Menu
Community /Pin to ProfileBookmark
@NogDogOct 30.2008 — #The [url=http://php.net/curl]cURL functions[/url] are often used for this sort of thing (if, in fact, we are talking about server-to-server transactions).@NogDogOct 30.2008 — #A typical scheme would be to have the form submit to a script (presumably PHP in this case) on your site. Your script would then take the form data, do whatever validation you need/want to do first, and if OK, then take that data along with whatever other data the bank's server-side program wants, and send it to them via cURL, which ends up sending a HTTP transaction exactly like a browser would when it submits a form. The cURL code would then receive the HTTP response from the bank's script, and you would then have to parse it to determine if the transaction was accepted/rejected, then output the final results to the user. @NogDogOct 30.2008 — #If you are going to have the HTML form submit to directly to the bank's server, then the only way you can get any required data to the bank is by having it in the form data. If it is not acceptable to have that data sent to the user's browser, then the only practical option I see is what I described above: having the form submit to a script on [i]your[/i] server, which then sends its own HTTP request (via cURL, sockets, whatever) to the bank's form-handler script and then captures and processes the result returned by that request.@NogDogOct 31.2008 — #Any hacker worth the name can look at the HTML source, and then set up something (using PHP and the cURL extension, for example ? ) to send his own spoofed form submission with whatever values he wants for the form post data. Therefore, if any such hidden fields (or even unhidden but non-editable ones) could cause a problem if someone changed their values, then you have potential security issues.
Passing values securely in PHP without using "hidden"
Hey all.
This is the problem and I’ll try to be as clear as possible. I am trying to incorporate a credit card acceptor/merchant account into a client’s website but the “developer’s guide” they offer for instituting the mechanism is leaving me lacking in one respect.
I’ll be dealing with Virtual Merchant and I will have to pass certain variables, e.g. all known variables not input — username, password, acct #, etc. through the php form used to collect customer information and to perform the transaction.
I have been unsuccessful in finding a good reference for doing something like this (probably because I don’t know what to search for). The bank’s developer guide suggests writing these values into server side code to truly keep them hidden/secure, but I am very new to this.
Any help/info would be greatly appreciated!!
Sign in
to post a comment20 Comments(s) ↴
0
@NogDogOct 30.2008 — #The 0
@NogDogOct 30.2008 — #0
@NogDogOct 30.2008 — #If you are going to have the HTML form submit to directly to the bank's server, then the only way you can get any required data to the bank is by having it in the form data. If it is not acceptable to have that data sent to the user's browser, then the only practical option I see is what I described above: having the form submit to a script on [i]your[/i] server, which then sends its own HTTP request (via cURL, sockets, whatever) to the bank's form-handler script and then captures and processes the result returned by that request.0
@NogDogOct 31.2008 — #Any hacker worth the name can look at the HTML source, and then set up something (using PHP and the cURL extension, for example ? ) to send his own spoofed form submission with whatever values he wants for the form post data. Therefore, if any such hidden fields (or even unhidden but non-editable ones) could cause a problem if someone changed their values, then you have potential security issues.