BritZin

Everytime I speak to a client who want's an e-commerce system I plead the case for PayPal, MoneyBookers, Nochex, GoogleCheckout etc. etc.
The thing is when you say "normal" card payments, I assume you want to accept all the usual cards but you want to do it directly through the website not using a third party system (e.g. PayPal) and instead use a merchant account/gateway set up. The trouble is, it opens up a whole can of worms. IF you use PayPal or any of the well known services listed above, you don't need to worry about security (much - apart from the setup of the website it's self) and you don't need to have the responsibility of ensuring credit card details are safe and secure. By using for instance PayPal, it's a well recognised name, so people will associate security and safety with it - more likely to purchase from you, you don't need to get PCI DSS Compliance (a very long, complicated, expensive and drawn out affair where you have to ensure you are handling confidential data responsibly and safely) and it is much easier, quicker and smoother to set up.
 
Clients often have this thing about "processing their own" so it makes them look more professional. I find this creates the exact opposite effect. What happens if a site you build with this kind of setup get's hacked and X number of customers credit card details are stolen? The client will be quick to blame you in court and you'll find yourself with numerous fines and prosecutions against you. If you want my advice go for a PayPal like system, it's less of a burden in the long run!
 
So in answer to your question, stick with PayPal! It doesn't really matter and the end user doesn't really care!

Very mature. I've reported you. First you turn a job request into a technical help thread, then you snap at Jake for correcting you, now you're turning a civil conversation into a playground fight.

Wooops! God I feel stupid now, I had the preconception it was a UK site. Thought it was meant to be one lmao.

I've never understood the misconception surrounding this subject. Securing shopping carts isn't hard, prebuilt ones are already pretty secure and as for writing your own, it's mainly just common sense. If you're using a payment processor such as PayPal, GoogleCheckout, SagePay (SagePay Go Form/Server) there is no real "issue" other than making sure that the data being posted to the payment processor is correct. Yeah, maybe SSL is an idea and is recommended for SagePay, but other than that, there is no real security threat.
 
The only time you're in trouble is if you're personally processing credit cards (Or Using SagePay Go Direct for instance), in which case you'd need to be PCI DSS Compliant and meet all of their fiddly criteria. Though, With regard to the quoted poster
 
 
That's not enough, and even if it was I wouldn't recommend doing it this way because you'd be storing and transferring card details yourself, and hence need to meet all the legislation, protocols and PCI DSS Criteria.
Additionally, there's no such thing as 100% Secure.
 
CityCM, I'd recommend you build a simple, self written shopping cart system, whereby there's a basket, etc. etc. then, install a simple SagePay Form Processor. Quick, Simple, Easy and Secure. No Worries! Your client will need to have a Basic Level of PCI DSS compliance since the data is being entered through their site, but far cheaper and easier.

Hi Adam,
To do this a basic level of PHP is a must, and further more so is an understanding of PHP Sessions.
 
In order to achieve something along these lines you'd need;
 
HTML Login Form (With Username/Password Fields) > PHP Application (Which checks the details with those in a user database) > If they match create a "PHP Session" (I.e. a secure session whereby they are "logged in") > Forward them to their unique members area dynamically created.
 
Additionally a registration app would also be needed.
This of course is just a low level explanation, there are other elements to it aswell, fairly simple but critical. Things such as Encryption of Data (I.e. Passwords and Database Content) and "Cleansing" - which removes illegal and dangerous characters from the text fields which could be used to hack and compromise security.
 
It's not something I'd recommend you try and do without expertise, in the mean time have a read over W3 Schools, they're very useful for beginners and quite comprehensive in detail.
 
Though, have you thought about hiring? Simple job like this wouldn't cost you that much, maybe £50 for a simple system that get's the job done.

I'd learn about PHP; loads of tutorial sites out there.
 
Some tips:
 
1. Learn how to structure PHP scripts
2. How to collect form variables in a PHP script (from the html form to the php script)
3. How to validate the data from the form variables
4. How to read and write cookies
5. How to encrypt data (md5 hash, salt keys etc.), you should never store a password but instead an encrypted key which allows you to validate a users password by regenerating and matching the keys.
6. Learning about sessions is also useful for logins but not actually essential if you are just starting out; I would say figure out how to do it with cookies first and then give sessions a go.

It is a very sad state of affairs, but, as always, every vaccine brought out has some kind of adverse affect on some people. People react to chemicals in different ways, and it is just very very unfortunate that this girl has lost her life - but that doesn't necessarily mean the jab caused it. As Stevo said, it was on the news today that an underlying medical condition was the cause. But, that doesn't mean that people should stop getting vaccines or boosters.
 
A friend of mine said today "Well, i'm certainly not getting it now! It only protects you up to 70% !" As if that was some kind of issue? It's like I said to her, It's better to be 70% protected against something than 100% protected against nothing.
 
It's not the governments fault, it's not GSK's fault, it's not anyones fault, it's a horrible accident. And Saying
 
 
Is ridiculous. These products wouldn't be on the market if they were deemed unsafe. GlaxoSmithKline is a world renowned reliable company and it's not fair to make such ludicrous claims.
 
Our thoughts should be with the family, not with placing blame.

