当前位置：首页 > PHP

php实现银行转帐

2026-02-15 06:23:12PHP

PHP实现银行转账功能

银行转账功能需要严格的安全措施和数据处理流程。以下是实现银行转账功能的PHP代码示例和关键注意事项：

数据库表结构设计

创建必要的数据库表存储账户和交易信息：

CREATE TABLE accounts (
    id INT PRIMARY KEY AUTO_INCREMENT,
    account_number VARCHAR(20) UNIQUE NOT NULL,
    account_name VARCHAR(100) NOT NULL,
    balance DECIMAL(15,2) DEFAULT 0.00,
    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
);

CREATE TABLE transactions (
    id INT PRIMARY KEY AUTO_INCREMENT,
    from_account VARCHAR(20) NOT NULL,
    to_account VARCHAR(20) NOT NULL,
    amount DECIMAL(15,2) NOT NULL,
    transaction_date TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
    status ENUM('pending', 'completed', 'failed') DEFAULT 'pending',
    reference VARCHAR(100)
);

转账处理代码

实现核心转账逻辑的PHP代码：

<?php
function transferFunds($fromAccount, $toAccount, $amount, $reference = '') {
    $db = new PDO('mysql:host=localhost;dbname=banking', 'username', 'password');
    $db->beginTransaction();

    try {
        // 检查转出账户是否存在且有足够余额
        $stmt = $db->prepare("SELECT balance FROM accounts WHERE account_number = ? FOR UPDATE");
        $stmt->execute([$fromAccount]);
        $fromBalance = $stmt->fetchColumn();

        if ($fromBalance === false) {
            throw new Exception("转出账户不存在");
        }

        if ($fromBalance < $amount) {
            throw new Exception("账户余额不足");
        }

        // 检查转入账户是否存在
        $stmt = $db->prepare("SELECT 1 FROM accounts WHERE account_number = ? FOR UPDATE");
        $stmt->execute([$toAccount]);

        if (!$stmt->fetchColumn()) {
            throw new Exception("转入账户不存在");
        }

        // 更新账户余额
        $stmt = $db->prepare("UPDATE accounts SET balance = balance - ? WHERE account_number = ?");
        $stmt->execute([$amount, $fromAccount]);

        $stmt = $db->prepare("UPDATE accounts SET balance = balance + ? WHERE account_number = ?");
        $stmt->execute([$amount, $toAccount]);

        // 记录交易
        $stmt = $db->prepare("INSERT INTO transactions 
                             (from_account, to_account, amount, reference, status) 
                             VALUES (?, ?, ?, ?, 'completed')");
        $stmt->execute([$fromAccount, $toAccount, $amount, $reference]);

        $db->commit();
        return true;
    } catch (Exception $e) {
        $db->rollBack();
        // 记录失败交易
        $stmt = $db->prepare("INSERT INTO transactions 
                             (from_account, to_account, amount, reference, status) 
                             VALUES (?, ?, ?, ?, 'failed')");
        $stmt->execute([$fromAccount, $toAccount, $amount, $reference]);

        error_log("转账失败: " . $e->getMessage());
        return false;
    }
}
?>

安全措施

银行转账系统必须实施严格的安全措施：

使用HTTPS协议保护数据传输
实施CSRF防护机制
对用户输入进行严格验证和过滤
使用预处理语句防止SQL注入
记录所有交易操作的详细日志
实现交易限额控制
添加敏感操作的多因素认证

验证和错误处理

转账操作需要完善的验证和错误处理：

// 示例调用代码
$fromAccount = '1234567890';
$toAccount = '0987654321';
$amount = 1000.00;
$reference = '工资转账';

if (!is_numeric($amount) || $amount <= 0) {
    die("转账金额必须为正数");
}

if ($fromAccount === $toAccount) {
    die("不能转账到同一账户");
}

if (transferFunds($fromAccount, $toAccount, $amount, $reference)) {
    echo "转账成功";
} else {
    echo "转账失败，请稍后再试";
}