ecommerce - use server side code for hidden values in an html form

Question

I'm trying to learn how to implement a donation form on a website using virtual merchant. The html code from their developer manual goes like this:

<form action="https://www.myvirtualmerchant.com/VirtualMerchant/process.do" method="POST">
Your Total: $5.00 <br/>
<input type="hidden" name="ssl_amount" value="5.00"><br/>
<input type="hidden" name="ssl_merchant_id" value="my_virtualmerchant_ID">
<input type="hidden" name="ssl_pin" value="my_PIN">
<input type="hidden" name="ssl_transaction_type" value="ccsale">
<input type="hidden" name="ssl_show_form" value="false">
Credit Card Number: <input type="text" name="ssl_card_number"> <br/>
Expiration Date (MMYY): <input type="text" name="ssl_exp_date" size="4"> <br/>
<br/>
<input type="submit" value="Continue">
</form>

I have that in an html file and it works fine, but they suggest that the merchant data (the input type="hidden" values) should be in a Server Side Code. I was looking at cURL but it'a all very new to me and I spent a couple of hours trying to find some guide or some sample code on how to accomplish that. Any suggestions or help is greatly appreciated. Thanks!

Answer 1

I have worked with this gateway a few times and they require you to input the URL that will be granted access to post to thier system. Even if someone tried to use the information that is in your hidden fields, they should not be able to post anything to it since they would not be posting from an approved location. If they could, the gateway would have major problems. The user info contained in the form is not the same information that is required to administer the gateway options and has very limited access to begin with.

Like you, I was uncomfortable with this at first. I ran across the same suggestion in their documentation, but they offered no examples and didn't find a good way to make it happen in the time-frame/budget for the project. After talking with my client, they agreed this was acceptable and we have been doing that way since launch.

In my case, I have used a form much like yours that my reads the values from my ecommerce system for 3 different sites, the oldest of which has been running for almost 2 years without any issues.

After using them a few times, I can say thier system works as advertised and our customers are happy with thier service.