/* PHP */
$post_data = array();
$post_data['store_id'] = "testbox";
$post_data['store_passwd'] = "qwerty";
$post_data['total_amount'] = "103";
$post_data['currency'] = "BDT";
$post_data['tran_id'] = "SSLCZ_TEST_".uniqid();
$post_data['success_url'] = "http://localhost/new_sslcz_gw/success.php";
$post_data['fail_url'] = "http://localhost/new_sslcz_gw/fail.php";
$post_data['cancel_url'] = "http://localhost/new_sslcz_gw/cancel.php";
# $post_data['multi_card_name'] = "mastercard,visacard,amexcard";  # DISABLE TO DISPLAY ALL AVAILABLE

# EMI INFO
$post_data['emi_option'] = "1";
$post_data['emi_max_inst_option'] = "9";
$post_data['emi_selected_inst'] = "9";

# CUSTOMER INFORMATION
$post_data['cus_name'] = "Test Customer";
$post_data['cus_email'] = "test@test.com";
$post_data['cus_add1'] = "Dhaka";
$post_data['cus_add2'] = "Dhaka";
$post_data['cus_city'] = "Dhaka";
$post_data['cus_state'] = "Dhaka";
$post_data['cus_postcode'] = "1000";
$post_data['cus_country'] = "Bangladesh";
$post_data['cus_phone'] = "01711111111";
$post_data['cus_fax'] = "01711111111";

# SHIPMENT INFORMATION
$post_data['ship_name'] = "Store Test";
$post_data['ship_add1 '] = "Dhaka";
$post_data['ship_add2'] = "Dhaka";
$post_data['ship_city'] = "Dhaka";
$post_data['ship_state'] = "Dhaka";
$post_data['ship_postcode'] = "1000";
$post_data['ship_country'] = "Bangladesh";

# OPTIONAL PARAMETERS
$post_data['value_a'] = "ref001";
$post_data['value_b '] = "ref002";
$post_data['value_c'] = "ref003";
$post_data['value_d'] = "ref004";

# CART PARAMETERS
$post_data['cart'] = json_encode(array(
    array("product"=>"DHK TO BRS AC A1","amount"=>"200.00"),
    array("product"=>"DHK TO BRS AC A2","amount"=>"200.00"),
    array("product"=>"DHK TO BRS AC A3","amount"=>"200.00"),
    array("product"=>"DHK TO BRS AC A4","amount"=>"200.00")    
));
$post_data['product_amount'] = "100";
$post_data['vat'] = "5";
$post_data['discount_amount'] = "5";
$post_data['convenience_fee'] = "3";

API Endpoint (Sandbox/Test Environment): https://sandbox.sslcommerz.com/gwprocess/v3/api.php

API Endpoint (Live Environment): https://securepay.sslcommerz.com/gwprocess/v3/api.php

Method: POST ( CURL for PHP, httpwebrequest for .NET and etc)

# REQUEST SEND TO SSLCOMMERZ
$direct_api_url = "https://sandbox.sslcommerz.com/gwprocess/v3/api.php";

$handle = curl_init();
curl_setopt($handle, CURLOPT_URL, $direct_api_url );
curl_setopt($handle, CURLOPT_TIMEOUT, 30);
curl_setopt($handle, CURLOPT_CONNECTTIMEOUT, 30);
curl_setopt($handle, CURLOPT_POST, 1 );
curl_setopt($handle, CURLOPT_POSTFIELDS, $post_data);
curl_setopt($handle, CURLOPT_RETURNTRANSFER, true);
curl_setopt($handle, CURLOPT_SSL_VERIFYPEER, FALSE); # KEEP IT FALSE IF YOU RUN FROM LOCAL PC


$content = curl_exec($handle );

$code = curl_getinfo($handle, CURLINFO_HTTP_CODE);

if($code == 200 && !( curl_errno($handle))) {
	curl_close( $handle);
	$sslcommerzResponse = $content;
} else {
	curl_close( $handle);
	echo "FAILED TO CONNECT WITH SSLCOMMERZ API";
	exit;
}

# PARSE THE JSON RESPONSE
$sslcz = json_decode($sslcommerzResponse, true );

if(isset($sslcz['GatewayPageURL']) && $sslcz['GatewayPageURL']!="" ) {
        # THERE ARE MANY WAYS TO REDIRECT - Javascript, Meta Tag or Php Header Redirect or Other
        # echo "<script>window.location.href = '". $sslcz['GatewayPageURL'] ."';</script>";
	echo "<meta http-equiv='refresh' content='0;url=".$sslcz['GatewayPageURL']."'>";
	# header("Location: ". $sslcz['GatewayPageURL']);
	exit;
} else {
	echo "JSON Data parsing error!";
}

You have to parse GatewayPageURL field from this json response and redirect user to this url.

