how do I use "server side code" to hide sensitive data from browser view?

Question

In setting up a SSL payment page for online sales it is suggested by the merchant services company that the sensitive data (i.e., merchant credentials, ID and SSL pin, etc) be hidden with the use of Server Side Code. I have been unable to find, after hours of searching, a comprehensive definition of server side code and how it could be used for this purpose. Don't care if the customer views the rest of the code, just want to hide a section. Have seen something that says

<script runat="server">

that looks like the phrase I need, but where do I put it in my block of code? I have

<form action="https:www.mmmmmmm.com/vvvvvvv/process.do method="post">

and then 10 lines such as

<input type="hidden" name= "ssl show_form" value="true">
<input type="hidden" name="ssl_pin" value=hhhhhh">

Please help.. and I am very new to this, so keep it simple? Thanks!!

Answer 1

Anything between the <?php ?> tags will run server-side. For example:

<?php

 echo "hello from the server!";

?>

This code will not be visible to a user - they will only see any output that you generate inside these tags using print, echo, if-else around HTML blocks, etc.

Answer 2

Think your Merchant Services don't want you including fields such as your "ssl_pin" in the HTML; so all customers can see it.

You'll have to choose and implement a method of storing the details you want hidden on the server, and combining these secret details with the submission of the correct form once the form gets submitted.

Answer 3

You need to use some server side language like php, asp.net, ruby... with that then your page should post back its values to your server side page/webservice and then that will handle talking to your merchant services' site.

Answer 4

I suggest you look into using PHP Sessions and store these values in the $_SESSION array. Session value keeps with the user, even when they go to another page, and it's stored server side.

But keep in mind in the US you MUST follow US PCI security requirements, which means you CAN NOT store things like credit card numbers, so make sure your server's PHP session timeout is short, like 5-15mins, and also don't store these values in a database either.