There are lot of payment gateways (Worldpay, PayPal, ..) offering easy integration, when the plain webpage using URL redirection to the payment page. HTTPS (worldpay,paypal), where the user posts his card details and payment data it is encrypted and trusted.
There are two webpages HTTP and HTTPS (secure) for payment. The user from the non-encrypted HTTP page is redirected to the HTTPS page, using redirect URL like: https://secure.payment.com/pay?to=merchant123&amount=300
The HTTPS page is opened to the user from a normal HTTP page, clicking to a button which opens a new URL. The URL string with its parameters is traveling as plaintext to the HTTPS site. The URL parameter contains the merchant ID and the amount.
The HTTPS (worldpay) displays all the data what is sent via url (so if MITM attack would change, the changed data would be displayed) and the user enters his card details there. This destination page is encrypted, and the user can double-check the payment details. Like paying for who, whats the amount, etc.
The question is, is it secure?
For the feedback, I try to re-edit and clarify more. 2015-04-17 EDIT: "secure enough" = it is trustable, and you can pay without a risk of a hacker steal your money. I'm not sure, isn't an easy hack trick to cheat that kind of system. Btw. this is the way suggested by the 3rd party (paypal, worldpay) payment gateway companies.
http://support.worldpay.com/support/bg/index.php?page=development&sub=integration&c= It states: "All payment processing is handled by WorldPay's secure server, so you and your Shoppers can be confident that their payment details are safe."
support/kb/bg/pdf/rhtml.pdf "The advantages are that nearly all browsers support URL strings, and they are simple to code and to use. However, because the recipient can see all the attributes and values in the URL string, you may not feel it is secure. "