet/Conceptual/StoreKitGuide/Introduction.html#//apple_ref/doc/uid/TP40008267

3. iPhone In App Purchase购买完成时验证transactionReceipt
   http://www.cnblogs.com/eagley/archive/2011/06/15/2081577.html