I am well aware of PCI Compliance so don't need an earful about storing CC numbers (and especially CVV nums) within our company database during checkout process.
However, I want to be safe as possible when handling sensitive consumer information and am curious how to get around passing CC numbers from page to page WITHOUT using SESSION variables if at all possible.
My site is built in this way:
Step 1) collect Credit Card
information from customer - when
customer hits submit, the
information is first run through JS
validation, then run through PHP
validation, if all passes he moves
to step 2.
Step 2) Information is displayed on
a review page for customer to make
sure the details of their upcoming
transaction are shown. Only the
first 6 and last 4 of the CC are
shown on this page but card type,
and exp date are shwon fully. If he
clicks proceed,
Step 3) The information is sent to
another php page which runs one last
validation, sends information
through secure payment gateway, and
string is returned with details.
Step 4) If all is good and well, the
consumer information (personal, not
CC) is stored in DB and redirected
to a completion page. If anything is
bad, he is informed and told to
revisit the CC processing page to
try again (max of 3 times).
Any suggestions?
