diff --git a/webapp/controller/ShopController.class.php b/webapp/controller/ShopController.class.php
index df12d60a..52c3d739 100644
--- a/webapp/controller/ShopController.class.php
+++ b/webapp/controller/ShopController.class.php
@@ -445,12 +445,13 @@ class ShopController extends BaseAuthedController
         error_log('----- inappPurchaseDiamonds -----');
         error_log('request:' . json_encode($_REQUEST));
         error_log('post:' . json_encode($_POST));
-        $channel = getReqVal('channel', '');
-        $records = getReqVal('records', '');
-        $records_json = json_decode($records, true);
-        $sign = getReqVal('sign', '');
+        $body = json_decode(file_get_contents('php://input'), true);
+        error_log('body:' . json_encode($body));
+        $channel = $body['channel'];
+        $records = $body['records'];
+        $sign = $body['sign'];
 
-        error_log('records:' . json_encode($records_json));
+        error_log('records:' . json_encode($records));
 
         // {
         //     channel: 'google',
@@ -475,7 +476,7 @@ class ShopController extends BaseAuthedController
         $record_strings = array();
 
         // 遍历 records 数组，对每个记录进行排序和拼接
-        foreach ($records_json as $record) {
+        foreach ($records as $record) {
             // 对记录的键进行升序排序
             ksort($record);
             // 把记录的键值对用等号连接，然后用 & 连接成一个字符串
@@ -502,8 +503,8 @@ class ShopController extends BaseAuthedController
         // 2. 站外充值钻石，没有订单号
         // 3. appstore 退款，没有订单号
 
-        for ($i = 0; $i < count($records_json); $i++) {
-            $record = $records_json[$i];
+        for ($i = 0; $i < count($records); $i++) {
+            $record = $records[$i];
 
             $product_id = $record['productId'];
             $order_id = $record['gameOrderId'];
@@ -523,8 +524,13 @@ class ShopController extends BaseAuthedController
                             return;
                         }
 
-                        $order = SqlHelper::selectOne($conn, 't_web2_order', array('address', 'id', 'item_id', 'goods_num', 'status'), array('order_id' => $order_id));
+                        $order = SqlHelper::selectOne($conn, 't_web2_order', array('address', 'id', 'item_id', 'goods_num', 'status'), array('order_id' => $order_id, 'status' => 0));
                         error_log('process order '. json_encode($order));
+                        if (!$order) {
+                            $this->_rspErr(3, "order not found, order_id: {$order_id}");
+                            return;
+                        }
+                        
                         SqlHelper::update($conn, 't_web2_order', array('order_id' => $order_id), array('status' => $status, 'channel' => $channel, 'out_order_id' => $out_order_id));
 
                         $id = $order['id'];