Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.php > #17026 > unrolled thread

Need help with two-way script

Back to article view | Back to comp.lang.php

Contents

  Need help with two-way script Adrienne Boswell <arbpen@yahoo.com> - 2016-09-08 01:48 +0000
    Re: Need help with two-way script Jerry Stuckle <jstucklex@attglobal.net> - 2016-09-07 22:51 -0400
      Re: Need help with two-way script "J.O. Aho" <user@example.net> - 2016-09-08 06:29 +0200
        Re: Need help with two-way script bill <william@TechServSys.com> - 2016-09-08 07:50 -0400
          Re: Need help with two-way script Adrienne Boswell <arbpen@yahoo.com> - 2016-09-08 17:39 +0000
      Re: Need help with two-way script Adrienne Boswell <arbpen@yahoo.com> - 2016-09-08 17:43 +0000
        Re: Need help with two-way script Jerry Stuckle <jstucklex@attglobal.net> - 2016-09-08 14:05 -0400
          Re: Need help with two-way script "J.O. Aho" <user@example.net> - 2016-09-08 22:06 +0200
            Re: Need help with two-way script Jerry Stuckle <jstucklex@attglobal.net> - 2016-09-08 16:59 -0400
              Re: Need help with two-way script (PCI DSS) "J.O. Aho" <user@example.net> - 2016-09-09 06:32 +0200
                Re: Need help with two-way script (PCI DSS) Jerry Stuckle <jstucklex@attglobal.net> - 2016-09-09 10:05 -0400
                  Re: Need help with two-way script (PCI DSS) "J.O. Aho" <user@example.net> - 2016-09-09 18:21 +0200
          Re: Need help with two-way script Adrienne Boswell <arbpen@yahoo.com> - 2016-09-08 20:17 +0000
            Re: Need help with two-way script Jerry Stuckle <jstucklex@attglobal.net> - 2016-09-08 17:03 -0400
            Re: Need help with two-way script Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2016-09-10 12:04 +0200
        Re: Need help with two-way script Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2016-09-10 11:54 +0200
    Re: Need help with two-way script Ben Bacarisse <ben.usenet@bsb.me.uk> - 2016-09-08 12:54 +0100
    Re: Need help with two-way script "J.O. Aho" <user@example.net> - 2016-09-09 06:54 +0200
    Re: Need help with two-way script Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2016-09-10 09:04 +0200
      Re: Need help with two-way script Jerry Stuckle <jstucklex@attglobal.net> - 2016-09-10 10:19 -0400
    Re: Need help with two-way script He <y12983@mail.ee> - 2022-02-02 02:23 -0800

Page 1 of 2  [1] 2  Next page →

#17026 — Need help with two-way script

I am coming here because I don't really even know what to google for, and 
I'm sure that many of you can do this with your eyes closed.  That's why 
I'm coming to the experts.

Here is the scenario.  A customer is at the checkout page of an online 
store, example.com. They would put in their email address, credit card 
information, etc., and hit send.

1. The site, example.com, sends a post request to 
https://aloyaltycard.com with the person's email address, their merchant 
number and total amount of the transation.
2. aloyaltycard.com receives the information, does a quick check to 
verify that the email address is on file and notes the transaction in its 
db. (I already know how to do this part)
3. aloyaltycard.com sends back a verification to example.com that the 
email address is good and 90% of the transaction amount. (This is where I 
need help)
4. Then example.com completes the tranaction on their end giving the user 
a 10% discount, which should match up with the 90% aloyaltycard.com sent 
back in the verification.

Thank you in advance for your time and assistance.

