Advice - Forms and Credit Card Security I'm working on a website for a client where he wants a order form created and e-mailed back to him.  Because of the nature of the business, the card cannot be charged until the order is verified that all the items are in stock and the shipping cost verified - then they charge the card themselves.  So the form is supposed to gather the card numbers.  The problem is that when I use a webform, it actually SAVES the credit card number!  YIKES!! I've created a PDF interactive form, which I think is a much better and safer option, but I can't get the PDF to display on the page like the customer wants.
Does anyone have any advice on what I should do or look into??
Thanks so much!!
It's not secure at all to store or send credit card numbers in the database and via plain text email. Without careful consideration bad practice to do so.

I think you need to rethink the order fulfilment process.

You should instead consider using the refund feature of your payment gateway to refund payment after the transaction is completed, if it fails validation.

Alternatively, look at providing some sort of API process so the stock and shipping details can be verified during the checkout process, prior to payment.

There's also an option of "Authorize" vs "Capture" payment modes provided by some payment gateways to allow delayed payment capture.

In the meantime, please review PCI Compliance requirements:


http://en.wikipedia.org/wiki/Payment_Card_Industry_Data_Security_Standard
https://www.pcisecuritystandards.org/security_standards/why_comply.php
https://www.pcisecuritystandards.org/pdfs/pci_ssc_quick_guide.pdf