Sage Pay Reporting API - generated signature hash not valid - php

Question

I am trying to invoke the getTransactionDetail end point on sagepay reporting api (https://www.sagepay.co.uk/file/6946/download-document/Reporting_and_Admin_API_Integration_Guideline_31012014.pdf) and the signature I made as per the following instructions:
does not appear to be working, I am getting an invalid signature response.
Here's what I have tried so far:
<?php
$vendor = 'myvendername';
$username = 'my-username';
$password = 'my-password';
$vpstxid = '{my-vpstxid-guid-here}';
$request = [
'command' => 'getTransactionDetail',
'vendor' => $vendor,
'user' => $username,
'vpstxid' => $vpstxid,
];
$signature = _calculate_request_signature($request);
$request_xml = _build_sagepay_request($request, $signature);
$result = _call_sagepay_server('https://test.sagepay.com/access/access.htm', $request_xml);
$xml = simplexml_load_string($result);
$json = json_encode($xml);
$array = json_decode($json,TRUE);
echo '<pre>'; print_r($array); exit;
function _calculate_request_signature($data) {
global $password;
$req = '';
foreach ($data as $key => $value) {
$req .= '<' . $key . '>' . $value . '</' . $key . '>' . PHP_EOL;
}
$req .= '<password>' . $password . '</password>';
return md5($req);
}
function _build_sagepay_request($data, $signature) {
$result = '<vspaccess>' . PHP_EOL;
foreach ($data as $key => $value) {
$result .= "\t" . '<' . $key . '>' . $value . '</' . $key . '>' . PHP_EOL;
}
$result .= "\t" . '<signature>' . $signature . '</signature>' . PHP_EOL;
$result .= '</vspaccess>';
return $result;
}
function _call_sagepay_server($url, $request_xml)
{ ... snipped ... }
Any ideas?

Answer 1

Ok, I've figured it out:
No tabs / PHP_EOL in the request / signature calc, keep it flat one line xml and it works.
function _calculate_request_signature($data) {
global $password;
$req = '';
foreach ($data as $key => $value) {
$req .= '<' . $key . '>' . $value . '</' . $key . '>';
}
$req .= '<password>' . $password . '</password>';
return strtoupper(md5($req));
}
function _build_sagepay_request($data, $signature) {
$result = '<vspaccess>';
foreach ($data as $key => $value) {
$result .= '<' . $key . '>' . $value . '</' . $key . '>';
}
$result .= '<signature>' . $signature . '</signature>';
$result .= '</vspaccess>';
return $result;
}
function _call_sagepay_server($url, $request_xml)
{
global $lastCurlError;
$curl = curl_init();
curl_setopt($curl, CURLOPT_URL, $url);
curl_setopt($curl, CURLOPT_HEADER, 0);
curl_setopt($curl, CURLOPT_POST, 1);
curl_setopt($curl, CURLOPT_POSTFIELDS, 'XML=' . $request_xml);
curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($curl, CURLOPT_TIMEOUT, 45);
curl_setopt($curl, CURLOPT_SSL_VERIFYPEER, false);
$result = curl_exec($curl);
$lastCurlError = curl_errno($curl);
curl_close($curl);
return $result;
}