About   Users   Help
Users & Guests Online
On Page: 1
Directory: 3 & 260
Entire Site: 7 & 1629
Page Staff: tgags123, pokemon x, tgags123, supercool22, SonicOlmstead, SonicOlmstead, Barathemos, Furret,
06-24-26 04:23 PM

Forum Links

Related Threads
Coming Soon

Thread Information

Views
1,514
Replies
5
Rating
0
Status
CLOSED
Thread
Creator
Yumecosmos
09-14-09 12:36 PM
Last
Post
DarkHyren
09-18-09 10:17 PM
Additional Thread Details
Views: 460
Today: 0
Users: 0 unique

Thread Actions

Thread Closed
New Thread
New Poll
Order
 

Cookie security

 

09-14-09 12:36 PM
Yumecosmos is Offline
| ID: 114819 | 138 Words

Yumecosmos
Level: 14


POSTS: 18/30
POST EXP: 2818
LVL EXP: 12905
CP: 0.0
VIZ: 1640

Likes: 0  Dislikes: 0
Hi all. I would really appreciate it if someone with knowledge of Javascript and/or ecommerce could help me out a bit

So, I'm a web designer who's pretending to be a developer (i.e. total programming noob), and a client just asked me to make them a shopping cart feature for their online store. They don't have a database or anything, so I thought I'd store the cart contents (basically an array of the product SKUs and prices) in a cookie. Does that pose any kind of security risk?

I imagine storing credit card numbers and such in a cookie is a bad idea, but wasn't sure if the order itself would be a problem...

Beyond that, I have absolutely no idea how to actually handle the payment process. But that's a whole 'nother can of worms. ;
Hi all. I would really appreciate it if someone with knowledge of Javascript and/or ecommerce could help me out a bit

So, I'm a web designer who's pretending to be a developer (i.e. total programming noob), and a client just asked me to make them a shopping cart feature for their online store. They don't have a database or anything, so I thought I'd store the cart contents (basically an array of the product SKUs and prices) in a cookie. Does that pose any kind of security risk?

I imagine storing credit card numbers and such in a cookie is a bad idea, but wasn't sure if the order itself would be a problem...

Beyond that, I have absolutely no idea how to actually handle the payment process. But that's a whole 'nother can of worms. ;

--------------------
Member

Affected by 'Laziness Syndrome'

Registered: 08-03-09
Last Post: 6097 days
Last Active: 6049 days

09-17-09 07:02 AM
DarkHyren is Offline
| ID: 115099 | 187 Words

DarkHyren
Level: 163


POSTS: 2930/7842
POST EXP: 744411
LVL EXP: 55538915
CP: 1232.1
VIZ: 19632

Likes: 0  Dislikes: 0
It really depends on if you design pages with a CMS or make up one from scratch.
I used an addon system for Joomla/Mambo systems a while back called VirtueMart that works quiet well and stores all the details in a standard SQL database.

The potential problem with storing cart contents in a cookie is an obvious exploit.
Using cookies one can trick the system into repricing items just by altering the cookie slightly.
Now that might not be a problem if the client will process orders manually after recieving, but if they use an automated system (An example is if they have a system set to notify their factory that item X is ordered and has to be shipped out) that tells them "item paid, ship item" without allowing them to check the payment details thats where you have problems.

So your best bet is a small database using a system like the one I mentioned above.
VirtueMart also allows for PayPal, credit card, and other payment system integration so that could kill 2 birds with 1 stone as they say.
Hope this helps some
It really depends on if you design pages with a CMS or make up one from scratch.
I used an addon system for Joomla/Mambo systems a while back called VirtueMart that works quiet well and stores all the details in a standard SQL database.

The potential problem with storing cart contents in a cookie is an obvious exploit.
Using cookies one can trick the system into repricing items just by altering the cookie slightly.
Now that might not be a problem if the client will process orders manually after recieving, but if they use an automated system (An example is if they have a system set to notify their factory that item X is ordered and has to be shipped out) that tells them "item paid, ship item" without allowing them to check the payment details thats where you have problems.

So your best bet is a small database using a system like the one I mentioned above.
VirtueMart also allows for PayPal, credit card, and other payment system integration so that could kill 2 birds with 1 stone as they say.
Hope this helps some

--------------------
Beware the dancing Kirby's (>^.^)> <(^.^<)
--------------------
Visit http://www.get-your-rom.com/ you know you wanna
--------------------
"Those who desire to give up freedom in order to gain security will not have, nor do they deserve, either one."
~Benjamin Franklin~
Vizzed Elite
Elite Lurker King

2nd Place in the June 2009 VCS!
2nd Place in the December 2009 VCS!


