Re: Help! Made a boo-boo encrypting credit cards
| From: | Brian Dunning | Date: | Mon, 14 Feb 2011 15:49:36 +0000 |
| Subject: | Re: Help! Made a boo-boo encrypting credit cards | ||
| References: | 1 2 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-311277@lists.php.net to get a copy of this message | ||
On Feb 13, 2011, at 12:44 AM, Richard Quadling wrote:
> You are
> using addslashes($_POST['cc_number']). Considering a credit card
> number is purely numeric, the addslashes would seem to be redundant as
> you don't need to escape numbers.
I do that routinely to all input fields as one additional layer of protection against injection
attacks.
> And you can run a Luhn10 check
> against the card number to make sure it is valid before storing it.
I do that as well.