Re: keeping credit card info in session

From: Date: Tue, 10 Apr 2007 13:18:00 +0000
Subject: Re: keeping credit card info in session
References: 1 2 3 4 5  Groups: php.general 
Request: Send a blank email to php-general+get-252416@lists.php.net to get a copy of this message
At 8:05 AM -0400 4/10/07, Eric Butera wrote:
Did you know sessions are just plain text files sitting on the webserver in most cases? So by putting a credit card in the session it is actually just cleartext for people to read.
Yes, all files reside somewhere. Session files reside on the server and are as secure as the server environment. If someone breaches the server environment, then all data could exposed and is an excellent reason why not to store highly sensitive data there. Cheers, tedd -- ------- http://sperling.com http://ancientstones.com http://earthstones.com

« previous php.general (#252416) next »