RE: [PHP] Sensitive Information (like CC)

> What's the best (secure?) way of transmitting sensitive > information over email? I'm helping some friends build an online > order form. They have a Thawte certificate and are already using > it for the order form, but they would like the information to be > emailed to them when an order is placed. The problem is, the > information contains everything, the person's name, address, > credit card information. Obviously I can't just email this over > over the ether, so how do people deal with this type of stuff? Use PGP to encrypt the mail. The web server will need to have a PGP environment set up for the user running the httpd (usually "nobody" on a Linux box). Thus, PHP and access and execute PGP. Set up PGP on the recipients' computer. Probably a good idea to make the email address "purchases@whereever.com" or "sales@", and not an individual user - makes it easier to manage a bunch of people receiving orders. Export the public key for the recipient's address, and send it to the web server. Have the sysadmin import the public key into the web server's user's PGP keyring with full trust and privileges, as this will stop PGP asking "do you really want to trust this user?" in the middle of a batch process and thus breaking everything. Once you can PGP encrypt a text file to that public key without having PGP ask for confirmation of anything, you need to hook PHP up to it. You need the environment variable PGPPATH set, so: <? putenv("PGPPATH=".where_you_installed_the_web_server_users'_pgp); ?> Then you can write out the original mail with all the naughty info in it to a file, run PGP over it to produce an encrypted version, delete the original and mail the encrypted version. Jason