在线获取信用卡信息而不进行处理——如何最好地做到这一点？
我收到了许多客户的请求，希望在线获取客户的信用卡号，然后在商店的 POS 终端上处理付款。 我想知道这样做的最佳方法是什么。
我不想以纯文本形式将信用卡号存储在服务器上，也不想以纯文本形式发送包含该号码的电子邮件。
客户不想注册在线支付账户，因为在线支付处理器的成本更高且额外。 此外，两个客户都无法在线收费，因为由于产品缺货或客户要求出现问题，总额可能会发生变化。
我还有什么其他选择？
我将使用 PHP。 我也在加拿大，如果规则对我应该使用哪种方法有任何影响。
I have had a number of requests from clients wanting to take a customer's credit card number online and then process the payment in store at a POS of terminal. I'm wondering what the best method of doing this is.
I don't want to store the credit card number on the server in plain text and I don't want to send an email with the number in plain text.
The clients don't want to sign up for an online payment accounts because of the higher and additional cost of an online payment processor. Also both customers can't charge online because the total will likely change because of out of stock products or problems with customers request.
What other options do I have?
I'll be using PHP. I am also in Canada if the rules have any effect on which method I should use.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（7）
您可以使用 MySql AES_ENCRYPT 函数对卡号进行加密，然后AES_DECRYPT 检索时。 使用强密钥并在处理完数据库中的条目后将其删除。
可能有一种方法可以使用 PHP 进行 AES 加密/解密，但我不知道本地方法。
You could store the credit card data in a MySql Database (other may work but I am unfamiliar) using the MySql AES_ENCRYPT function to encrypt the card number and then AES_DECRYPT when retrieving. Use a strong key and delete the entry in the database once they are processed.
There may be a way to do the AES en/decryption with PHP but I am not aware of a native way.
最好的选择是使用非对称加密。 生成 RSA 公钥和私钥对。 将私钥放在安全的位置。 将公钥放在您的网络服务器上。 当客户想要提交信用卡详细信息时，将公钥推送给他们。 在此客户端使用公钥加密数据。 在 OpenSSL 中，查看 Envelope 例程 (EVP_**)。
这样，恢复明文信用卡数据的唯一方法就是使用非常安全、从未放置在网上、从未见过互联网连接的计算机私钥进行解密。
您可以再次使用 OpenSSL 创建一个非常简单的独立应用程序来执行此操作。
考虑到您要加密的数据量很小，我认为这是一个相当实用的解决方案。
更有效但更复杂的解决方案是使用客户端生成的密钥进行 AES 加密数据。 然后按上述方法加密此 AES 密钥（在我的上述解决方案中将信用卡替换为 AES 密钥。）
Your best bet is to use asymmetric encryption. Generate a RSA public and private key pair. Place the private key in a SECURE location. Put the public key on your webserver. When clients want to submit their credit card details, push the public key to them. Encrypt the data using the public key, on this client side. In OpenSSL, look at the Envelope routines (EVP_**).
This way, the only way to recover the plaintext credit card data will be to Decrypt using the very secure, never placed online, never seen an internet connected computer private key.
You could create a pretty simple standalone app that does this, again with OpenSSL.
Considering the small amount of data you want to encrypt, I think this is a fairly practical solution.
A more efficient, but more complicated solution is to AES encrypt the data with a key generated client side. Then encrypt this AES key as above (replace credit card with AES key in my above solution.)
存储信用卡将符合 PCI 合规性。
PCI 的规则和规定是繁琐而详细的。 这不是一个简单的问题。 如果我必须重来一次，我会考虑购买一辆符合 PCI 标准的推车并安装它，然后就可以使用它了。
Storing the credit card at all will come under PCI compliance.
The rules and regs of PCI are ornorous and detailed. This is not a simple problem. If I had to do it over again, I would look at buying a cart that is PCI compliant and installing that and be done with it.
