QUOTE(cyberscribe @ 27 Nov, 2005 - 09:58 PM)
Salting md5 for one-way encryption can bolster security:
CODE
...
$salt = '470dcd7b'; //or whatever
$password_hash = md5($salt.$password.$salt);
...
and
CODE
if ($password_hash === md5($salt.$password.$salt)) {
//authentication successful ...
You don't want to store credit cards in a database. Trust me. Use a third-party service like VeriSign Recurring Biling. Unless you want to be responsible for 100% of the data security issues on the server and with all the clients involved (i.e. every browser that accesses your admin), and pass PCI compliance when your vendor starts doing more than 20,000 cards per year, leave card storage to a CISP-certified payment gateway.
If don't heed my warning and still decide to do it yourself, use strong encryption like triple DES or (ideally) AES. You can use the mcrypt library in PHP for such purposes, but there are many issues involved with realtime encryption in a plain-text scripting environment. Check out this article:
http://www.robertpeake.com/archives/33-PHP...cle-Online.htmlfor more.
i know that i don't want to store cc info in a db, unfortunately, it's already being done, but on a windows server using asp (something i know nothing about), the billing isn't recurring, and i don't think we even hit 1000 transactions a year, and the billing isn't done online...we need the cc in the db so that they can be referenced twice, once when the order is placed, and again when it's complete, after that we can delete it from the db...
with that knowledge, what's the best way to go about doing this?
27 Nov, 2005 - 05:29 PM
| 