I am writing in regards to PCI-DSS compliance for taking credit cards. A client of mine is not willing / does not want to bump up security beyond what is currently done for their credit card data. All data is currently being stored on a server's MySQL database until it is run through the merchant system manually. Currently, only the credit card number is being encrypted, and only that is using using basic MySQL ENCODE() with an short string as the key. The rest of the information is plain text.
Personally, I am not comfortable with this low level security and they are pushing back for bumping up the security. What should I do / what can I do to explain, encourage, or force PCI DSS compliance or at least a higher level of security?
We are using PHP 5.2 and MySQL (sorry, forget the version number)
If nothing else, is there a way to encrypt it with PHP or MySQL that will be more secure but minimize the work for the client to be more secure.