如果我们以表格形式获取信用卡详细信息并将其发布到任何支付网关，是否需要 PCI 投诉？
我正在从表单中的使用中捕获信用卡详细信息，然后将这些表单数据发送到支付网关，例如 PayPal 或Braintree。
信用卡捕获表单托管在 SSL (HTTPS) 中，并使用 cURL 将信用卡数据发布到支付网关。由于我们不会将信用卡数据保存到我们的服务器上，因此如果我们正在关注这种情况。
I am capturing the credit card details from the uses in a form and then sending these form data to payment gateways like PayPal or Braintree.
The credit card capturing form is hosted in SSL (HTTPS) and using cURL to post credit card data to payment gateways. As we are not saving credit card data to our server so do we need to be PCI complaint if we are following this scenario.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（6）
你不应该这样做！
处理信用卡信息的表单应始终指向支付网关作为目标，以便您的服务器不会处理任何敏感数据。
好的支付网关会向您发送回信用卡号码的缩写版本以及验证状态，以存储在您的数据库中，并可能在电子邮件或用户管理区域中向用户显示。
您还可以使用 JavaScript 从表单中获取缩短的信用卡号码（并且仅是号码！），并通过 ajax 将其发送到您的服务器，然后再将表单发送到网关。
You shouldn`t do that!
The form that handles the credit card information should always point to the payment gateway as target so your server doesn´t handle any sensitive data.
A good payment gateway will send you back a shortened version of the credit card number combined with the verification status to store in your database and possibly show the user in emails or user admin areas.
You could also use a javascript to get a shortened credit card number (and the number only!) from the form and send this via ajax to your server before sending the form to the gateway.
如果您要处理和传输信用卡信息，那么您必须遵守 PCI 规定。时期。
If you're handling and transmitting credit card information then you have to be PCI compliant. Period.
我同意发布的其他两个答案...
由于您可以访问敏感数据，充当中间人，无论您是否决定存储数据...您可以..并且您需要遵守规定。
如果您将它们传递到不属于您的另一种形式，例如 Paypal / 等，并且您实际上从未收到任何客户信用数据......这是正确的方式。
I agree with the two other answers that are posted ...
As you have access to the sensitive data, functioning as a man-in-the-middle, regardless if you decide to store the data or not ... you could ... and you need to be compliant.
If you pass them on to another form which isn't yours like Paypal / etc. and you never actually receive any client credit data ... that is the right way.
您可能仍在处理敏感数据。如果有人入侵您的服务器，他们可以轻松拦截您的通信并获取这些数据，即它仍然需要得到适当的保护。
您可能会在PCI 网站上找到正确的答案
Probably, you are still handling the sensitive data. If someone hacks your server they could easily intercept your communication and get hold of this data, i.e. it still needs to be properly secured.
You will probably find the correct answer on the PCI Website
简短的回答是肯定的。 PCI 合规性有多个级别，所有级别均由您的年销量决定。
大多数商户每年的交易量少于 2 万笔，因此可以自由地进行自我评估，以确认您是否遵守法规。 这篇文章虽然针对 Magento，但却是一个非常好的总结的风景。
这里的关键要点是您应该将其作为核心业务工作流程的一部分。
The short answer is yes. There's several levels of PCI compliance, all of which are determined by your annual sales volume.
Most merchants do less than 20K transactions annually and that affords some liberty to do a self-assessment to confirm that you are compliant with the regulations. This article, although Magento specific, is a really good summary of the landscape.
The key takeaway here is that you should have this as part of your core business workflow.
答案是否定的，如果您不存储信用卡详细信息并使用安全网关，则不必符合 PCI 标准。但是，您确实需要已有的 https。
The answer is NO, you DO NOT have to be PCI compliant if you aren't storing credit card details and using a secure gateway. But, you DO need https which you already have.