Best would be not to store them at all, and let a third party payment processor do that job (e.g. Paypal, Servebase). The rules for privacy are getting tougher and tougher (PCI Compliance), so if you don't store this data, you'll save a lot of work.
Reputation Points: 550
Solved Threads: 731
Bite my shiny metal ass!
Offline 4,177 posts
since Jul 2006