Affected by 'Laziness Syndrome'

Registered: 12-19-08
Last Post: 3405 days
Last Active: 401 days

09-18-09 09:01 PM
Yumecosmos is Offline
| ID: 115324 | 205 Words

Yumecosmos
Level: 14


POSTS: 21/30
POST EXP: 2818
LVL EXP: 12905
CP: 0.0
VIZ: 1640

Likes: 0  Dislikes: 0
Thanks for the advice!

Unfortunately their host does not offer SQL or any kind of database, so it looks like Virtuemart's not going to be an option. (It's a free hosting service, though, so... not much room to complain. ; ) But they are planning on processing orders manually, so I guess they'll just have to be careful to double check everything. Shouldn't be a big problem since they're pretty small right now.

As long as it's not going to like, open a hole for some hacker to upload a trojan to their server or something, it should be no problem. (I don't even know how that kind of thing works, so that may have sounded totally dumb to the computer-literate crowd.)

If their company grows enough that it gets out of hand, I'll definitely recommend that they get a database and try Virtuemart. Hopefully they'll be able to afford to upgrade their hosting package by then! (Or the manufacturer has their own shopping cart thing that they offer, but they charge $200/month plus setup fees, and that doesn't include a payment gateway. x.x )

Ack, I'm rambling. Anyway, thanks for the tip! Hmm, I should look into this Joomla thing more... looks handy.
Thanks for the advice!

Unfortunately their host does not offer SQL or any kind of database, so it looks like Virtuemart's not going to be an option. (It's a free hosting service, though, so... not much room to complain. ; ) But they are planning on processing orders manually, so I guess they'll just have to be careful to double check everything. Shouldn't be a big problem since they're pretty small right now.

As long as it's not going to like, open a hole for some hacker to upload a trojan to their server or something, it should be no problem. (I don't even know how that kind of thing works, so that may have sounded totally dumb to the computer-literate crowd.)

If their company grows enough that it gets out of hand, I'll definitely recommend that they get a database and try Virtuemart. Hopefully they'll be able to afford to upgrade their hosting package by then! (Or the manufacturer has their own shopping cart thing that they offer, but they charge $200/month plus setup fees, and that doesn't include a payment gateway. x.x )

Ack, I'm rambling. Anyway, thanks for the tip! Hmm, I should look into this Joomla thing more... looks handy.

--------------------
Member

Affected by 'Laziness Syndrome'

Registered: 08-03-09
Last Post: 6097 days
Last Active: 6049 days

09-18-09 09:36 PM
DarkHyren is Offline
| ID: 115329 | 112 Words

DarkHyren
Level: 163


POSTS: 2949/7842
POST EXP: 744411
LVL EXP: 55538915
CP: 1232.1
VIZ: 19632

Likes: 0  Dislikes: 0
No problems.

Im not completly up to date on the whole cookie thing, but so long as you have it limited and make it that it can only affect the final output receipt (possibly so that no hard copy is stored on their server but instead is forwarded to their email as well as customers email? might save some server storage space that way too) it shouldnt be a big risk.
But dont quote me on it

But yeah, once a company gets above a certain level a content management system can be a good idea.
Just remember the free ones like Joomla and Mambo need some tweaking for extra security.
No problems.

Im not completly up to date on the whole cookie thing, but so long as you have it limited and make it that it can only affect the final output receipt (possibly so that no hard copy is stored on their server but instead is forwarded to their email as well as customers email? might save some server storage space that way too) it shouldnt be a big risk.
But dont quote me on it

But yeah, once a company gets above a certain level a content management system can be a good idea.
Just remember the free ones like Joomla and Mambo need some tweaking for extra security.

--------------------
Beware the dancing Kirby's (>^.^)> <(^.^<)
--------------------
Visit http://www.get-your-rom.com/ you know you wanna
--------------------
"Those who desire to give up freedom in order to gain security will not have, nor do they deserve, either one."
~Benjamin Franklin~
Vizzed Elite
Elite Lurker King

2nd Place in the June 2009 VCS!
2nd Place in the December 2009 VCS!


Affected by 'Laziness Syndrome'

Registered: 12-19-08
Last Post: 3405 days
Last Active: 401 days

09-18-09 10:03 PM
is Offline
| ID: 115330 | 176 Words


JigSaw
Level: 167


POSTS: 2163/7936
POST EXP: 584185
LVL EXP: 60749082
CP: 8069.8
VIZ: -46029578

Likes: 0  Dislikes: 0
Cookies are fine to use however you are only limited to 20 of them I believe so use them sparingly. Why not use paypal? No cookies needed, it has loads of security, and you don't need a database for it however a database will really help out with it all.