Personally, I always put "We" regardless of who you are, or how many people you have working for you. Mainly because I'm in an LLP so, as an incorporated body, surely, a "We" is the right use.
 
Freelancers though, I'd say "We" aswell - more professional.

I'd ignore it if I were you.
I don't like the reputation feature because it becomes a popularity/reliability contest. Like some other well known forums on the web, the "more rep" (as they say) you have, they suddenly believe they are more valuable and useful to society at large.
 
Just because someone disagree's with you doesn't always mean that you're wrong, and because of the way the reputation system works, if someone new saw that they'd automatically think "oh I'll keep out of his/her way - they're obviously no good." which just isn't true.
 
On the other hand you might get a bunch of pure a*se holes who act like children and push each others reputation points up so they look like reliable individuals but who are infact complete morons who ridicule and think they're above everyone else.
 
[/rant]
 
So yeah ignore it lol
 
EDIT:
this springs to mind.

I haven't seen one for digital cameras,
 
Check the manufacturers website?
 
That might have a policy if you want to recycle it.
 
Ben

How come I have negitive reputation? Hope I didn't upset someone...

NEVER MIND!
Heh, Issue resolved.

NEVER MIND!
Heh, Issue resolved.

It's starting to depress me, so many people are are being used and abused by people claiming to be web professionals and it's not fair, so many of us here deserve to get more contracts but are being shunned by people who are rubbish at website design and a lot more expensive.
 
A good example of this happened to me recently, my sister-in-law (to be) works at a nursery in the town where I live, the nursery was approached by some people selling a website to them for £3,000 that they can update themselves etc, the website was a template and they just changed the header, the reason that it cost so much was because the company is 'ofsted registered', which they told the nursery was necessary when designing websites for schools and nurseries that are private (public). This really annoyed me, so I got in touch with OFSTED, they've never heard of a company being OFSTED registered for website design, and as long as you comply with the data protection act etc, you can basically do whatever the hell you want...
 
I told my sister-in-law this, who went to the nursery basically saying "Look, you're being scammed." The nursery didn't care because "It's already sorted out."
 
I know it might be a bit of a ****ty thing to do, but I'm seriously considering going to an organisation to get the design company checked out, it's hardly very fair on people like us who are honest and wouldn't have charged anywhere near £3000 for a site that's already pre-made and just needs a header changing, and it pisses me off that people are stupid enough to hire them.
 
Rant over.

Think I need to hire me a Manny to do my tax for me... it's why I do mine online, there's enough paper flying around the office during tax return without trying to hunt down the form underneath the carnage.

Hahahaha that was the first thing I thought of when I opened your post.

I would like to remind people about the law. It is illegal to cold call people on the TPS therefore you must get this list and use it for reference. It's not like the Apprentice where you just pick up the Yellow Pages and give everyone and anyone a call.
 
http://www.communicationsexpert.co.uk/cold-calling-law.html
 
Having said that though a member gave some really very good advice here once on this topic. (members have since given good advice, this is not me saying there has only ever been 1 bit of good advice ever here, afterall I have over 1400 posts..)
 
They said they would 1st contact potential clients but not try to sell them something, they would send a survey or something similar to try and engage and start a relationship with them. They would normally get a high return from the survey (say a quick 10 question survey monkey one) and then they would contact them for a little chat about their answers and ask if they would mind if you kept them upto date with your offers etc. they would then send a flyer or sales letter and follow it up with a sales call.
 
I loved that idea on so many levels, people hate cold callers and their immediate reaction is normally NO, unless they have had to do it themselves in which case they are polite. You build up a trusting relationship before trying to sell, you already know what they want before you try to sell. Pure genius.

I'm in Agreement with Andy, Remember the law.
No point re-echoing what he said, so you get the gist

I would suggest people take the time to research this properly before randomly deleting registry keys they *think* might be suspicious:
 
TrendMicro website details on TSPY_KATES.G

May I just enquire, what was the attack. Forgive me, I don't use WordPress so am not familiar with it so if I'm not making sense, sorry. But, What exactly was the loop hole, what did they do that allowed them to XSS your sites?

Hmmm. Right ok. XSS is a funny thing and is nearly always, if not always caused by failure to validate user inputs correctly. If you do, do this then it maybe a host issue.

I want to add the following to this discussion:
 
1. There has been a very recent (Today I believe) update to Wordpress to fix the XSS security hole.
 
 
It should be run as a matter of urgency by anyone maintaining Wordpress Sites.
 
Thanks,
 
Eris

I'm still not absolutely sure how they got in. Some of my non-WP sites have also been hacked. I'm starting to wonder if they found an exploit on my host.
 
And, !B, if someone is "trying to have a little fun", which involves hacking sites at the expense of others, that doesn't make them "a little childish", that makes them criminals under UK Law.

Hmmm. Right ok. XSS is a funny thing and is nearly always, if not always caused by failure to validate user inputs correctly. If you do, do this then it maybe a host issue.

May I just enquire, what was the attack. Forgive me, I don't use WordPress so am not familiar with it so if I'm not making sense, sorry. But, What exactly was the loop hole, what did they do that allowed them to XSS your sites?