Does storing CC data in the session violate PCI compliance?
jacquesm: Storing CC data anywhere is a huge nono. You use it at the moment you pass it on to your IPSP. No temp files, no database records, no session keys none of that.Read the terms and conditions of your merchant account.Edit: I'm very serious about this, CC companies periodically check the active merchant accounts and will ruthlessly block you if they see you violate these rules.If you do recurring billing this can sting you in an extremely bad way, to lose a few days of income is bad, to have to rebuild your member base from the ground up is orders of magnitude worse.The reasons are simple if there is any indication you store CC data in between pageviews you are literally asking to be hacked. The very best way to handle these issues is to use an IPSP that serves up your final payment page, that way even the form is not on your machine (and so not subject to having a nice little javascript payload embedded in it at some point by some joker that hacks your site).Unless you are planning on being an IPSP you should not attempt to either receive or store CC info.