I’m looking to build an ecommerce form using the PRG model. My question is on how best to hold the users credit card information during each page transition (page 1 input, page 2 review/submit, page 3 thank you) — is a SESSION the best way to handle this, and is it secure enough? If not storing in a SESSION, how else would I do it? I would unset the SESSION var after the transaction is complete. Is there a simple method for encrypting the information while it is stored in the SESSION? Your thoughts appreciated.
Share
Sessions aren’t that secure, there are security risks such as:
I would suggest you to store your sensitive data into the database instead in a encrypted fashion and read that back across pages.