I've just seen an online hotel booking system that uses javacript and a PHP script library interacting with a MySQL database. For taking deposits it uses a "pickup and process" system Like Mal's shopping cart, where credit card details are stored on a secure server and then processed by the hotelier through his existing physical machine. It looks OK enough, and I'm considering buying a licence to use it on a client's site, but how can I know that the credit card details are not being seen by the person who runs the system? I don't like to sound rude enough to ask him, but how do I know he's not collecting these details? I suppose I could ask the same of Mal's shopping cart. Maybe I'm missing something here?
