I'm using a payment gateway and am trying to implement the post and response handling with CURL so that it all happens on one page.The following is tested and works but I want to double check it's secure. I'm not storing the card details but I'm essentially posting them to myself (via AJAX) and then curling that through to the gateway. I can't AJAX post it directly to the gateway because of cross domain restrictions.So, this all happens in https://mysite.com/payment.php:HTML<form method=post action=https://mysite.com/payment.php>    <input type=hidden name=Amount value=1.00>    <!-- fingerprint is a hash of my gateway passwords and fields on this form -->       <input type=hidden name=Gateway_Fingerprint value=<?php echo $fingerprint ?>>     <input type=hidden name=Gateway_ReturnURL value=https://mysite.com/payment.php>    <input type=hidden name=Card_Number value=></form>PHP// when payment form is submittedif(isset($_POST['Card_Number'])){   // CURL the data to payment gateway   foreach($data as $key => $value){        $fields .= $key . '=' . $value . '&';    }   rtrim($fields, '&');   $post = curl_init();   curl_setopt($post, CURLOPT_VERBOSE, true);   curl_setopt($post, CURLOPT_URL, 'https://gatewayurlhere');   curl_setopt($post, CURLOPT_POST, count($data));   curl_setopt($post, CURLOPT_POSTFIELDS, $fields);   curl_setopt($post, CURLOPT_RETURNTRANSFER, 1);   $result = curl_exec($post);   // output result from gateway as JSON   header('Content-Type: application/json');   echo $result;   curl_close($post);   exit();} // result returned from gateway, this will be the CURL result dataif(isset($_POST['restext'])){   echo json_encode($_POST);   exit();}
Secure CURL to & handle response from Payment Gateway
php;security;curl;ssl