Does storing CC data in the session violate PCI compliance?
adelle: Use Javascript to change the caption of the submit button from "OK" to "Confirm" the first time it is pressed and then submit the form on the second press.  That way, the data doesn't reach your server until the user has confirmed the purchase.