问自己以下问题:为什么要存储信用卡号码?很可能你不知道。事实上，如果你确实储存了它们，并设法偷了一个，你可能会面临一些严重的责任。

我写了一个存储信用卡号码的应用程序(因为交易是离线处理的)。这里有一个好方法:

Get an SSL certificate! Create a form to get CC# from the user. Encrypt part (not all!) of the CC# and store it in your database. (I'd suggest the middle 8 digits.) Use a strong encryption method and a secret key. Mail the remainder of the CC# to whoever processes your transactions (probably yourself) with the ID of the person to process. When you log in later, you will type in the ID and the mailed-out portion of the CC#. Your system can decrypt the other portion and recombine to get the full number so you can process the transaction. Finally, delete the online record. My paranoid solution was to overwrite the record with random data before deletion, to remove the possibility of an undelete.

这听起来工作量很大，但由于从未在任何地方记录完整的CC#，黑客很难在你的web服务器上找到任何有价值的东西。相信我，这值得你安心。

Keep in mind that using SSL to send a card number from a browser to a server is like covering your credit card number with your thumb when you hand your card to a cashier in a restaurant: your thumb (SSL) prevents other customers in the restaurant (the Net) from seeing the card, but once the card is in the hands of the cashier (a web server) the card is no longer protected by the SSL exchange, and the cashier could be doing anything with that card. Access to a saved card number can only be stopped by the security on the web server. Ie, most card thefts on the net aren't done during transmission, they're done by breaking through poor server security and stealing databases.

整个过程有很多。最简单的方法是使用类似paypal的服务，这样你就不会实际处理任何信用卡数据。除此之外，要获得批准在你的网站上提供信用卡服务，还有很多事情要做。你可能应该和你的银行谈谈，以及给你发商户ID的人帮助你设置这个过程。

问自己以下问题:为什么要存储信用卡号码?很可能你不知道。事实上，如果你确实储存了它们，并设法偷了一个，你可能会面临一些严重的责任。

我写了一个存储信用卡号码的应用程序(因为交易是离线处理的)。这里有一个好方法:

Get an SSL certificate! Create a form to get CC# from the user. Encrypt part (not all!) of the CC# and store it in your database. (I'd suggest the middle 8 digits.) Use a strong encryption method and a secret key. Mail the remainder of the CC# to whoever processes your transactions (probably yourself) with the ID of the person to process. When you log in later, you will type in the ID and the mailed-out portion of the CC#. Your system can decrypt the other portion and recombine to get the full number so you can process the transaction. Finally, delete the online record. My paranoid solution was to overwrite the record with random data before deletion, to remove the possibility of an undelete.

这听起来工作量很大，但由于从未在任何地方记录完整的CC#，黑客很难在你的web服务器上找到任何有价值的东西。相信我，这值得你安心。

As others have mentioned the easiest way into this area is with the use of Paypal, Google checkout or Nochex. However if you intend to to a significant amount of business you may wish to look up "upgrading" to higher level site integrations services such as WorldPay, NetBanx (UK) or Neteller (US). All of these services are reasonably easy to set up. And I know that Netbanx offers convenient integration into some of the off the shelf shopping cart solutions such as Intershop (because I wrote some of them). Beyond that you are looking at direct integration with the banking systems (and their APAX systems) but thats hard and at that point you also need to prove to the Credit card companies that you are handling the credit card numbers securely (probably not worth considering if you are not taking $100k's worth per month).

从第一个到最后一个的成本/好处是，早期的选择更容易(更快/更便宜)设置，让你为每笔交易支付相当高的手续费。后期的设置成本要高得多，但从长远来看你付出的更少。

大多数非专用解决方案的另一个优点是，您不需要保持加密的信用卡号码的安全。那是别人的问题:-)

PCI 1.2文档刚刚发布。它给出了一个如何实现PCI合规性和需求的过程。你可以在这里找到完整的文档:

https://www.pcisecuritystandards.org/security_standards/pci_dss.shtml

长话短说，为专门存储CC信息的服务器(通常是DB服务器)创建一个单独的网段。尽可能地隔离数据，并确保只存在访问数据所需的最小访问权限。存储时加密。不要存储PAN。清除旧数据并旋转加密密钥。

不该做的事:

不要让可以在数据库中查找一般信息的同一个帐户查找CC信息。 不要把你的CC数据库和你的web服务器放在同一个物理服务器上。 不要允许外部(Internet)流量进入CC数据库网段。

Dos示例:

使用单独的数据库帐户查询CC信息。 禁止通过防火墙/access-lists访问CC数据库服务器 将CC服务器的访问限制为一组有限的授权用户。