Securely passing Credit Card info

[sledgeweb]

Hello all-

I'm been programming in PHP for a few years now, but I'm just now encountering my first job where I need an to process credit card payments live - and I want to make sure I'm doing everything securely before making it public.

A) I'm using PHP, and the pages with info-gathering forms are on a SSL server. I check the HTTP_REFERER to make sure they arrived from a specefic URL, and that no query string variables were added.

B) Once the form (including CC info) is submitted, it goes to a verification page also on the SSL server. On this page, all their information is stored into PHP SESSION variables.

C) If the information is verified, the user is sent to a third page, where the information is pulled from the session variables and submitted to Authorize.net The result is read, and the proper output given. If everything went well, some info is stored in a DB (not CC info), and then the session is destroyed after printing a receipt.

My questions are:
1) Is EVERYTHING in an SSL connection encrypted? Session Variables? Form Values? Etc?

2) What is the best way to pass CC info? In A->B, it is passed by the form values. In B->C, it is passed through Session variables. Is one way better than another? I've read that sessions are more secure... but I'm not sure how to implement this in the A->B passing.

3) Any other security issues I should be aware of in this format of payment processing?

Thanks,
Sledgeweb

[daisho]

The one thing that I'd look at is how your sessions are being stored. By default they are stored in /tmp in flat files by PHP. This is _NOT_ secure because anyone with access to the server could get at them.

PHP recommends putting them in a seperate directory with tighter security.

A better solutions would be to use in memory sessions providing you webserver is on one box and your PHP has support for it.

daisho

[sledgeweb]

Would it be better to just pass them as hidden form values using POST? Rather than using SESSIONS? I'm having a hard time finding info on this... been searching for about 4-5 days now.

The information is passed three times.

1) From input page to confirmation page as POST.
2) From confirmation page to submission page as SESSION.
3) Using CURL, passed to payment gateway in querystring as POST (response is read, user never leaves page 2).

Since I'm already using POST for two of the passes, should I just stick with it, using hidden form fields, instead of using SESSIONS?

I just want to be sure I'm passing the CC info in a secure manner.

Thanks,
Sledge

[daisho]

I would avoid having a CC Number in a post variable. When they first post it to you it's never recorded. If you pas it back to them as part of the HTML page it could be.

I would talk to your host to find out what type of sessions that you have on your system. Sessions when done right offer you more security.

daisho