If you encrypt it, either you use a different key for each user's data, which means you're storing per-user session data on the server so you may as well store

If you encrypt it, either you use a different key for each user's data, which means you're storing per-user session data on the server so you may as well store the cc number there I don't see how that follows. Storing credit card details on the server is generally a bad thing to do and takes a lot of work to get it to be PCI compliant. What would be wrong with a different key/salt per user stored on the server, with the credit card number stored in a short-lived, secure, httponly cookie?