Advice - Forms and Credit Card Security
It's not secure at all to store or send credit card numbers in the database and via plain text email. Without careful consideration bad practice to do so.

I think you need to rethink the order fulfilment process.

You should instead consider using the refund feature of your payment gateway to refund payment after the transaction is completed, if it fails validation.

Alternatively, look at providing some sort of API process so the stock and shipping details can be verified during the checkout process, prior to payment.

There's also an option of "Authorize" vs "Capture" payment modes provided by some payment gateways to allow delayed payment capture.

In the meantime, please review PCI Compliance requirements:


http://en.wikipedia.org/wiki/Payment_Card_Industry_Data_Security_Standard
https://www.pcisecuritystandards.org/security_standards/why_comply.php
https://www.pcisecuritystandards.org/pdfs/pci_ssc_quick_guide.pdf