Greg K — Fri, 02 Dec 2005 21:41:42 +0000

In the area of taking payments, my thought is use free stuff to learn how to write your own code.

I did that on our site, from the login, to the credit card processing to the encrypting of the credit cards to be stored in a database, and the recurring payment processing.

These areas were too critical to just put up a canned script. I wanted to make sure I knew what it was doing, and in looking though the code, you learn it enough to write your own customized code. This is my personal preference though, I prefer to know it inside and out.

Now if you do opt to use a canned script, either free or paid, I suggest at least going through and changing things like the name of input fields, or aything else that may give people a clue as to what script you are using. As an example, as seen discussd on here before, there has been issues of people putting up a canned guestbook, only to find down the road, someone is using a script to mass post in their guestbook. Someone has a script that knows what information to feed the canned guestbook script to get the data in there. (ie, knows the field names on the form).

Again, my prefered method is to custom write my own, but if you do not have the option, do as much as you can to prevent anyone browsing the site from knowing which "canned" scripts you are running in case a security issue were to be known. (ie now that you posted on here which scripts you used, i would recommend against posting your site's address).

Keep in mind though I have had a few people tell me I go overboard on security

-Greg