$val_id=urlencode($_POST['val_id']);
$store_id=urlencode("testbox");
$store_passwd=urlencode("qwerty");
$requested_url = ("https://sandbox.sslcommerz.com/validator/api/validationserverAPI.php?val_id=".$val_id."&store_id=".$store_id."&store_passwd=".$store_passwd."&v=1&format=json");

$handle = curl_init();
curl_setopt($handle, CURLOPT_URL, $requested_url);
curl_setopt($handle, CURLOPT_RETURNTRANSFER, true);
curl_setopt($handle, CURLOPT_SSL_VERIFYHOST, false); # IF YOU RUN FROM LOCAL PC
curl_setopt($handle, CURLOPT_SSL_VERIFYPEER, false); # IF YOU RUN FROM LOCAL PC

$result = curl_exec($handle);

$code = curl_getinfo($handle, CURLINFO_HTTP_CODE);

if($code == 200 && !( curl_errno($handle)))
{

	# TO CONVERT AS ARRAY
	# $result = json_decode($result, true);
	# $status = $result['status'];

	# TO CONVERT AS OBJECT
	$result = json_decode($result);

	# TRANSACTION INFO
	$status = $result->status;
	$tran_date = $result->tran_date;
	$tran_id = $result->tran_id;
	$val_id = $result->val_id;
	$amount = $result->amount;
	$store_amount = $result->store_amount;
	$bank_tran_id = $result->bank_tran_id;
	$card_type = $result->card_type;

	# EMI INFO
	$emi_ instalment = $result->emi_instalment;
	$emi_ amount = $result->emi_ amount;
	$emi_description = $result->emi_description;
	$emi_issuer = $result->emi_issuer;

	# ISSUER INFO
	$card_no = $result->card_no;
	$card_issuer = $result->card_issuer;
	$card_brand = $result->card_brand;
	$card_issuer_country = $result->card_issuer_country;
	$card_issuer_country_code = $result->card_issuer_country_code;

	# API AUTHENTICATION
	$APIConnect = $result->APIConnect;
	$validated_on = $result->validated_on;
	$gw_version = $result->gw_version;

} else {

	echo "Failed to connect with SSLCOMMERZ";
}

$tran_id=urlencode($_POST['tran_id']);
$store_id=urlencode("testbox");
$store_passwd=urlencode("qwerty");
$requested_url = ("https://sandbox.sslcommerz.com/validator/api/merchantTransIDvalidationAPI.php?tran_id=".$tran_id."&store_id=".$store_id."&store_passwd=".$store_passwd."&v=1&format=json");

$handle = curl_init();
curl_setopt($handle, CURLOPT_URL, $requested_url);
curl_setopt($handle, CURLOPT_RETURNTRANSFER, true);
curl_setopt($handle, CURLOPT_SSL_VERIFYHOST, false); # IF YOU RUN FROM LOCAL PC
curl_setopt($handle, CURLOPT_SSL_VERIFYPEER, false); # IF YOU RUN FROM LOCAL PC

$result = curl_exec($handle);

$code = curl_getinfo($handle, CURLINFO_HTTP_CODE);

$whether_give_the_service = false;

$t_status = "";

if($code == 200 && !( curl_errno($handle))) {

	# JSON CONVERT T
	$result = json_decode($result, true);
	if(isset($result['APIConnect']) && $result['APIConnect']=='DONE') {
		if(isset($result['element'])) {
		
			foreach($result['element'] as $t) {

				var_dump($t);
		
				$tran_date = $t['tran_date'];
				
