Credit Card Information, what security precautions must be taken?
encryption, php, security
Solution
I assume SSL is a must. Is this correct?
Yes, correct.
Should I switch from shared hosting to a dedicated server?
A VPS at minimum is a very good idea. You can probably not be PCI compliant successfully on a shared host, you just don't have enough control to lock your server down as required by PCI.
I assume there is no encryption that isn't easily un-reversible that can take place between the HTML form and the PHP script, does any encryption need to be used for what I'm trying to do?
Your API should take care of that. Be sure the API is over an SSL/Secure connection as well.
Please read up on PCI requirements. You are transmitting cardholder data so you DO NEED TO BE PCI COMPLIANT. You will be at the "lowest level" of compliance (I think it's C or D). You will need to run quarterly scans on your server IP to prove compliance as well. As an FYI, I use McAffee Secure for this.
The only way you won't be subject to PCI rules is if the cardholder's data is entered on somebody else's server (think: paypal). Whenever you pay by paypal, you are transferred to PayPal's server, then transferred back. In that scheme, you would not need to be compliant.
Now a lot of the PCI requirements talk about some stuff that don't apply in the questionaire (i.e. is your server stored in a safe place, how physically secure is your building, etc....) - the good news is that your server/hosting company should handle that.
After your network scan, it'll come up with a list of things that make you non-compliant. They are almost always server related issues. You can either fix them yourself, or ask your host to help you - most hosts will do it if you send them the list. You will NOT be able to fix a lot of them on shared hosting.
Problem
We don't store any credit card information. It is gathered via an HTML form, then processed by a PHP script which uses the API from Intuit to charge the credit card. After calling the API to charge the card, all credit card information is disposed of. Here are my questions regarding the security of the credit card information: - I assume SSL is a must. Is this correct? - Should I switch from shared hosting to a dedicated server? - I assume there is no encryption that isn't easily un-reversible that can take place between the HTML form and the PHP script, does any encryption need to be used for what I'm trying to do? If there is anything else you can think please share it. Thanks for your time everyone.