Credit card payment gateway in PHP?

Question

I need to process credit cards and integrate with backend payment services to credit them. The majority of solutions on the internet require an intermediary, eg. 2CO, GCO, Auth.net.

Do you have any experience with implementing a credit-card payment gateway in PHP? Any help in appreciated.

Thanks for your time.

Solution 1

Stripe has a PHP library to accept credit cards without needing a merchant account: https://github.com/stripe/stripe-php

Check out the documentation and FAQ, and feel free to drop by our chatroom if you have more questions.

Solution 2

If you need something quick and dirty, you can just use PayPal's "Buy" buttons and drop them on your pages. These will take people off-site to PayPal where they can pay with a PayPal account or a credit card. This is free and super easy to implement.

If you want something a bit nicer where people pay on-site with their credit card, then you would want to look into one of those 3rd part payment providers. None of them (that I'm aware of) are completely free. All will have a per-transaction fee, and most will have a monthly fee as well.

Personally I've worked with Authorize.NET and PayPal Website Payments Pro. Both have great APIs and sample code that you can hook into via PHP easily enough.

Solution 3

There are more than a few gateways out there, but I am not aware of a reliable gateway that is free. Most gateways like PayPal will provide you APIs that will allow you to process credit cards, as well as do things like void, charge, or refund.

The other thing you need to worry about is the coming of PCI compliance which basically says if you are not compliant, you (or the company you work for) will be liable by your Merchant Bank and/or Card Vendor for not being compliant by July of 2010. This will impose large fines on you and possibly revoke the ability for you to process credit cards.

All that being said companies like PayPal have a PHP SDK:

https://cms.paypal.com/us/cgi-bin/?cmd=_render-content&content_ID=developer/library_download_sdks

Authorize.Net:

http://developer.authorize.net/samplecode/

Those are two of the more popular ones for the United States.

For PCI Info see:

https://www.pcisecuritystandards.org/

Solution 4

Braintree also has an open source PHP library that makes PHP integration pretty easy.

Solution 5

The best solution we found was to team up with one of those intermediaries. Otherwise you will have to deal with a bunch of other requirements like PCI compliance. We use Verifone's IPCharge and it works quite well.

View more solutions

Comments

[Chris]

where can i read about that "u have to be compilant with PCI" thing?

[Scott Lance]

pcisecuritystandards.org

[Chris]

@Scott i meant, where can i find the law. on that page at least i cant find a notice that u are forced by law to be compilant by july 2010

[Scott Lance]

There is no 'law', but if you don't become compliant, and are caught, then your merchant bank will be fined by the PCI, that fine will probably roll down hill and hit you. Then you will be either forced to pay the fine or lose your ability to process credit cards by your merchant bank. See websiteverification.wordpress.com/2009/04/28/pci-dss-fines

[Chris]

@Scott: i understand the issue Scott. All i want to find is some serious sources, nut just this blog posts without any references. If you can be fined by court to pay for the loss of cc data (even if u didnt lost anything) there has to be a law that protects you from that IF u are PCI complilant. however, somewhere has to be a law involved otherwise PCI coulndt have any impact bcs non compilance couldnt be pursued.

[Scott Lance]

The courts or the federal governments with the exception of Nevada have nothing to do with PCI. PCI is a independent body run by the 5 major card brands (Visa, MC, AMEX, JBC, Discover). If a breach in your company occurs, then the PCI will fine your merchant bank, your merchant bank will pass the fine along to you. If you refuse to pay the fine, then your merchant bank will probably drop your service and those card brands will revoke your privilege of processing transactions with their brands. We found out Friday that even if you are PCI compliant and are breached you will still be fined.

[Scott Lance]

We also found out Friday from our QSA that Nevada has passed a law that requires all Nevada companies that process credit cards are required by law to become compliant to the PCI standard. See infoseccompliance.com/2009/06/22/…

[Jestep]

PCI does not provide any protection. It is simply a standard that must be followed. As Scott Lance said, you are still fully liable for damages due to stolen information whether you're PCI compliant or not.

[amolv]

is Authorize.NET avail in INR ?

[Eric Petroelje]

@amolv - sort of, you can accept payments in INR, but as the merchant you must have a US bank account. The credit card provider would handle the conversion of INR -> USD. See here: developer.authorize.net/faqs/#global

[Robin Rodricks]

Fantastic! Easy to use and no hidden charges.

[Blackbam]

Unfortunatly only working with American bank accounts right now...

[Igbanam]

No hidden charges? Doesn't Stripe charge like 2% + 30c per transaction?

[Jose Cifuentes]

Here's a very-simple tutorial/example of how to implement stripe: code.tutsplus.com/tutorials/…

[Luke Pring]

Their documentation is terrible.