Like the title says, I would like some advice from knowledgable web developers on figuring out security issues for my e-commerce site.

I am designing the database as well as the code that communicates with the database to make changes, etc. I have a few questions, but in general a good checklist on what to do to make the security pretty tight, seeing as I will be dealing with credit cards. I will not be storing credit card numbers. Links to good places would be helpful.

My main concern is keeping the database secure. I am pretty new to web development, and I am just concerned about thst.

I do have a question about the design of a database used for online transactions. Is there a better way to make the schema than to just put all the user info into one table: ex.

customer(customerid, firstname, lastname, username, password,
         address, city, country, zipcode)

Would it be better to store user credentials in another table and link them with the customerid? Sorry if I am not getting too specific, but I am new to web development and mainly have experience in offline programming. Again my main concern is security issues. If anyone has a great article on security, that would do just fine as well. Thanks for your time!

  • why not use one of the many very good existing e-commerce solutions, they will have (hopefully) designed the security appropriately already. – Dagon Jun 15 '11 at 2:40
  • Thank you, yes, that does sound like a good idea. Do you recommend any? – Andy Jun 15 '11 at 2:56

I'm not sure that this is something you'd want to get into for a live site - for a hobbyist project, it would be fun and a great learning experience. If you miss one simple thing in a front facing ecommerce website, your entire customer base could be compromised, and that's irreversible damage.

Like the others, working with one of the existing platforms (and making sure it is updated constantly) is a better idea if you're going to be deploying this on a live site. You should be familiar with PCI-DSS Compliance, which is a way to better protect your customer base from potential attacks.

I've personally worked quite a bit with Magento - for academic purposes, you should take a look at their schema and overall structure. The architecture is very interesting and the database structure is vast. I believe it is pretty PCI-DSS compliant out of the box, though I haven't deployed it recently.

  • Wow, thanks! Yea, I keep getting that. I guess that was pretty ambitious of me. Sounds like I will be working around an existing platform. I appreciate it. – Andy Jun 15 '11 at 3:07
  • 2
    PCI certification is only absolutely required if you plan on storing your user's credit card details on your end. That said, the standard does provide valid points to securing your site and it is well worth reading even if you don't plan on getting certified, – Jahufar Jun 15 '11 at 3:25
  • To expand on Jahufar's comment, if you're thinking about storing credit card details on your end, take a step back and think about whether you really need to. In the U.S., the forms have become much more robust, or at least the simple forms have been dropped. Third-party is generally a good idea unless you've really got the money to invest. In my opinion. – James Skemp Jun 29 '11 at 2:02

Generally, I'd say find a good existing application/platform for your core. Hopefully it will allow you to extend the application, since I think we all know there's always customization we need made.

Security is extremely difficult to get right, and especially if you're just starting out, it's best to go with something that's already been tested.

  • Yes, someone else commented on that as well. Security is definitely tricky, and it sounds like my best option for learning it as well. Do you recommend any of those applications off the top of your head? I really appreciate the advice by the way, very helpful. Thanks again. – Andy Jun 15 '11 at 3:04
  • Sorry I missed your comment (wasn't flagged for whatever reason - possibly because of the move). It's been years since I actively developed in PHP, so the only application I've heard of that's listed above is osCommerce. Really, it depends upon your needs, as you may want something that can be customized to a very low level, or be fine with an out-of-the-box solution. – James Skemp Jun 29 '11 at 2:03

Welcome to StackOverflow!

I would use an open source e-commerce solution - while you can't expect any solution that is 100% secure, an open-sourced solution would have the befinit of being peer reviewed and tested on live sites.

Here are a few I've used before:

  • osCommerce: The grand-daddy of all open source e-commerce solutions. Very flexible in terms of configuring it to your liking but can be a nightmare to customize/skin. Used it several years back on a project, can't say I liked working with it (from a developer's perspective).

  • Magento: One of the better implementations I've seen around.. packed with features, very customizable and quite easy to setup and get going.

  • X-Cart: This one is not free but if you like the option of having paid support this would be a good choice (customizing the site would require you to know Smarty - a PHP templating engine).

On the other hand, if you want to roll your own then at least be aware of basic security pitfalls web apps can be exploited for:

  1. SQL Injection
  2. Cross-site scripting
  3. Remote code execution

If you plan on writing your own in PHP, I would highly recommend you read Essential PHP Security by Chris Shiflett. This book and his blog helped me a lot when I started with serious development.


Just a few pointers...

  1. Don't store the credit card numbers, ever. You already got this covered, but it bears repeating.

  2. If you, your boss, one of your customers, etc. comes up with an idea for some new killer feature that requires you to store the credit card numbers, refer to rule #1.

  3. Use existing crypto solutions. Do not try to roll your own encryption scheme, you don't know how.

  4. Don't store the account password; store a hash of the password (preferably with a randomly generated salt). This way, even if someone cracks the database, they won't be able to log in.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy