ballhogjoni Posted March 29, 2007 Share Posted March 29, 2007 Is it it safe and secure to save credit card info in a session and then send that info to google checkout through their xml api? Quote Link to comment https://forums.phpfreaks.com/topic/44816-is-it-secure-to-do-this/ Share on other sites More sharing options...
boo_lolly Posted March 29, 2007 Share Posted March 29, 2007 i am working on a project right where i am writing a shopping cart that will completely be handled using sessions. no database whatsoever. along with the items in the shopping cart, the user's credit card and address information will also be stored in session variables. a few things to consider. first, PHP stores session variables in the 'tmp' directory. this directory should be outside the root HTML directory that stores your website pages. second, make sure you serialize() your sensitive session data. third, beyond all of this, i would still highly recommend acquiring an SSL certificate from either verisign or instantssl. Quote Link to comment https://forums.phpfreaks.com/topic/44816-is-it-secure-to-do-this/#findComment-217609 Share on other sites More sharing options...
ballhogjoni Posted March 29, 2007 Author Share Posted March 29, 2007 Thank fo rthe reply. I am using an SSL right now. A few questions. How do you change the tmp directory? Then make sure your session data gets stored in tmp directory after you move it outside the root HTML directory? Quote Link to comment https://forums.phpfreaks.com/topic/44816-is-it-secure-to-do-this/#findComment-217618 Share on other sites More sharing options...
drewbee Posted March 29, 2007 Share Posted March 29, 2007 the temp directory is changed in the PHP INI (configuration) file. Quote Link to comment https://forums.phpfreaks.com/topic/44816-is-it-secure-to-do-this/#findComment-217631 Share on other sites More sharing options...
boo_lolly Posted March 29, 2007 Share Posted March 29, 2007 drewbee is right. you can change the path in the php.ini file. Quote Link to comment https://forums.phpfreaks.com/topic/44816-is-it-secure-to-do-this/#findComment-217638 Share on other sites More sharing options...
rcorlew Posted March 29, 2007 Share Posted March 29, 2007 You can also change the /tmp directory using ini_set like this: <?php ini_set(session.save_path = "/where/to/tmp"); Keep it above your public html directory though. Quote Link to comment https://forums.phpfreaks.com/topic/44816-is-it-secure-to-do-this/#findComment-217643 Share on other sites More sharing options...
ballhogjoni Posted March 29, 2007 Author Share Posted March 29, 2007 Thanks for your replies. Another question or two. Would the code look something like this serialize($_SESSION['email'] = $_POST['email'] when you serialize()? Quote Link to comment https://forums.phpfreaks.com/topic/44816-is-it-secure-to-do-this/#findComment-217645 Share on other sites More sharing options...
ballhogjoni Posted March 29, 2007 Author Share Posted March 29, 2007 anybody? Quote Link to comment https://forums.phpfreaks.com/topic/44816-is-it-secure-to-do-this/#findComment-217678 Share on other sites More sharing options...
boo_lolly Posted March 29, 2007 Share Posted March 29, 2007 more like: $_SESSION['email'] = serialize($_POST['email']); Quote Link to comment https://forums.phpfreaks.com/topic/44816-is-it-secure-to-do-this/#findComment-217679 Share on other sites More sharing options...
ballhogjoni Posted March 29, 2007 Author Share Posted March 29, 2007 thx Quote Link to comment https://forums.phpfreaks.com/topic/44816-is-it-secure-to-do-this/#findComment-217684 Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.