Hi All,
I have never created a secure web page before.
I am currently creating an online form that requests credit card information, so of course, I want that page to be secure.

Where can I go to learn how to do this?

Thanks!

Could you describe more how the credit cards will be collected and where the information goes? Do you have a merchant account and need to connect to that? Will you be using PayPal?

The general idea is when sensitive information is being sent you want to use SSL (secure sockets layer). You'd want to get a SSL certificate and the instructions for setting it up will come from the company that issues you the certificate. It's mostly setting things up through the control panel for your hosting account.

Then you'll want to make sure that you use https instead of http.

If you're using something like PayPal you can set things up so all the information is transferred on PayPal's site. In that case PayPal would be handling the security since they'd be the ones collecting the sensitive information.

Nope, no merchant account.
It will be collected on a form, and then sent to their email.
The lady wants all the info to run through her hands first.

So I should be able to set up SSL through the host then right?
Cool, I'll look there. Thanks for the info. I hadn't done this type of stuff yet, so you learn something new every day!

For simple secure pages I always sue the .htaccess method!

I'm not sure having credit card numbers emailed is really the best idea. Securing the information sent through the form isn't too hard, but securing during the email is going to be trickier I think. I'm guessing the choice isn't yours so...

I did find this thread from WebmasterWord where someone was looking to do pretty much the same thing you want to do. The third post down looks to have the info you need.

You set up SSL through the host, but you (your client) need to purchase a certificate first. There are different kinds of certificates at different prices. I don't think the cheap ones are the best way to go. The one you'll want is probably about $100/year.

Here's an article about SSL and certificates I came across a few years back when I was first looking to purchase a certificate. It's a multi-part article and the info helped me way back when. Hopefully it will help you as well.

Thanks vangogh,
I agree, it shouldn't be sent via email, but that's what she wants.
I've already let her know the possible reprocussions, but she seems fine with it.

Thanks for the links, I will look them over tomorrow!

Sending through email is fine - just encrypt it first!

My credit card number, expiration date, and zip code are FD6B1AAB03D44f83B6F65AC1C873C25B516083115693403eB7 93CD07C
1BCF6B5055831D882E04b0aBE1C945CB2A3302CBCF0FE9130E E4be6B
5DD4392A93805F2EDD18AB23F1348958D7BA0E95A1478F5

Eat your heart out!

Now I'm sure you see what I'm getting at. All the money in my bank and all the credit I'm good for, are contained in those magical numbers above. But they're worthless to you. And to VanGogh, even though he's really bright and good with computers. In fact, they're completely worthless to anyone who doesn't have the password I used to encrypt them with. How you go about it is a long story I won't bore you with, at least at this point, but we'll agree that it's what SSL does, and that SSL is good.

John, please do share the password you used. I promise not to tell.

You know, technically, if I told you the password, but didn't tell you what encryption algorithm I used, or how the text was encoded (ASCII vs Unicode) you'd still have a heck of a time. But then the brute force you'd need would be something like 20 different attempts, instead of 20 million billion.

It's just a simple fibonacci sequence. His credit card is a Visa, number 4309 5143 2341 9753 with an expiration of 07/12. His ZIP code is 33817. His social security number is in there too, but I won't share it because I'm sure John would rather keep that quiet.

Thanks VM. Ok I'm on may out. I have the sudden urge to go on a shopping spree. Could someone keep John busy for the next few hours?

Sadly I kow you got his zip code wrong since I think John's will need to start with a '9' and 33817 is probably somewhere in Florida.

Oh well, maybe I won't be going shopping after all.