Does storing CC data in the session violate PCI compliance?
edw519: The order confirmation screen only needs to display the last 4 digits.  They know the rest.  If any of the other digits were entered incorrectly, you'll both find out soon enough.