[SOLVED] How to mask credit card numbers

  
echo (SQL generated: ". $Component->ds->SQL;  

  
if ( substr($Component->yourfield->GetValue(),1,3) == "***") {  
   $OrgSQL = $Component->ds->SQL;  
   $FldString = " creditcardnr = " . $Component->ds->ToSQL($Component->yourfield->GetValue(), ccsText) . ",";  
   $Component->ds->SQL = str_replace($FldString,"", $OrgSQL);  
//  echo "<br> Org: ". $OrgSQL;  
// echo "Fldstring" . $FldString;  
// echo "<br> New"  . $Component->ds->SQL;  
  
}  
  

  
if ( 1 == 1) { // stupid always true test  
   $OrgSQL = $Component->ds->SQL;  
   $FldString = " product_name = " . $Component->ds->ToSQL($Component->product_name->GetValue(),ccsText) . ",";  
   $Component->ds->SQL = str_replace($FldString,"", $OrgSQL);  
  
   echo "<br> Org: ". $OrgSQL;  
   echo "<br> Fldstring" . $FldString;  
   echo "<br> New"  . $Component->ds->SQL;  
}  
  
Results in:  
  
  
Org: UPDATE store_products SET category_id = 1, product_name = 'PHP and MySQL Web Development', price = 3, description = NULL, is_recommended = 0 WHERE product_id = 5  
Fldstring product_name = 'PHP and MySQL Web Development',  
NewUPDATE store_products SET category_id = 1,price = 3, description = NULL, is_recommended = 0 WHERE product_id = 5  
Warning: Cannot modify header information - headers already sent by (output sta................  
  

Quote datadoit:

Why not? :)

Quote marcwolf:

Hi..
Try this.

When you load the record put the credit card number into a session variable, and put the masked credit card number into two fields.. A Hidden one and a text one.

When the form is submitted you can check that the two credit card fields are the same. If so then put the session variable back into the credit card field using the BeforeInsert of BeforeUpdate event.

If the two fields are different then you can put the new creditcard number into the database, update the session with the new number, and then send the two masked fields back out again.

This way you have your validation AND your application is secure as the credit card number is stored in the server memory - not on the Client's browser.

Hope this helps

Dave

Quote wkempees:

BeforeExecuteUpdate, is the place to alter the SQL.

First I would do

  
echo (SQL generated: ". $Component->ds->SQL;  

This will display the generated UPDATE statement,
UPDATE <table> SET field=value, [....] WHERE ......

So test for creditcardfield

  
if ( substr($Component->yourfield->GetValue(),1,3) == "***") {  
   $OrgSQL = $Component->ds->SQL;  
   $FldString = " creditcardnr = " . $Component->ds->ToSQL($Component->yourfield->GetValue(), ccsText) . ",";  
   $Component->ds->SQL = str_replace($FldString,"", $OrgSQL);  
//  echo "<br> Org: ". $OrgSQL;  
// echo "Fldstring" . $FldString;  
// echo "<br> New"  . $Component->ds->SQL;  
  
}  
  

Basics:
Store the original SQL
strore the 'field = value' in $Fldstring and use ToSQL to make a correct string
replace the $fldString with nothing "" actually cutting it out of the update SQL
feed CCS the new SQL

The echo statements are for debugging only, of course. will display and stop execute.


an example on Internet example database, Store products Update:

  
if ( 1 == 1) { // stupid always true test  
   $OrgSQL = $Component->ds->SQL;  
   $FldString = " product_name = " . $Component->ds->ToSQL($Component->product_name->GetValue(),ccsText) . ",";  
   $Component->ds->SQL = str_replace($FldString,"", $OrgSQL);  
  
   echo "<br> Org: ". $OrgSQL;  
   echo "<br> Fldstring" . $FldString;  
   echo "<br> New"  . $Component->ds->SQL;  
}  
  
Results in:  
  
  
Org: UPDATE store_products SET category_id = 1, product_name = 'PHP and MySQL Web Development', price = 3, description = NULL, is_recommended = 0 WHERE product_id = 5  
Fldstring product_name = 'PHP and MySQL Web Development',  
NewUPDATE store_products SET category_id = 1,price = 3, description = NULL, is_recommended = 0 WHERE product_id = 5  
Warning: Cannot modify header information - headers already sent by (output sta................  
  

Walter
HTH

Quote :

ASP
When using ASP, you can use the following code to print out variables within most events:

  
response.write variable_name  

In a similar fashion you can also display the value of a control, such as a Text Box, within its Before Show event:

  
response.write TextBox1.value  

Additionally, you can use the Before Execute Select event of a Grid to examine parts of the SQL statement of the form by using the following code:

  
response.write "SQL:" & GridName.datasource.SQL & "<br>"  
response.write "ORDER BY:" & GridName.datasource.Order & "<br>"  
response.write "WHERE:" & GridName.datasource.Where & "<br>"  

(similar code can also be used to dynamically alter the SQL)

Keep in mind that sometimes the VBScript command response.write may appear not to work, especially when the page is being redirected to another page or refreshed. In this case you can disable the page buffering option by adding the following code to the beginning of the Common.asp file (after the 'End Include Files comment):

  
response.buffer = False  

Quote datadoit:

You are correct. Excellent point!

To make certain it's secure in that regards, in the hidden field's
BeforeShow event, do:

$Component->SetValue("");

It's still 'bound' to the database field, but it doesn't get it's value
until -after- the submit takes place.

Quote datadoit:

JimmyCrackedCorn wrote:
> but if I set the hidden field value to "" then upon return to the server it
> will blank the credit card number in the database!
>
> as I see it there are only two ways to do this, 1) rewrite the SQL to remove
> this field when it has not been changed (like Walter suggested) or 2) store the
> credit card number on the server for later comparison (as MarcWolf suggested). I
> was hoping CCS has a command to simply remove one of the fields from the Update
> SQL.
>
> ---------------------------------------

Recognize that you're setting it's initial value in the field's
BeforeShow event to null so that a client's view source won't expose
anything (as requested), but then in the form's OnValidate server-side
event you're giving it a value (either the new value or the old value
from the database). It's never exposed to the client.

Looking at this further, you don't even need a hidden field! Simply use
the existing display field, give it a mask as you have been in it's
BeforeShow event, then assign the field value accordingly (old or new
value).

//Get what's currently in the database.
$db = new clsDBYourConnectionDB();
$DatabaseValue = CCDLookUp("YourField", "YourTable", "YourID=" .
$db->ToSQL($Container->YourUniqueField->GetValue(), ccsInteger), $db);
$db->close();

//Now let's see if user changed something.
if (substr($Container->YourField->GetValue(),0,3) == "***") {
//There's no change, so write out the existing database value.
$Container->YourField->SetValue($DatabaseValue);
}

//Otherwise the update will write out the new value.

Quote datadoit:

Correct. You don't even need the custom query if you don't want to.
Simply define a global variable in the field's BeforeShow and set that
global variable to the field value. Then, in the field's OnValidate,
use that global variable to compare with.

YourField_BeforeShow:
global $DatabaseValue;
$DatabaseValue = $Component->GetValue();
....then do your masking stuff

YourField_OnValidate:
global $DatabaseValue;
//Now let's see if user changed something.
if (substr($Container->YourField->GetValue(),0,3) == "***") {
//There's no change, so write out the existing database value.
$Container->YourField->SetValue($DatabaseValue);
}

Quote wkempees:

@Oper, nice one, thanks.
@J, pls change title to [SOLVED] How to mask creditcard numbers.

The [SOLVED] is serious, the other part is changed by the SQL, lol

Walter