				$tran_id = $t['tran_id'];
				$amount = $t['amount'];
				$bank_gw = $t['bank_gw'];
				$card_type = $t['card_type'];
				$card_no = $t['card_no'];
				$card_issuer = $t['card_issuer'];
				$card_brand = $t['card_brand'];
				$card_issuer_country = $t['card_issuer_country'];
				
				$card_issuer_country_code = $t['card_issuer_country_code'];
				$status = $t['status'];
				$error = $t['error'];
				$risk_title = $t['risk_title'];
				$risk_level = $t['risk_level'];

				# TAKE LATEST STATUS
				$t_status = $status;				

				if($status=='VALID') {	# CHECK CONDITIONS				
					$t_status = "Successful Transaction, Please check AMOUNT with your System. ";					
					if($risk_level=='1') { 
						$t_status = "Payment is Risky";
					}					
					break;
					
				} else if ($status=='VALIDATED') {				
					$t_status = "Successful Transaction already validated by you, Please check AMOUNT with your System. ";					
					if($risk_level=='1') { 
						$t_status = "Payment is Risky";
					}
					break;					
				}			
			}
		} else {	# NO SUCCESSFUL RECORD
			$t_status = "No Record Found";
		}
	} else {	# INVALID STORE ID AND PASSWORD
		$t_status = "API Connection Failed";
	}
} else {	# UNABLE TO CONNECT WITH SSLCOMMERZ
	$t_status = "Failed to connect with SSLCOMMERZ";
}

echo $t_status;

$sessionkey=urlencode($_POST['sessionkey']);
$store_id=urlencode("testbox");
$store_passwd=urlencode("qwerty");
$requested_url = ("https://sandbox.sslcommerz.com/validator/api/merchantTransIDvalidationAPI.php?sessionkey=".$sessionkey."&store_id=".$store_id."&store_passwd=".$store_passwd."&v=1&format=json");

$handle = curl_init();
curl_setopt($handle, CURLOPT_URL, $requested_url);
curl_setopt($handle, CURLOPT_RETURNTRANSFER, true);
curl_setopt($handle, CURLOPT_SSL_VERIFYHOST, false); # IF YOU RUN FROM LOCAL PC
curl_setopt($handle, CURLOPT_SSL_VERIFYPEER, false); # IF YOU RUN FROM LOCAL PC

$result = curl_exec($handle);

$code = curl_getinfo($handle, CURLINFO_HTTP_CODE);

if($code == 200 && !( curl_errno($handle)))
{

	# TO CONVERT AS ARRAY
	# $result = json_decode($result, true);
	# $status = $result['status'];

	# TO CONVERT AS OBJECT
	$result = json_decode($result);

	# TRANSACTION INFO
	$status = $result->status;
	$tran_date = $result->tran_date;
	$tran_id = $result->tran_id;
	$val_id = $result->val_id;
	$amount = $result->amount;
	$store_amount = $result->store_amount;
	$bank_tran_id = $result->bank_tran_id;
	$card_type = $result->card_type;

	# EMI INFO
	$emi_ instalment = $result->emi_instalment;
	$emi_ amount = $result->emi_ amount;
	$emi_description = $result->emi_description;
	$emi_issuer = $result->emi_issuer;

	# ISSUER INFO
	$card_no = $result->card_no;
	$card_issuer = $result->card_issuer;
	$card_brand = $result->card_brand;
	$card_issuer_country = $result->card_issuer_country;
	$card_issuer_country_code = $result->card_issuer_country_code;

	# API AUTHENTICATION
	$APIConnect = $result->APIConnect;
	$validated_on = $result->validated_on;
	$gw_version = $result->gw_version;

} else {

	echo "Failed to connect with SSLCOMMERZ";
}

$bank_tran_id=urlencode('1709162345070ANJdZV8LyI4cMw');
$refund_amount=urlencode('5.50');
$refund_remarks=urlencode('Out of Stock');
$store_id=urlencode("testbox");
$store_passwd=urlencode("qwerty");

$requested_url = ("https://sandbox.sslcommerz.com/validator/api/validationserverAPI.php?refund_amount=$refund_amount&refund_remarks=$refund_remarks&bank_tran_id=$bank_tran_id&store_id=$store_id&store_passwd=$store_passwd&v=1&format=json");

