Credit Card Numbers

[swapdude]

Hi,

What would be the best and most secure way of storing credit card numbers in a MySQL database? They are used for online reservations and customers are charged later.

Regards,
swapdude

[the tree]

The best way would to not. Just use a third party system like PayPal.

[swapdude]

I cannot charge the customer at that point. I have to charge the customer at a later period in time when they actually checkin .. betweem their registration date and actualt date of move in they can still cancel the reservation and prevent being charged. But if they do not cancel and if they do not show up the customer still has to be charged using the stored information ..

is this doable ..

[NogDog]

Databases containing sensitive data should be on a server not accessible via the Internet (i.e., only accessible within a private, protected network).

Ideally things like credit card numbers should be encrypted within the database, so you might want to look at the mcrypt extenstion for PHP (www.php.net/mcrypt).

And of course you should be using SSL connections between the browser and server to prevent "sniffers" from capturing cc data.