SSL certificates and forms

[mr_nabo]

Hi,

Just wondering about a quick solution to securing forms that will be taking address, tel no., email and credit card details. Is it just a case of buying an SSL certificate and then working out how to implement that into a simple form?

I'm new to secure form submissions...

Any advice on where to start greatly appreciated.

Thanks

[jtara]

I assume you are talking about securing the data stream between your site and the user. But there is a lot more than that to "securing the data"!

Secure web data transfer is done using the HTTPS protocol, on a separate port. You will need to configure your web server for this. Typically, the bulk of your site will be served by HTTP, with secure areas served by HTTPS. Essentially, you have two webservers, though the same server software typically handles both. Part of configuring the HTTPS server is installing an SSL certificate.

This is basic stuff, there are lots of places on the web to learn about it, and it's highly-specific to the particular web server software you are using. You are best to go to your web software's (e.g. Apache, IIS, etc.) support site for information on how to set this up. If you are on a shared host, I'd suggest you peruse your host's support area.

More critical, and often overlooked are script and host security. Can flaws in your scripts be exploited to do things you didn't intend? (Such as retrieving personal data without first logging in?) Where do you store the data you collect? Is the data encrypted on disk? How secure is your server from external attack? (Firewall, critical software updates, known exploits, etc.)

[mr_nabo]

I see, I feared my interest in this would open a big can of worms. I'll read up about it on the net with pointers you've given me. I'm with a shared host so will need to coordinate how to integrate my forms etc. with them.

Thanks for the help

[rocknbil]

securing forms that will be taking address, tel no., email and credit card details.

Another dimension is what you do with this data once it's submitted from the form. Emailing this info is out of the question (or should be.) Although the site may be encrypted and secure, transmission of data via email is not.

Secondly if you store credit card data on the server to be retrieved by an administrative login, you or the site owner are liable in the event of credit card theft. Generally you should only post this data to a payment gateway.