Php – Best practices for taking and storing credit card information with PHP

credit-cardPHPtransactions

Should I use sessions for the first few steps (validation, review purchase) then input the information into the database in the final submit?

Could the cookies get jacked and transform into a lawsuit? Is it too risky?

Would I need to protect my db any special way if storing credit card numbers?

Any and all recommendation and personal experiences are welcome.

Best Answer

Credit card issues have strict requirements (google "PCI Compliance") about storing credit card data.

There's at least one payment gateway that allows you to outsource the compliance stuff: http://www.braintreepaymentsolutions.com/

Last time I looked, you can run an initial transaction, and get back a token. That token can be used to make future charges against the card, but only by you. The payment gateway guys take care of storing the actual credit card data.

As far as I know (and I don't do a ton of card processing), this is probably the best solution if you need to make arbitrary charges against the same card.

If all you need is some recurring charge (a set amount at regular intervals), most payment gateways (authorize.net comes to mind) can be configured for this.

At the end of the day, if you're not dealing with a particularly large budget, you're better off outsourcing the card # storage. Doing it yourself is too much of a liability.

(Edit: As to storing things in session -- yeah, you can probably get away with that, but you should probably avoid it. Just make your initial auth/capture in-process when the CC info is submitted.)

Related Solutions

C# – Storing credit card details

Basically avoid by all means taking the responsiblity to save the CC details on your side, however I can assume you are using a thirdparty service to do your transaction such as PayPal/Verisign or whatever, most of them have API's that enables you to save CC credentials at their side, and they give you back a key that you can then use later to complete or initiate transactions, so they take care of the hard part, while all what you have to do is store this string key in your DB.

Php – Best practices to test protected methods with PHPUnit

If you're using PHP5 (>= 5.3.2) with PHPUnit, you can test your private and protected methods by using reflection to set them to be public prior to running your tests:

protected static function getMethod($name) {
  $class = new ReflectionClass('MyClass');
  $method = $class->getMethod($name);
  $method->setAccessible(true);
  return $method;
}

public function testFoo() {
  $foo = self::getMethod('foo');
  $obj = new MyClass();
  $foo->invokeArgs($obj, array(...));
  ...
}

Best Answer

Related Solutions

C# – Storing credit card details

Php – Best practices to test protected methods with PHPUnit

Related Topic