php credit card processing

[J Cellini]

My merchant account company is raising my rates and making me buy new software. I am looking for a different solution and anyone familiar with credit card processing may be able to give me some good advice.

Up until now, I used software that I installed on my computer that would enable me to process transactions over the Internet. My question is: When someone gives me a credit card number, can I process credit cards using a secure page coded with php? I have a dedicated IP, I can get an SSL certificate, and I can sign up with a credit card gateway like Authorize.net. Why would I need a merchant account (who will charge me a percentage of everything I make)?

There are a number of good php credit card processing scripts available. Can I bypass the merchant account company using a php page that will process my credit cards?

[Lawrence_Cramer]

Hi John...

First - Never, ever, under any circumstances store consumer credit card data in your database. Period. In a shared host environment there is no way to adequately secure it and doing so exposes you, or your client to real legal and liability issues.

Here's a blog post on the tiopic: http://blog.cartweaver.com/index.cfm?newsid=13

You'll notice that this is a fairly old post, and this issue hasn't gotten any less critical.  In fact - note to self "do an updated post on this" - because even a "hold harmless" agreement from the client won't adequately protect you any more. So, just don't do it.

As for gateways - I'd recommend one of the dedicated true real-time processors (frankly I don't think highly of either PayPal Web Payments Pro or Google Check-out, both are "hybrids" that serve to promote their brand on your store - not a truly professional approach)  I would recommend one that is reputable and truly operates in real time and transparently like Authorize Net, PayPal PayFlow Pro, or LinkPoint.

Hope this helps. If you have any other or specific questions let me know I'd be happy to help.

--   
Lawrence Cramer   *Adobe Community Professional*
www.Cartweaver.com
Complete Shopping   Cart Application for
Dreamweaver, available in PHP and CF

Stay updated - Friend, Follow, and Bookmark!
http://www.twitter.com/Cartweaver

http://blog.cartweaver.com
http://www.cartweaver.com/facebook

[J Cellini]

Lawrence,

I have always been uncomfortable with keeping credit cards for automatic

payments and never have done it. But there a lot of companies (like goDaddy,

hosting companies, cell phone companies, etc.) that keep a credit card on

file and automatically charge it every payment period. They must store that

information in a database. Do you know how they do it and how they secure

that information? They must have several levels of security.

I use Authorize.net for a few of my clients and it's a good gateway to use

(and like you said a reputable company) especially if you are doing shopping

carts. Most third party shopping carts have software that will easily

integrate with Authorize.net. (I will probably end of purchasing

cartweaver-which I have been looking at a long time.)

Like I stated before, most of my clients pay with a check but a few will

give me a credit card over the phone. In this case, my Sam's club merchant

account works well and is an inexpensive solution.

John

[netartdesign]

how is cartweaver better than other 3rd party shoping cart?

[J Cellini]

netartdesign wrote:

how is cartweaver better than other 3rd party shoping cart?

It depends on what you need. I have had experience with Zen cart and Volusion. I inherited a zen cart shopping cart web site to redesign and make it work better. I did not like Zen cart at all (I have already commented on Zen cart in previous posts). In a nut shell, zen cart is open source software with very little support and I don't think a lot of people pay much attention to it anymore. I spent valuable hours and hours trying to resolve a number of issues.

Volusion is a pretty good solution. It's not free but the cost is reasonable (you pay a monthly fee but the hosting is included in the fee). There is plenty of good support which saves you a lot of time (and money). In most cases, the phone support techs knew what they were talking about. Volution uses ASP instead of PHP for its server-side language and I don't know a thing about ASP code, but Volusion does a good job of separating different technologies so you can easily design the site the way you want (you really never have to worry about the server-side issues). The only problem I had was that the web site is based on a template (that you can redesign) and some of the features are difficult or sometimes inflexible (but this turned out to be a small issue). I would give Volusion high marks.

I haven't had any experience with Cartweaver but I spent a lot of time looking into it. The support seems to be pretty good. It's a Dreamweaver extension so you can use it with Dreamweaver. You can get the PHP version-I know the basics of PHP but I am working on learning advanced features (even if your PHP knowledge is very little, Cartweaver support will work with you). It's a one-time purchase, so there is not a monthly charge. I host most of the web sites I create for people, so I can continue to make money on the hosting after a site is built.

[netartdesign]

got it. i will probobly will end getting cartweaver my self. after all ive been looking in this forum and others i got to the conclusion that if you take the parameters here are time,profetionality,convinient and security. if im trying to put all the info i got togethor i will probobly will end up getting the cartweaver. just not sure yet about the payment proccess. is authorize.net work good international outside of the states?

[Lawrence_Cramer]

Authorize Net can take orders from other countries no problem, we get orders from all over the world. Now if you are in another country, like the UK or somewhere in the EU then you may need to see what is available to work with your local merchant accounts.  So depending on your location it may take a little research to come up with the best solution.

For the US, while we have developed intigrations with many payment gateways Authorize Net is about my favorite. They are very relible, have copetative rates and also have one of the best fraud prevention suites around.

Lawrence Cramer   *Adobe Community Professional*
www.Cartweaver.com
Complete Shopping   Cart Application for
Dreamweaver, available in PHP and CF

Stay updated - http://blog.cartweaver.com

[netartdesign]

ok

thanks for the help

[Lawrence_Cramer]

I avoid doing much "horn blowing" on this forum, it's not a place to sell. If you'd like a bit more info feel free to pop me an e-mail directly at:  lawrence  at  Cartweaver dot com I'll be happy to answer any questions you have.

Lawrence Cramer   *Adobe Community Professional*
www.Cartweaver.com
Complete Shopping   Cart Application for
Dreamweaver, available in ASP, PHP and CF

Stay updated - http://blog.cartweaver.com

[jon8]

unless your running a pci compliant dedicated server for that one website... you are not suppose to be storing any credit card information.  i recommend using a gateway service approved by the merchant account with a virtual terminal and documented api to hook into via any programming language, including php.  best of luck