$handle = curl_init();
curl_setopt($handle, CURLOPT_URL, $requested_url);
curl_setopt($handle, CURLOPT_RETURNTRANSFER, true);
curl_setopt($handle, CURLOPT_SSL_VERIFYHOST, false); # IF YOU RUN FROM LOCAL PC
curl_setopt($handle, CURLOPT_SSL_VERIFYPEER, false); # IF YOU RUN FROM LOCAL PC

$result = curl_exec($handle);

$code = curl_getinfo($handle, CURLINFO_HTTP_CODE);

if($code == 200 && !( curl_errno($handle)))
{

	# TO CONVERT AS ARRAY
	# $result = json_decode($result, true);
	# $status = $result['status'];

	# TO CONVERT AS OBJECT
	$result = json_decode($result);

	# TRANSACTION INFO
	$status = $result->status;
	$bank_tran_id = $result->bank_tran_id;
	$trans_id = $result->trans_id;
	$refund_ref_id = $result->refund_ref_id;
	$errorReason = $result->errorReason;

	# API AUTHENTICATION
	$APIConnect = $result->APIConnect;

} else {

	echo "Failed to connect with SSLCOMMERZ";
}

$refund_ref_id=urlencode('59bd63fea5455');
$store_id=urlencode("testbox");
$store_passwd=urlencode("qwerty");

$requested_url = ("https://sandbox.sslcommerz.com/validator/api/validationserverAPI.php?refund_ref_id=$refund_ref_id&store_id=$store_id&store_passwd=$store_passwd&format=json");

$handle = curl_init();
curl_setopt($handle, CURLOPT_URL, $requested_url);
curl_setopt($handle, CURLOPT_RETURNTRANSFER, true);
curl_setopt($handle, CURLOPT_SSL_VERIFYHOST, false); # IF YOU RUN FROM LOCAL PC
curl_setopt($handle, CURLOPT_SSL_VERIFYPEER, false); # IF YOU RUN FROM LOCAL PC

$result = curl_exec($handle);

$code = curl_getinfo($handle, CURLINFO_HTTP_CODE);

if($code == 200 && !( curl_errno($handle)))
{

	# TO CONVERT AS ARRAY
	# $result = json_decode($result, true);
	# $status = $result['status'];

	# TO CONVERT AS OBJECT
	$result = json_decode($result);

	# TRANSACTION INFO
	$status = $result->status;
	$bank_tran_id = $result->bank_tran_id;
	$trans_id = $result->trans_id;
	$refund_ref_id = $result->refund_ref_id;
	$errorReason = $result->errorReason;

	# API AUTHENTICATION
	$APIConnect = $result->APIConnect;

} else {

	echo "Failed to connect with SSLCOMMERZ";
}

/**************************************************
Example Code in PHP - SSLCOMMERZ IPN Validation Function
Developed on 22/11/2015
SSLCOMMERZ Document Version 3.00
***************************************************/

function _ipn_hash_varify($store_passwd="") {

	if(isset($_POST) && isset($_POST['verify_sign']) && isset($_POST['verify_key'])) {
		# NEW ARRAY DECLARED TO TAKE VALUE OF ALL POST

		$pre_define_key = explode(',', $_POST['verify_key']);

		$new_data = array();
		if(!empty($pre_define_key )) {
			foreach($pre_define_key as $value) {
				if(isset($_POST[$value])) {
					$new_data[$value] = ($_POST[$value]);
				}
			}
		}
		# ADD MD5 OF STORE PASSWORD
		$new_data['store_passwd'] = md5($store_passwd);

		# SORT THE KEY AS BEFORE
		ksort($new_data);

		$hash_string="";
		foreach($new_data as $key=>$value) { $hash_string .= $key.'='.($value).'&'; }
		$hash_string = rtrim($hash_string,'&');

		if(md5($hash_string) == $_POST['verify_sign']) {

			return true;

		} else {
			return false;
		}
	} else return false;
}


$result = "NO Result";


if(_ipn_hash_varify("STORE PASSWORD") ) {
	$result =  "Hash validation success.";
} else {
	$result =  "Hash validation failed.";
}