I'm a developer for a large e-commerce site. We require users to input their credit card for each purchase (no save functionality). We store the credit card for

I'm a developer for a large e-commerce site. We require users to input their credit card for each purchase (no save functionality). We store the credit card for the duration of the transaction. Which is usually a few seconds. The time it takes to do run an AUTH ONLY. During these few seconds cards are stored with 256bit encryption on a server not accessible by a public IP. We use the mcrypt library in PHP. I understand you want to save the cards for future purchases, but you should definitely give customers the option to input their card every time if they so desire. If you dont need the card in the future, theres no reason to save it. Most processing gateways will return a transaction id which you can use to take processing actions in the future. You can run voids, refunds or settle payment. For our site we settle payment once we ship the goods and its all done with transaction IDs. The only thing we hang on to is the last 4 digits of the card number as a reference. If you are going to store the card numbers use a good, well known encryption algorithm. Hashing isnt encryption, plus a one way hash will not work since you wont be able to recover the number to process. Its important you become PCI compliant, especially if you are selling a hosted solutions to other businesses.