-- 
Adrienne Boswell
http://the-good-plate.com - Gourmet Foods on a Budget
http://cavalcade-of-coding.info - Organic Web Design

[toc] | [next] | [standalone]

#17027

On 9/7/2016 9:48 PM, Adrienne Boswell wrote:
> I am coming here because I don't really even know what to google for, and 
> I'm sure that many of you can do this with your eyes closed.  That's why 
> I'm coming to the experts.
> 
> Here is the scenario.  A customer is at the checkout page of an online 
> store, example.com. They would put in their email address, credit card 
> information, etc., and hit send.
> 
> 1. The site, example.com, sends a post request to 
> https://aloyaltycard.com with the person's email address, their merchant 
> number and total amount of the transation.
> 2. aloyaltycard.com receives the information, does a quick check to 
> verify that the email address is on file and notes the transaction in its 
> db. (I already know how to do this part)
> 3. aloyaltycard.com sends back a verification to example.com that the 
> email address is good and 90% of the transaction amount. (This is where I 
> need help)
> 4. Then example.com completes the tranaction on their end giving the user 
> a 10% discount, which should match up with the 90% aloyaltycard.com sent 
> back in the verification.
> 
> Thank you in advance for your time and assistance.
> 

Not really enough information for a meaningful response.  What is the
communication between example.com and aloyaltycard.com?  Is it http?
Json?  Database (i.e. MySQL)?  XML?

You probably should be asking the folks at aloyaltycard.com for
information on how to work with their server.

And BTW - I hope you're talking about a domain owned by Josef Rotter
Marketing (aloyaltycard.com).  Otherwise you shouldn't be using someone
else's domain in your post.

-- 
==================
Remove the "x" from my email address
Jerry Stuckle
jstucklex@attglobal.net
==================

[toc] | [prev] | [next] | [standalone]

#17028

On 09/08/2016 04:51 AM, Jerry Stuckle wrote:
> On 9/7/2016 9:48 PM, Adrienne Boswell wrote:
>> I am coming here because I don't really even know what to google for, and 
>> I'm sure that many of you can do this with your eyes closed.  That's why 
>> I'm coming to the experts.
>>
>> Here is the scenario.  A customer is at the checkout page of an online 
>> store, example.com. They would put in their email address, credit card 
>> information, etc., and hit send.

Congratulation, you will have the enjoyable task of reading the  	
PCI DSS documentations from the payment card industry:
https://www.pcisecuritystandards.org/document_library

>> 1. The site, example.com, sends a post request to 
>> https://aloyaltycard.com with the person's email address, their merchant 
>> number and total amount of the transation.
>> 2. aloyaltycard.com receives the information, does a quick check to 
>> verify that the email address is on file and notes the transaction in its 
>> db. (I already know how to do this part)
>> 3. aloyaltycard.com sends back a verification to example.com that the 
>> email address is good and 90% of the transaction amount. (This is where I 
>> need help)
>> 4. Then example.com completes the tranaction on their end giving the user 
>> a 10% discount, which should match up with the 90% aloyaltycard.com sent 
>> back in the verification.
>>
>> Thank you in advance for your time and assistance.
>>
> 
> Not really enough information for a meaningful response.  What is the
> communication between example.com and aloyaltycard.com?  Is it http?
> Json?  Database (i.e. MySQL)?  XML?

Also if it's direct communication between the sites or the data
transported with redirecting the customer between the sites (that could
be prone for fraud).

> You probably should be asking the folks at aloyaltycard.com for
> information on how to work with their server.
> 
> And BTW - I hope you're talking about a domain owned by Josef Rotter
> Marketing (aloyaltycard.com).  Otherwise you shouldn't be using someone
> else's domain in your post.

for me it has a feel of a school task, but sure I could be wrong.

-- 

 //Aho

[toc] | [prev] | [next] | [standalone]

#17030

>> And BTW - I hope you're talking about a domain owned by Josef Rotter
>> Marketing (aloyaltycard.com).  Otherwise you shouldn't be using someone
>> else's domain in your post.
>
> for me it has a feel of a school task, but sure I could be wrong.
I'll vouch for Adrienne, she has been around for a long time. 
Used to post in the HTML-Kit forum.
-bill
>

[toc] | [prev] | [next] | [standalone]

#17032

bill <william@TechServSys.com> wrote

> 
>>> And BTW - I hope you're talking about a domain owned by Josef Rotter
>>> Marketing (aloyaltycard.com).  Otherwise you shouldn't be using someone
>>> else's domain in your post.
>>
>> for me it has a feel of a school task, but sure I could be wrong.
> I'll vouch for Adrienne, she has been around for a long time. 
> Used to post in the HTML-Kit forum.
> -bill
>>
> 
> 

Thanks bill, I appreciate that.

