bpc22

Storing CC numbers in the app is an unusual approach.

Is it because you would like to offer your customers the same payment method on a return visit? For convenience? Or because you are going to run the transaction later offline?

I developed an ecommerce site which needed to store customer payment methods so they could be billed again later without re-entering their details. The implementation choices were
a) store the CC numbers in the app, or
b) offload this storage requirement to a Payment Processor. Both PayPal and Authorize.net (for instance) offer a way to save the CC billing information and refer to it later for a sale.

If you choose to save the billing information yourself in your own app then according to PCI standards it MUST NOT reside on a server which is directly accessible from the Internet. If you are using WordPress then the app is on an Internet accessible server (obviously) but depending on where the database is hosted you may technically be meeting PCI requirements – although I wouldn’t push that reasoning too hard with a certification engineer.

But my greatest concern with what you’re suggesting is this: WordPress is a platform that doesn’t partition plugins into their own security domains. Think about it, when a plugin loads its got access to ALL the database. So if you’re going to store CC numbers and other billing information, you should at least encrypt them first. And don’t leave the encryption key and method lying around in the database either.

Personally, I think you’re playing with fire here. If you store CC numbers you’re running a real risk with serious downside. If the website app is going to be owned by a business, then you’ll be putting that business’ reputation and financial assets at serious risk.

Consider storing the details in a real CC vault – either one provided by the payment processors or one built yourself running on a secured server.

You might find the Suma plugin helpful. It restricts content in a WordPress website to paid subscribers only. It also handles the subscriber registration process and the subsequent recurring billing.

Details are at http://sumaplugin.com

cheers,
– Brenton

Yes, such a site can be built with WordPress. But since WordPress doesn’t have such functionality built-in, you’ll need to use a plugin.

One such plugin is Suma (http://www.sumaplugin.com). It can restrict access to a WordPress website’s content (posts, comments and pages) to subscribers only. It also manages the subscription registration process and the ongoing recurring billing. It supports recurring payments based on PayPal or Credit Card information, and all financial transactions are executed through PayPal so you won’t need to apply for a Merchant account with the Card processing companies.

More information about the plugin as well as a free-trial download is available from the website: http://sumaplugin.com.

Thank you, u2wedge for the feedback.

The demonstration mode of the plugin differs from the licensed mode in the following ways:
1. payments collected from subscribers are billed through PayPal’s Sandbox (test only) environment and hence aren’t ‘real’ transactions, however the transaction history is still accessible for subscribers when viewing their accounts,
2. the registration process displays a label informing users that the plugin is operating in demo mode, and
3. 14 days after the plugin was installed it will stop accepting new subscribers which marks the end of the plugin’s evaluation period.

The plugin can be upgraded from demo mode to licensed mode by simply entering a valid license code: reinstallation of the plugin isn’t necessary. When it is ‘unlocked’ into production mode, all the test subscriber accounts, their transaction histories and payment methods are purged from the system.

I hope people find it useful for developing paid-content, subscription-based websites such as newsletters and information hubs.

Licenses for the plugin are perpetual (never expire) and include perpetual customer-only access to updates – both bug fixes and feature enhancements.

If this plugin had been available when I was looking for one, I would have purchased it for this price – after trying it first of course.

At the risk of blowing my own horn, I have developed a PayPal subscription plugin for WordPress.

I was writing a paid-content, subscription-based website in WordPress and needed access-control/recurring-billing functionality (preferably in a plugin). As you would know from the thread above and elsewhere, there really isn’t much out there in this way. Hence I developed the Suma plugin: see http://www.sumaplugin.com.

Its currently supported and new features are being added.

cheers,
Brenton

I came across this error under Windows XP. (Don’t worry, I’m just using it as my development site, not production.).

Environment: Windows XP, Apache-2.2, PHP-5.2.5, MySQL-5.0, WordPress-2.5

These were the steps which I followed to install WordPress without it resulting in that nasty error message.
1. Install Apache
2. Install My-SQL. Note: in WordPress’ installation instructions this step comes after PHP installation. However, I read somewhere someone suggesting to install PHP after My-SQL. Don’t know if this was the determining factor, but it was the way I took.
3. Install PHP. Here is were I think you’ll make it or break it. When installing PHP,
a) be sure to point to Apache’s conf directory when asked where its configuration directory resides, don’t just point to Apache’s install directory,
b) when asked which items to install, navigate down into Extensions and select MySQL and MySQLi. By default, these won’t be installed.
4. Copy wordpress directory contents into Apache’s htdocs directory (just my choice, but there are ofcourse other variations which will work).
5. Restart Apache.
6. navigate to http://localhost/wp-admin/install.php This time it should work.

I make no claims to being an Apache/PHP/MySQL/WordPress guru or even a dimly enlightened student. Some of the steps above are probably unnecessary, but they seemed the right thing to do, and hey – IT WORKED!

I hope this helps.