我知道您要求一个不涉及支付处理器的解决方案，但加拿大有一个名为 CurePay 的信用卡处理器，据我所知，它相对便宜（我自己不使用它）。 www.curepay.com。 可能值得给他们打电话，至少了解定价。
另外，我似乎还记得有关获取信用卡号码的某种合规性。 “不正确”地存储或处理信用卡可能会让您面临法律麻烦。 不是想吓唬你，只是确保你确实在考虑这样的事情，无论你采取什么解决方案。
I know you asked for a solution that doesn't involve a payment processor, but there's a credit card processor called CurePay in Canada that from what I have heard is relatively cheap (I don't use it myself). www.curepay.com. Might be worth giving them a shout, at least to find out about pricing.
Also, I seem to remember something about some sort of compliance around taking credit card numbers. Storing credit cards or processing them "incorrectly" might leave you open to legal troubles. Not trying to scare you, just making sure you are definitely considering things like this with whatever solution you go ahead with.
我建议使用 Authorize.net（只是因为我用过它）。 您可以将信用卡信息发布到 Authorize.net 以捕获（AUTH_CAPTURE 我相信）要收费的信用卡信息。 然后，您的客户可以登录到 Authorize.net 虚拟终端，并根据可用库存收取或作废每笔付款。
请勿将信用卡信息存储在可通过互联网访问的数据库中，即使该信息已加密。 我不知道 PCI 合规性从哪里开始和结束，但我确实知道，如果您的客户存储信用卡信息，那么他们接受的信贷提供商就要求他们遵守 PCI 合规性。 PCI 合规性是一个难题，我推荐的方法是我发现的最简单的解决方法。 并且给客户带来的麻烦也最少。
I recommend using Authorize.net (only because that's what I have used). You can post the credit card information to Authorize.net to capture (AUTH_CAPTURE I believe) the credit card information to be charged. Then your client can log in to the Authorize.net virtual terminal and charge or void each payment depending on available inventory.
DO NOT store credit card information, even if it's encrypted, in a database that is accessible via the internet. I do not know where PCI compliance begins and ends, but I do know that if your client is storing credit card information, then they are required to be PCI compliant by the credit providers they accept. PCI compliance is a pain, and the approach I recommend is the easiest way around it that I have found. And with minimal headaches for the client.
我通过构建 GPG 前端并允许网站所有者生成自己的 GPG 密钥解决了这个问题。 然后，所有信用卡数据都经过 GPG 加密，并且只能使用网站所有者的私钥进行解密，为了额外的安全性，如果需要，可以将私钥保留在服务器之外。
I solved this problem by building a frontend to GPG and allowing the website owner to generate their own GPG keys. Then, all credit card data is GPG encrypted and can only be decrypted with the website owner's private key, which for additional security could be kept off the server if desired.
与使用 POS 机相比，我建议使用大量可用的支付处理器。 大多数评论是 PayPal、Authorize.net、CyberSource...它们都有编程 API，可让您与您的网站进行交互。
其次，我使用 Rijndael 加密，因为我相信这是存储卡数据最安全的方式。 我竭尽全力将加密密钥隐藏在网络配置之外（单独的文件、注册表密钥等）。
最后但可能是最重要的一点是，您应该重点关注 PCI（支付卡行业）合规性认证 (https:// www.pcisecuritystandards.org/）。 我相信这很快就会成为在线接受卡数据的要求（如果还没有的话）。 未来，不遵守规定的人可能会受到罚款。
There are a large number of payment processors available that I would recommend over using a POS machine. Most comment are PayPal, Authorize.net, CyberSource... all have programming APIs to let you interface with your site.
Secondly, I use Rijndael encryption, as I believe it is the most secure way to store card data. I go to great lengths to hide the encryption key outside of the web config (seperate file, reg key, etc).
Last, but probably most important, is that you should strongly look at PCI (Payment Card Industry) compliance certification (https://www.pcisecuritystandards.org/). I believe this is quickly becoming a requirement (if it isn't already) to accepting card data online. In the future, there may be a fine for those who do not comply with the regulations.