使用网站上托管的付款表格处理信用卡交易数据
在为网站开发信用卡交易页面以将数据传输到支付网关时，我注意到有许多输入选项可用。支付网关的返回响应也包含大量数据。
下面列出了一些输入字段，我相信大多数支付网关都会捕获这些字段：
- 客户地址 客户
- ID 客户
- IP 地址
- 描述
- 电子邮件
- 名字和姓氏
- 发票号码和 PO 号码
- 税和免税状态
- 交易id
下面列出的是一些响应字段，我相信这些字段通常会返回到网站：
- 总体响应（接受、拒绝、错误、保留）
- 具体响应（例如地址验证、卡 CCV） 验证等）
- 响应
- 哈希（商家帐户独有）
- 来自上面输入的
数据的具体描述我想了解：
- 您将在内部处理哪些数据而不发送到网关？
- 在处理之前您将通过网关路由哪些数据？
- 您将使用哪些响应进行进一步处理？
- 您会存储哪些回复以供将来参考，为什么？
我相信这个决策过程是网络开发人员在设置电子商务应用程序时通常会遇到的。有人愿意分享他/她的知识吗？
首先，让我尝试一下
- 您将在内部处理哪些数据而不发送到网关？
电子邮件 - 我会直接从我的网络应用程序发送电子邮件来通知客户交易成功。支付网关提供商不需要了解我客户的详细信息。
While developing a credit card transaction page for a website to transmit data to the payment gateway, I notice that many input options are available. The return response from the payment gateway also contains a myriad of data.
Listed below are some input fields which, I believe, are captured on most payment gateways:
- customer's address
- customer id
- customer's IP address
- description
- first name and last name
- invoice number and PO number
- tax and tax exempt status
- transaction id
Listed below are some response fields which, I believe, would generally be returned to the website:
- overall response (accept, reject, error, hold)
- specific responses (such as address verification, card CCV
verification, etc) - specific description of response
- hash (unique to merchant account)
- data from the input above
I would like to find out:
- Which data would you process internally without sending to the gateway?
- Which data would you route through the gateway before processing?
- Which responses would you use for further processing?
- Which responses would you store for future reference, and why?
I believe this decision making process is what web developers would normally encounter when they set an e-commerce application. Would anyone like to share his/her knowledge?
To start the ball rolling, let me attempt
- Which data would you process internally without sending to the gateway?
email - I would notify customers of a successful transaction by emailing directly from my web application. The payment gateway provider does not need to know my customers' detail.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
所以在信用卡行业，有一种叫做 PCI 合规性的东西。请访问 https://www.pcisecuritystandards.org/ 或其他此类网站了解更多信息。自行存储/处理信用卡数据有很多要求。您可以做的另一件事是使用像 http://www.chargify.com 这样的公司来负责为您提供 PCI 合规性。他们提供了一个处理模块供您在网页中参考。数据在经过处理之前永远不会穿过您的服务器。然后，如果您想设置订阅，您只会获得诸如客户信息、定期付款令牌之类的信息。
编辑：
因此，根据您的评论，这是我在几个地方所做的事情。我们通常会在发送付款之前使用我们想要拥有的任何用户数据创建用户记录。我们还在提交抄送数据之前创建所有交易记录 - 减去最终交易结果。这样，如果您的系统出现故障，您还没有接触过信用卡。网关收取退款费用。一切都在等待一两个标志被设置。获得收费权限，得到客户确认，完成交易。如果由于某种原因交易失败，您将拥有重置页面所需的所有信息……信用卡信息除外。
至于交易信息，一定要存储状态和参考号。您的财务人员会很高兴能够将特定交易与 cc 网关报告中的特定条目联系起来。至于其他交易信息，我发现总体上没有人再次使用它......除非您想评估网关拒绝卡的频率。如果地址信息过多，您可能需要切换网关。
So in the credit card industry, there is something called PCI compliance. Look at https://www.pcisecuritystandards.org/ or some other such site for more information. There are a fair number of requirements to storing / processing credit card data yourself. The other thing you can do instead is to use a company like http://www.chargify.com who takes care of PCI compliance for you. They provide a processing module for you to reference in your web page. The data never crosses your servers until it has been processed. Then you will only be given things like customer information, a recurring payment token if you want to set up subscriptions.
EDIT:
So based on your comments, here's what I've done in a couple of places. We generally will create the user record with whatever user data we want to have prior to sending the payment. We also create all of the transaction records prior to submitting the cc data - minus the final transaction result. That way if a failure occurs in your system, you haven't touched the credit card yet. Gateways charge for refunds. Everything is waiting for a flag or two to be set. Acquire the authority to charge, get confirmation from the custumer, then complete the transaction. If for some reason the transaction fails, you have all of the information required to reset their pages... except the credit card info.
As far as transaction information, definitely store the status and the reference number. Your finance people will appreciate being able to tie out specific transactions with specific entries in the cc gateway reports. As far as additional transaction information, I've found that overall no one uses it again...unless you want to evaluate how often your gateway rejects cards. If it chokes on address info a lot, you might want to switch gateways.