PayPal IPN: Storing credit card numbers? why?

[gravyface]

I'm in the process of setting up a store for a customer of mine and plan on using the official PayPal IPN 1.4 module. I was quite pleased with everything until I spied:

$sql_data_array = array
 ...

'cc_type' => $order->info['cc_type'],
'cc_owner' => $order->info['cc_owner'],
'cc_number' => $order->info['cc_number'],
'cc_expires' => $order->info['cc_expires'],

 

I *really* don't like the idea of being responsible for my client's customers' credit card information -- I don't want their credit card info sitting in a MySQL database up on a web host somewhere. The whole point of using third-party transaction/payment gateways is to outsource this responsibility to someone else, somebody who's in the business of managing secure transactions and sensitive financial data.

 

Perhaps I don't understand enough about the PayPal/osCommerce problems/limitations that this module was supposed to address -- please enlighten me. While I'd love to use this module I may resort to using something else (another payment gateway) or a different e-commerce solution altogether.

[dynamoeffects]

The PayPal IPN module doesn't ask for credit card numbers as all of that's done offsite. If you dump the $order array at the end of the checkout, you'll see that those fields are empty.

[gravyface]

The PayPal IPN module doesn't ask for credit card numbers as all of that's done offsite. If you dump the $order array at the end of the checkout, you'll see that those fields are empty.

 

*breathes a sigh of relief*

 

Good to know! I thought that perhaps this was part of the "pre-order" routine.