在SESSION中存储信用卡号-可以解决吗?

本文介绍了在SESSION中存储信用卡号-可以解决吗?的处理方法，对大家解决问题具有一定的参考价值，需要的朋友们下面随着小编来一起学习吧！

问题描述

我非常了解PCI合规性，因此在结帐过程中不需要花太多时间在我们的公司数据库中存储CC编号(尤其是CVV编号).

I am well aware of PCI Compliance so don't need an earful about storing CC numbers (and especially CVV nums) within our company database during checkout process.

但是，我希望在处理敏感的消费者信息时尽可能地安全，并且很好奇如何尽可能避免在不使用SESSION变量的情况下在页面之间传递抄送号码.

However, I want to be safe as possible when handling sensitive consumer information and am curious how to get around passing CC numbers from page to page WITHOUT using SESSION variables if at all possible.

我的网站是通过以下方式构建的:

My site is built in this way:

步骤1)收集信用卡来自客户的信息-何时客户点击提交，信息首先通过JS运行验证，然后通过PHP运行验证，如果他通过所有通过进行第2步.
步骤2)信息显示在供客户制作的评论页面确定他们即将到来的细节显示交易.只有CC的前6个和后4个是显示在此页面上，但卡类型和exp日期完全显示出来.如果他点击继续
步骤3)信息发送到另一个运行最后一个PHP页面验证，发送信息通过安全的支付网关，以及字符串返回详细信息.
第4步)如果一切都很好，那么消费者信息(个人信息，非个人信息)CC)存储在数据库中并重定向到完成页面.如果有的话不好，他被告知并被告知再次访问CC处理页面以再试一次(最多3次).

Step 1) collect Credit Cardinformation from customer - whencustomer hits submit, theinformation is first run through JSvalidation, then run through PHPvalidation, if all passes he movesto step 2.
Step 2) Information is displayed ona review page for customer to makesure the details of their upcomingtransaction are shown. Only thefirst 6 and last 4 of the CC areshown on this page but card type,and exp date are shwon fully. If heclicks proceed,
Step 3) The information is sent toanother php page which runs one lastvalidation, sends informationthrough secure payment gateway, andstring is returned with details.
Step 4) If all is good and well, theconsumer information (personal, notCC) is stored in DB and redirectedto a completion page. If anything isbad, he is informed and told torevisit the CC processing page totry again (max of 3 times).

有什么建议吗?

在这个问题上，我收到了很多非常好的答复-大多数人都同意以下几点:

I have received a lot of really good response on this question - majority seem to agree on the following:

在之后获取POST变量验证已运行
加密ccnum和cvv(不确定您可以将cvv存储在DB中虽然如此)
存储在临时数据库中
查看"后立即访问数据库页面就可以了
从数据库解密详细信息
将信息发送给处理器
接收响应
终止数据库

taking POST variables aftervalidation is run
encrypting ccnum and cvv (not sureyou are allowed to store cvv in DBat all though)
Storing in temporary DB
Access DB immediately after 'review'page is OK'd
decrypt details from DB
send information to processor
receive response
terminate DB

我认为这总体上很有意义.是否有人有好的加密/解密方法以及创建临时DB信息的最佳方法，该信息在以后的调用中会自动删除?

I think this makes sense overall. Does anybody have good method for the encryption/decryption along with best way to create temp DB info that is automatically deleted on later call?

我正在用PHP和MySQL DB编程

I am programming in PHP and MySQL DB

我遇到了Packet General，这似乎是一个理想的解决方案，但实际上并不想为实现该目标而另外购买软件许可. http://www.packetgeneral.com/pcigeneralformysql.html

I came across Packet General which seems like an ideal solution but REALLY don't want to pay for another software license to accomplish this goal.http://www.packetgeneral.com/pcigeneralformysql.html

我现在发布了一些示例代码，我整理它们以使本文中提到的加密/解密/密钥和存储有意义.希望已经有用的贡献者可以进行验证，其他人也可以使用类似的功能.为了篇幅，我将不讨论用于实际CC编号本身的验证方法.

I have now posted some example code I put together trying to make sense of the encryption/decryption/key and storage mentioned in this post. Hopefully, the already helpful contributors can validate and others are able to use similar functionality. For the sake of length I will not go into the validation methods used for the actual CC num itself.

<form action="<?php $_SERVER['PHP_SELF']; ?>" method="POST">
<input type="text" name="CC" />
<input type="text" name="CVV" />
<input type="text" name="CardType" />
<input type="text" name="NameOnCard" />
<input type="submit" name="submit" value="submit" />
</form>

PHP加密和存储数据

<?php

$ivs = mcrypt_get_iv_size(MCRYPT_DES,MCRYPT_MODE_CBC);
$iv = mcrypt_create_iv($ivs,MCRYPT_RAND);
$key = "1234"; //not sure what best way to generate this is!
$_SESSION['key'] = $key;

$ccnum = $_POST['CC'];
$cvv = $_POST['CVV'];
$cctype = $_POST['CardType'];
$ccname = $_POST['NameOnCard'];

$enc_cc = mcrypt_encrypt(MCRYPT_DES, $key, $ccnum, MCRYPT_MODE_CBC, $iv);
$enc_cvv = mcrypt_encrypt(MCRYPT_DES, $key, $cvv, MCRYPT_MODE_CBC, $iv);
$enc_cctype = mcrypt_encrypt(MCRYPT_DES, $key, $cctype, MCRYPT_MODE_CBC, $iv);
$enc_ccname = mcrypt_encrypt(MCRYPT_DES, $key, $ccname, MCRYPT_MODE_CBC, $iv);


//if we want to change BIN info to HEXIDECIMAL
// bin2hex($enc_cc)

$conn = mysql_connect("localhost", "username", "password");
mysql_select_db("DBName",$conn);

$enc_cc = mysql_real_escape_string($enc_cc);
$enc_cvv = mysql_real_escape_string($enc_cvv);
$enc_cctype = mysql_real_escape_string($enc_cctype);
$enc_ccname = mysql_real_escape_string($enc_ccname);

$sql = "INSERT INTO tablename VALUES ('$enc_cc', '$enc_cvv', '$enc_cctype', '$enc_ccname');

$result = mysql_query($sql, $conn) or die(mysql_error());
mysql_close($conn);

Header ("Location: review_page.php");

?>

PHP解密数据并发送到网关

    $conn = mysql_connect("localhost", "username", "password");
    mysql_select_db("DBName",$conn);

$result = mysql_query("SELECT * FROM tablename");

echo mcrypt_decrypt (MCRYPT_DES, $_SESSION['key'], $enc_ccnum, MCRYPT_MODE_CBC, $iv);
echo mcrypt_decrypt (MCRYPT_DES, $_SESSION['key'], $enc_cvv, MCRYPT_MODE_CBC, $iv);
echo mcrypt_decrypt (MCRYPT_DES, $_SESSION['key'], $enc_cctype, MCRYPT_MODE_CBC, $iv);
echo mcrypt_decrypt (MCRYPT_DES, $_SESSION['key'], $enc_ccname, MCRYPT_MODE_CBC, $iv);

mysql_close($con);
?>

然后继续获取刚刚在字符串中发送的数据，并在Gateway提交中使用.看起来正确吗?

then proceed to take the data just sent in the string and use in Gateway submission. Seem right?