Lord_Webby

Thanks.

Do you know what version you are running? ("c:\XAMPP\readme_en.txt")

I'm thinking of upgrading to windows 7. Anyone had any issues installing XAMPP on Windows 7? What version are you running?

I am creating a site that will be used to hold information about customers and their credit cards. I will not be storing or processing PAN (Primary account numbers) in any way, so I know PCI-DSS (Payment Card Industry - Data Security Standards) do not apply. But does anyone know of any regulations regarding storing customer data in a database? The Data Protection Act is a bit vague - I can't seem to find information regarding specifics. For instance, I've been told that if you are holding customer data it needs to be on a seperate server to the website. Is this true? Does anyone know of any specific documents / standards regarding storing customer information entered through the web? Any help would be appreciated. Thanks.

PGP? Do you mean PHP?

I should also add that there are no actual transactions taking place. All transactions are delt with offline. The system just needs to be secure to hold the personal and credit card data.

The system is for a company that claims back credit card charges. Users enter personal information and add credit card details so that the company can claim back the credit card charges. Therefore they need to store the details but users never need to access the system again (hence no login information). I was thinking of only giving the website 'write' permissions. The data can then be accessed internally only - by staff (who Will have to login to access the data). I've read that amazon use a seperate server connected via a serial port because it is easy to analyse the data being passed through and check why it is being accessed. Anyone know how you would check the information being passed through the serial port? I believe the servers will be behind a sonicwall hardware firewall.

I am Looking for advice on how to store credit card details securely. I am about to develop a new website (details being finalized). The project consists of a website that requires a users credit card details to be stored to a database. Unfortunately there is no way around this (I tried to advise against storing the details - but this is a mandatory part of the business). The site requires mysql and php. So far I have the following: - use an ssl-ev certificate on the webserver (xampp) - store the mysql database on another server (also xampp) and restrict permissions depending on the action taking place. - use 256bit php encryption, and hashing for passing variables and clean mysql data (mysql_real_escape_string) before submitting it to the database. Does anyone have any other/more ideas on how to ensure security on the above - or perhaps a different process? Have I missed anything? (The site is a public site and the owners want to stay away fro the username password route for clients).