I don't want to have paying clients leave our domain name . . . so what is the terminology I should look for when browsing merchants?
There may be other names for it, but the most common one is
silent post. Most robust processors support it.
Generally (of course) it requires posting to the gateway only from a valid SSL connection. The trick is to curl (or PHP's implementation) as a part of the auth/charge process.
You're sitting on the checkout page with the CC info fields, etc., post to checkout.php/cgi/asp etc.
-- Do what you do with input
-- curl using the post method to the processor. Generally this takes the form of a query string or an XML string. The general process is
$result = `curl -d [query string] [post url]`;
(PHP method is similar)
The response in $result is generally also a query/XML string, but what you're looking for is the approved/declined(etc.) code value. Based on the response,
- if error, return to checkout form with error displayed. For security considerations, most API integration guides recommend it's "good practice" not to display the specific error (invalid card, declined, etc.) But it's **always** a good idea to log API responses.
- if approved, update your database, send the emails, return a response to the browser.
Customer never leaves your site.
