Re: Storing credit card numbers temporarily (OT)

[donarb]

Another option not mentioned here is to not handle the credit card number at all.

Some CC processors will allow you to insert a custom page into your ordering flow. The customer jumps to the page hosted at the processor that accepts the cc number and other info. On approval (or denial) the customer is redirected back to your site to continue the ordering process.

I did this on a site I wrote and I was happy that I didn't have to worry about liability issues with the client's server storing credit card numbers.

If you really want to store sensitive information on your server, take a look at the book "Translucent Databases" by Peter Wayner. This book shows examples of how to store data securely.