For example, I just made a shopping cart. Instead of having to re-enter the pricing and product information for each button you can simply extract all the data to that button with one page and one query.

Making a manual shopping cart on free hosting space is a bad idea especially if you try to process orders yourself. Plus it looks bad if your trying to sell stuff on a free hosting site anyways so the odds are stacked against you.

Storing product numbers and price isn't much of a concern since those are always public but whatever you do don't ask for their credit card info unless you got SSL or if your using something like PayPal cause that can be a major security risk.
Cookies are fine to use however you are only limited to 20 of them I believe so use them sparingly. Why not use paypal? No cookies needed, it has loads of security, and you don't need a database for it however a database will really help out with it all.

For example, I just made a shopping cart. Instead of having to re-enter the pricing and product information for each button you can simply extract all the data to that button with one page and one query.

Making a manual shopping cart on free hosting space is a bad idea especially if you try to process orders yourself. Plus it looks bad if your trying to sell stuff on a free hosting site anyways so the odds are stacked against you.

Storing product numbers and price isn't much of a concern since those are always public but whatever you do don't ask for their credit card info unless you got SSL or if your using something like PayPal cause that can be a major security risk.

--------------------
Vizzed Elite
PHP Developer, Security Consultant

Affected by 'Laziness Syndrome'

Registered: 04-06-06
Location: Area 51
Last Post: 2524 days
Last Active: 2518 days

09-18-09 10:17 PM
DarkHyren is Offline
| ID: 115334 | 90 Words

DarkHyren
Level: 163


POSTS: 2950/7842
POST EXP: 744411
LVL EXP: 55538915
CP: 1232.1
VIZ: 19632

Likes: 0  Dislikes: 0
Well the way I understand it the cookie it a temp measure to use until the cart contents get to the checkout.
Basically just something to store items in a shopping cart till the customer is finished shopping, which paypal could then take over.

I agree on if their going with whatever is cheapest to use a basic paypal account, they might have to put a surcharge because of paypals withdraw fees, thats one drawback, but they would have to weight the pros of paypals security against it as well.
Well the way I understand it the cookie it a temp measure to use until the cart contents get to the checkout.
Basically just something to store items in a shopping cart till the customer is finished shopping, which paypal could then take over.

I agree on if their going with whatever is cheapest to use a basic paypal account, they might have to put a surcharge because of paypals withdraw fees, thats one drawback, but they would have to weight the pros of paypals security against it as well.

--------------------
Beware the dancing Kirby's (>^.^)> <(^.^<)
--------------------
Visit http://www.get-your-rom.com/ you know you wanna
--------------------
"Those who desire to give up freedom in order to gain security will not have, nor do they deserve, either one."
~Benjamin Franklin~
Vizzed Elite
Elite Lurker King

2nd Place in the June 2009 VCS!
2nd Place in the December 2009 VCS!


Affected by 'Laziness Syndrome'

Registered: 12-19-08
Last Post: 3405 days
Last Active: 401 days

Page Comments

Dove4JS - 12-12-20 05:26 AM
no image
joldboy70 - 07-10-20 11:13 AM
test
joldboy70 - 07-10-20 11:12 AM
test
savage23157 - 04-08-20 01:33 PM
Hi im new vizzed
zokuza - 11-18-19 09:08 AM
final got playstaion games unlock yes baby digimon world here i com
yoshirulez! - 02-10-17 08:45 PM
MAY MAYS
yoshirulez! - 02-10-17 08:45 PM
maymays
yoshirulez! - 02-07-17 11:13 PM
OwO what's this?
yoshirulez! - 02-07-17 11:13 PM
OwO what's this?
yoshirulez! - 02-07-17 11:13 PM
OwO what's this?

Adblocker detected!

Vizzed.com is very expensive to keep alive! The Ads pay for the servers.

Vizzed has 3 TB worth of games and 1 TB worth of music.  This site is free to use but the ads barely pay for the monthly server fees.  If too many more people use ad block, the site cannot survive.

We prioritize the community over the site profits.  This is why we avoid using annoying (but high paying) ads like most other sites which include popups, obnoxious sounds and animations, malware, and other forms of intrusiveness.  We'll do our part to never resort to these types of ads, please do your part by helping support this site by adding Vizzed.com to your ad blocking whitelist.

×