I've noticed current credit card gateways like stripe and wepay encourage sending the credit card number via their js framework (which would use some iframe jsonp magic to pass the data).
To my knowledge this way you don't need to worry about much of PCI compliance other than using SSL.
I understand that storing it can lead to many issues, from how it's stored (strength of encryption) to protect from employees access to the database, to protecting the database from SQL injection etc. But if it's not being stored, how could the data be compromised? If I'm worried about someone getting into my server and modifying the files to direct the data to themselves, then it won't make a difference what my code is.
My question is, what indeed are the security risks by having my server send the cc info (even without storing it) over having it sent by the browser/client?