当前位置：首页 > PHP

php实现银行转帐

2026-01-30 08:35:30PHP

PHP实现银行转账的基本流程

银行转账功能涉及资金流动，需严格遵循安全规范。以下是核心实现步骤和注意事项：

数据库设计

创建交易记录表（如transactions）和用户账户表（如accounts）：

CREATE TABLE accounts (
    id INT PRIMARY KEY AUTO_INCREMENT,
    user_id INT NOT NULL,
    account_number VARCHAR(20) UNIQUE,
    balance DECIMAL(15,2) DEFAULT 0.00,
    currency VARCHAR(3) DEFAULT 'USD'
);

CREATE TABLE transactions (
    id INT PRIMARY KEY AUTO_INCREMENT,
    from_account VARCHAR(20),
    to_account VARCHAR(20),
    amount DECIMAL(15,2),
    fee DECIMAL(15,2) DEFAULT 0.00,
    status ENUM('pending','completed','failed'),
    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
);

事务处理实现

使用PDO确保数据一致性：

function transferFunds($pdo, $fromAccount, $toAccount, $amount) {
    try {
        $pdo->beginTransaction();

        // 检查转出账户余额
        $stmt = $pdo->prepare("SELECT balance FROM accounts WHERE account_number = ? FOR UPDATE");
        $stmt->execute([$fromAccount]);
        $balance = $stmt->fetchColumn();

        if ($balance < $amount) {
            throw new Exception("Insufficient funds");
        }

        // 扣除转出账户
        $stmt = $pdo->prepare("UPDATE accounts SET balance = balance - ? WHERE account_number = ?");
        $stmt->execute([$amount, $fromAccount]);

        // 增加转入账户
        $stmt = $pdo->prepare("UPDATE accounts SET balance = balance + ? WHERE account_number = ?");
        $stmt->execute([$amount, $toAccount]);

        // 记录交易
        $stmt = $pdo->prepare("INSERT INTO transactions (from_account, to_account, amount, status) VALUES (?, ?, ?, 'completed')");
        $stmt->execute([$fromAccount, $toAccount, $amount]);

        $pdo->commit();
        return true;
    } catch (Exception $e) {
        $pdo->rollBack();
        error_log("Transfer failed: " . $e->getMessage());
        return false;
    }
}

安全措施

验证输入参数并防止SQL注入：

$fromAccount = filter_input(INPUT_POST, 'from_account', FILTER_SANITIZE_STRING);
$toAccount = filter_input(INPUT_POST, 'to_account', FILTER_SANITIZE_STRING);
$amount = filter_input(INPUT_POST, 'amount', FILTER_VALIDATE_FLOAT);

if (!$fromAccount || !$toAccount || !$amount || $amount <= 0) {
    die("Invalid input parameters");
}

日志记录

记录所有交易操作：

function logTransaction($message) {
    $logFile = __DIR__ . '/transaction.log';
    $entry = date('Y-m-d H:i:s') . " - " . $message . PHP_EOL;
    file_put_contents($logFile, $entry, FILE_APPEND);
}

验证机制

实现二次确认流程：

session_start();

if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_SESSION['transfer_token'])) {
    if ($_POST['token'] !== $_SESSION['transfer_token']) {
        die("CSRF token validation failed");
    }

    // 处理转账逻辑
}

性能优化

批量处理大量交易时使用预处理语句：

php实现银行转帐

$stmt = $pdo->prepare("UPDATE accounts SET balance = balance + ? WHERE account_number = ?");
foreach ($batchTransfers as $transfer) {
    $stmt->execute([$transfer['amount'], $transfer['account']]);
}