Search code examples
phpcredit-cardpaypalbraintree

Do we need to be PCI complaint, if we are capturing the credit card details in a form and posting it to any payment gateway?


I am capturing the credit card details from the uses in a form and then sending these form data to payment gateways like PayPal or Braintree.

The credit card capturing form is hosted in SSL (HTTPS) and using cURL to post credit card data to payment gateways. As we are not saving credit card data to our server so do we need to be PCI complaint if we are following this scenario.


Solution

  • You shouldn`t do that! The form that handles the credit card information should always point to the payment gateway as target so your server doesn´t handle any sensitive data. A good payment gateway will send you back a shortened version of the credit card number combined with the verification status to store in your database and possibly show the user in emails or user admin areas. You could also use a javascript to get a shortened credit card number (and the number only!) from the form and send this via ajax to your server before sending the form to the gateway.