I need to know the best scenario for a merchant inserting client's credit cards and expiry dates to process recurring payment for these cards. What I have in mind (and want your expert suggestions please) is the following:

  1. form to be filled with credit card information
  2. normal post with https to a php page having function for encrypting the credit card with random encrypt key
  3. saving the encrypted card and the key in different locations in mysql when processing the payment
  4. getting the encrypted credit card and the key and use a decryption function to process the payment with curl to the gateway

credit card encrypt/decrypt sample: http://www.walkswithme.net/credit-card-validation-and-encryption-using-php

do you have any comments on the above, or better scenario?

  • 1
    Whether you need to be PCI compliant or not, the PCI guidelines are a good start for best practices. Nov 16, 2014 at 14:04

1 Answer 1


Your payment gateway should be able to provide you with a tokenized system for recurring payments where you submit the cc to the payment gateway once and they return an authorization code which you will use instead of a cc number for the recurring payments.

This is a far better solution than storing credit card numbers in any shape or form. Please contact your payment provider for advice before you consider copy/pasting encryption advice from the internets.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .