Checked it now: CC details are really sent UNENCRYPTED over the wire. They use no SSL at all.
Not even on POST. The credit card details are really sent over the clear, over the wire.
The RapidSSL button is even false, because it does not popup a validation when clicked (which real RapidSSL buttons should do)
I also checked. They have a SSL site with real certificate and Everything, but they specifically disable SSL by redirecting to HTTP when attempting to load the /secure namespace over HTTPS. It should really be the opposite, where HTTP redirects to HTTPS.
I would say you can be sure about submitting a CC number there, and thats only in this specifically case:
If you are 100 % sure that your WHOLE PATH, from your computer, to that company's server, is completely trusted, then you can submit the CC there.
That includes trusting your ISP, your landlord and every router and device on the path to the Company in question.
How to check yourself:
Check the source of the page.
If the credit card form "form action=" parameter Point to a HTTPS site, its encrypted.
If the "form action=" parameter is empty or contains a invalid value, chances are the CC is submitted over a AJAX script and thus you have to rummage through tons of JS code to find out if CC are sent encrypted or not.
However, submitting to a HTTPS site from a HTTP site is NOT 100% SAFE. There is possible that the page in question has been modified in transit by a malicious indivual to send the details to a attacker's server or via a HTTP Connection to be able to sniff the data.
However, MITM/modifying attacks are rare, if you are home on your home Connection and you DO NOT sit on wireless, its pretty hard to get into a suitable position to be able to modify data in transit.
I would say:
As long as the form submits to a HTTPS resource (
form action=https://blaahblaahblaah) you can be SUFFICIENT safe that the credit card is not being leaked.
If we take the assumption that there only PASSIVE listernes, no Active adversiaries in the network, then your credit card number is 100% safe if the form is sent over HTTPS.
However, this are NOT in case here, thus you should really trust the link Before sending anything there. Not even your home Connection may be fully 100% safe to send CC details there, if you account in the physical security of EVERY node on the path.