PHP and MySQL Web Development 4th Ed-tqw-_darksiderg

Using Encryption in PHP
419
Storing Credit Card Numbers
Now that we’ve discussed secure storage for sensitive data, one type of sensitive data
deserves special mention. Internet users are paranoid about their credit card numbers. If
you are going to store them, you need to be very careful.You also need to ask yourself
why you are storing them and whether it is really necessary.
What are you going to do with a card number? If you have a one-off transaction to
process real-time card processing, you will be better off accepting the card number from
your customer and sending it straight to your transaction processing gateway without
storing it at all.
If you have periodic charges to make, such as the authority to charge a monthly fee
to the same card for an ongoing subscription, this approach might not be an option. In
this case, you should think about storing the numbers somewhere other than the web
server.
If you are going to store large numbers of your customers’ card details, make sure that
you have a skilled and somewhat paranoid system administrator who has enough time to
check up-to-date sources of security information for the operating system and other
products you use.
Using Encryption in PHP
A simple, but useful, task you can use to demonstrate encryption is sending encrypted
email. For many years, the de facto standard for encrypted email has been PGP, which
stands for Pretty Good Privacy. Philip R. Zimmermann wrote PGP specifically to add
privacy to email.
Freeware versions of PGP are available, but you should note that it is not Free
Software.The freeware version can legally be used only for noncommercial use.
You can download the freeware or purchase a commercial license of PGP from PGP
Corporation. For details, see http://www.pgp.com.
For more information on the history of PGP and the available versions, read the article,“Where
to Get PGP,” from Philip Zimmerman: http://www.philzimmermann.com/
EN/findpgp/findpgp.html.
An open source alternative to PGP has more recently become available. Gnu Privacy
Guard, known as GPG, is a free (as in beer) and Free (as in speech) replacement for PGP.
It contains no patented algorithms and can be used commercially without restriction.
The two products perform the same task in fairly similar ways. If you intend to use
the command-line tools, the differences might not matter, but each has different interfaces
such as plug-ins for email programs that automatically decrypt email when it is
received.
GPG is available from http://www.gnupg.org.