Hello,
Is it okay to save credit card data in the database. I know it will be password protected but still, it will be a disaster if someone ever hacks in. How do real world companies(mine is school project) save their customer's credit card information? Thank you in advance.

you can store the data in the db but you definatly need to encrypt. i would suggest not even storing it personally. But that is just me.

defenetly you have to secure the data while you accessing the database through queries

better you make ssl on while you accessing the database, and also just use a random textfield as a hidden value in the post and you check it for authorization whether it is coming from fine navigation or not

i will agree with that. more secure the better if its being stored. didnt really think having a SSL setup was needed since it is a class project but if its live it is a must have.

then what you are really expecting

more than this

Well as a majority companies dont store creditcard information with them as it is a big security risk and isnt safe. For example many companies use a merchant account from providers like Paypal, therefore Paypal takes care of the payment and the company need not store any details of the customer's credit card

from what I have been told, storing credit card numbers without encryption is illegal. I would recommend not storing them at all. ever.

Thanks for all your replies. hivenk: Please elaborate. Do want me to create a hidden in the user form and fill it with random data? And check it when the form is submitted?

What do I have to do as a php programmer to ensure that the data is being transmitted over ssl?
I don't have to collect credit card data if the customer is paying with paypal. But I have to collect it (requirement) when the customer is paying with a credit card. How do I ensure that data is being sent over ssl when I send the data to the bank or whomever.

What kind of encryption are we talking about?
Thanks again.

Well, in order to ensure data is being sent over a secure environment, you will have to purchase a SSL Certificate and then lets say the billing system (where you take information and all of the customer) is under a sub-domain say for example billing.domain.com

I would suggest you purchase a SSL Certificate for that subdomain and using the .htaccess file force all connections via that subdomain to use the https prefix... so, no matter what, all links, forms, etc... under that subdomain will be forced to use SSL Connection (HTTPS) therefore securing and encrypting your data.

Normally a SSL Certificate uses strong 128/256 bit encryption.

Hope this helps you.

ssl is already installed. But how do I use it? Do I have to do any thing with my php code?
Or do I just use a .htaccess file.
Sorry if I am asking stupid questions. No one in my team has built a whole site before. Its like blind leading the blind.