import java.nio.charset.StandardCharsets;
import java.security.MessageDigest;
import java.util.*;

public class PaySign {
    /** 同一个方法也可用于验证返回报文与回调通知：把收到的报文原样传进来即可。 */
    public static String sign(Map<String, Object> params, String key) throws Exception {
        List<String> parts = new ArrayList<>();
        for (Map.Entry<String, Object> e : params.entrySet()) {
            String v = val(e.getValue());
            if (v.isEmpty() || "sign".equals(e.getKey())) continue;
            parts.add(e.getKey() + "=" + v);
        }
        Collections.sort(parts, String.CASE_INSENSITIVE_ORDER);
        String s = String.join("&", parts) + "&key=" + key;
        byte[] d = MessageDigest.getInstance("MD5").digest(s.getBytes(StandardCharsets.UTF_8));
        StringBuilder sb = new StringBuilder();
        for (byte b : d) sb.append(String.format("%02X", b));
        return sb.toString();
    }

    /** 嵌套对象（如下单返回报文里的 payParams，其值均为字符串）：键按字典序、紧凑序列化 */
    @SuppressWarnings("unchecked")
    private static String val(Object o) {
        if (o == null) return "";
        if (!(o instanceof Map)) return o.toString();
        StringBuilder sb = new StringBuilder("{");
        Map<String, Object> m = new TreeMap<>((Map<String, Object>) o);
        for (Map.Entry<String, Object> e : m.entrySet()) {
            if (sb.length() > 1) sb.append(',');
            sb.append('"').append(esc(e.getKey())).append("\":\"")
              .append(esc(String.valueOf(e.getValue()))).append('"');
        }
        return sb.append('}').toString();
    }

    private static String esc(String s) {
        return s.replace("\\", "\\\\").replace("\"", "\\\"");
    }

    public static void main(String[] args) throws Exception {
        Map<String, Object> p = new LinkedHashMap<>();
        p.put("mchId", "20001222");
        p.put("productId", "9168");
        p.put("mchOrderNo", "P20260828001");
        p.put("amount", "100");
        p.put("subject", "测试商品");
        p.put("body", "测试商品描述");
        p.put("notifyUrl", "https://merchant.example.com/notify");
        System.out.println(sign(p, "abc123456789"));
        // 应输出 94884A0F25E72BC0EB5EC0ED4F547F0C
    }
}

<?php
// 嵌套对象（如下单返回报文里的 payParams）：键按字典序、紧凑序列化，与平台一致
function payVal($v): string {
    if (is_array($v)) {
        ksort($v);
        return json_encode($v, JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE);
    }
    return (string)$v;
}

// 同一个函数也可用于验证返回报文与回调通知：把收到的报文原样传进来即可
function paySign(array $params, string $key): string {
    $parts = [];
    foreach ($params as $k => $v) {
        if ($k === 'sign' || $v === null) continue;
        $s = payVal($v);
        if ($s === '') continue;
        $parts[] = $k . '=' . $s;
    }
    usort($parts, 'strcasecmp');
    return strtoupper(md5(implode('&', $parts) . '&key=' . $key));
}

$p = [
    'mchId'      => '20001222',
    'productId'  => '9168',
    'mchOrderNo' => 'P20260828001',
    'amount'     => '100',
    'subject'    => '测试商品',
    'body'       => '测试商品描述',
    'notifyUrl'  => 'https://merchant.example.com/notify',
];
echo paySign($p, 'abc123456789');
// 应输出 94884A0F25E72BC0EB5EC0ED4F547F0C

import hashlib
import json


def _val(v):
    # 嵌套对象（如下单返回报文里的 payParams）：键按字典序、紧凑序列化，与平台一致
    if isinstance(v, dict):
        return json.dumps(v, sort_keys=True, separators=(",", ":"), ensure_ascii=False)
    return str(v)


def pay_sign(params: dict, key: str) -> str:
    """同一个函数也可用于验证返回报文与回调通知：把收到的报文原样传进来即可。"""
    parts = [f"{k}={_val(v)}" for k, v in params.items()
             if k != "sign" and v is not None and _val(v) != ""]
    parts.sort(key=str.lower)
    s = "&".join(parts) + "&key=" + key
    return hashlib.md5(s.encode("utf-8")).hexdigest().upper()


p = {
    "mchId": "20001222",
    "productId": "9168",
    "mchOrderNo": "P20260828001",
    "amount": "100",
    "subject": "测试商品",
    "body": "测试商品描述",
    "notifyUrl": "https://merchant.example.com/notify",
}
print(pay_sign(p, "abc123456789"))
# 应输出 94884A0F25E72BC0EB5EC0ED4F547F0C

const crypto = require('crypto');

// 嵌套对象（如下单返回报文里的 payParams）：键按字典序、紧凑序列化，与平台一致
const val = v => (v !== null && typeof v === 'object')
  ? JSON.stringify(v, Object.keys(v).sort())
  : String(v);

// 同一个函数也可用于验证返回报文与回调通知：把收到的报文原样传进来即可
function paySign(params, key) {
  const parts = Object.entries(params)
    .filter(([k, v]) => k !== 'sign' && v !== null && v !== undefined && val(v) !== '')
    .map(([k, v]) => `${k}=${val(v)}`);
  parts.sort((a, b) => {
    const x = a.toLowerCase(), y = b.toLowerCase();
    return x < y ? -1 : x > y ? 1 : 0;
  });
  const s = parts.join('&') + '&key=' + key;
  return crypto.createHash('md5').update(s, 'utf8').digest('hex').toUpperCase();
}

const p = {
  mchId: '20001222',
  productId: '9168',
  mchOrderNo: 'P20260828001',
  amount: '100',
  subject: '测试商品',
  body: '测试商品描述',
  notifyUrl: 'https://merchant.example.com/notify',
};
console.log(paySign(p, 'abc123456789'));
// 应输出 94884A0F25E72BC0EB5EC0ED4F547F0C

// 用法：Body 选 x-www-form-urlencoded，业务参数逐个填好，sign 那格填 {{sign}}
// 把下面这段贴进 Pre-request Script，每次 Send 会自动算好签名
const KEY = '你的商户私钥';

const parts = [];
pm.request.body.urlencoded.each(p => {
  if (p.disabled || p.key === 'sign') return;
  const v = pm.variables.replaceIn(String(p.value == null ? '' : p.value));
  if (v !== '') parts.push(p.key + '=' + v);
});
parts.sort((a, b) => {
  const x = a.toLowerCase(), y = b.toLowerCase();
  return x < y ? -1 : x > y ? 1 : 0;
});
pm.variables.set('sign',
  CryptoJS.MD5(parts.join('&') + '&key=' + KEY).toString().toUpperCase());