RichB

Can anyone point me in the right direction regarding what are considered to be the dos and donts of setting up an ecommerce site. Essentially an ecommerce site is the same as any other DB driven site, its just the taking of funds/sending the card information to the retailer that is slightly different...

Are you actually legally allowed to store CC details? People like Dabs seem to...
The equence of events would be...
Add products to a basket
checkout
jump to a SSL site/page
Create a user/profile
input CC details
then what?
store them and allow the retailer to log in and retrieve encrypted details?
have the order and CC details emailed to the retailer?
Is PGP encryption the way to go?

I'm interested to hear what others do, I like to write my code rather than take a open source/off the shelve product, I'd rather understand whats going on. I use PHP/MySql.

Thanks in advance
Rich

mykp

Depends on your budget, cheapest way to go is use an off the shelf solution with paypal or worldpay taking the transactions. Its not difficult to do and once you have your product DB in place its just a matter of making the shopping cart (there is loads of code out there you can download), then sending these details to the payment processor, where details are taken by them not you.

I have seen lots of solutions but the main two seem to be using a payment processor for taking the details. An email is then generated to you to say you have received an order, the credit card details dont leave the server.

The second is an order is taken and using a secure server and PGP they are emailed to the office where payment is processed and goods are despatched, the transactions are processed manually.

I prefer the first method and have done this many times. It keeps costs down as the only fee is a transaction fee, usually 2-3%.

Personally I think from a time point of view why not use code which is already written, maybe modified a little but depends on your time scale, most people I build sites for want it now, little time to hand code. Having said that I wouldnt go near some code as its not secure.

mike