[toc] | [prev] | [next] | [standalone]

#17033

Jerry Stuckle <jstucklex@attglobal.net> wrote

> On 9/7/2016 9:48 PM, Adrienne Boswell wrote:
>> I am coming here because I don't really even know what to google for,
>> and I'm sure that many of you can do this with your eyes closed. 
>> That's why I'm coming to the experts.
>> 
>> Here is the scenario.  A customer is at the checkout page of an
>> online store, example.com. They would put in their email address,
>> credit card information, etc., and hit send.
>> 
>> 1. The site, example.com, sends a post request to 
>> https://aloyaltycard.com with the person's email address, their
>> merchant number and total amount of the transation.
>> 2. aloyaltycard.com receives the information, does a quick check to 
>> verify that the email address is on file and notes the transaction in
>> its db. (I already know how to do this part)
>> 3. aloyaltycard.com sends back a verification to example.com that the
>> email address is good and 90% of the transaction amount. (This is
>> where I need help)
>> 4. Then example.com completes the tranaction on their end giving the
>> user a 10% discount, which should match up with the 90%
>> aloyaltycard.com sent back in the verification.
>> 
>> Thank you in advance for your time and assistance.
>> 
> 
> Not really enough information for a meaningful response.  What is the
> communication between example.com and aloyaltycard.com?  Is it http?
> Json?  Database (i.e. MySQL)?  XML?

It would be http, database is MySQL. Other suggestions most welcome!

> 
> You probably should be asking the folks at aloyaltycard.com for
> information on how to work with their server.

I AM the folks at aloyaltycard.com.  I just haven't had to deal with this 
kind of thing yet.

> 
> And BTW - I hope you're talking about a domain owned by Josef Rotter
> Marketing (aloyaltycard.com).  Otherwise you shouldn't be using
> someone else's domain in your post.

Josef has been my friend for over 30 years, and we've been working 
together on aloyaltycard.com for 10.  I used to babysit his daughter who 
recently got married.  I've known that man forever!

-- 
Adrienne Boswell

[toc] | [prev] | [next] | [standalone]

#17034

On 9/8/2016 1:43 PM, Adrienne Boswell wrote:
> Jerry Stuckle <jstucklex@attglobal.net> wrote
> 
>> On 9/7/2016 9:48 PM, Adrienne Boswell wrote:
>>> I am coming here because I don't really even know what to google for,
>>> and I'm sure that many of you can do this with your eyes closed. 
>>> That's why I'm coming to the experts.
>>>
>>> Here is the scenario.  A customer is at the checkout page of an
>>> online store, example.com. They would put in their email address,
>>> credit card information, etc., and hit send.
>>>
>>> 1. The site, example.com, sends a post request to 
>>> https://aloyaltycard.com with the person's email address, their
>>> merchant number and total amount of the transation.
>>> 2. aloyaltycard.com receives the information, does a quick check to 
>>> verify that the email address is on file and notes the transaction in
>>> its db. (I already know how to do this part)
>>> 3. aloyaltycard.com sends back a verification to example.com that the
>>> email address is good and 90% of the transaction amount. (This is
>>> where I need help)
>>> 4. Then example.com completes the tranaction on their end giving the
>>> user a 10% discount, which should match up with the 90%
>>> aloyaltycard.com sent back in the verification.
>>>
>>> Thank you in advance for your time and assistance.
>>>
>>
>> Not really enough information for a meaningful response.  What is the
>> communication between example.com and aloyaltycard.com?  Is it http?
>> Json?  Database (i.e. MySQL)?  XML?
> 
> It would be http, database is MySQL. Other suggestions most welcome!
>

Ok, but that still doesn't talk about the format of the
request/response.  You can use cURL, the actual request/response, for
instance.  Or you might access the MySQL database directly (it does
support remote access).

>>
>> You probably should be asking the folks at aloyaltycard.com for
>> information on how to work with their server.
> 
> I AM the folks at aloyaltycard.com.  I just haven't had to deal with this 
> kind of thing yet.
> 

Ok, didn't mean to be insulting.  It's just there are a lot of people
around here who misuse other people's domain names in examples.

So it sounds like you have control over both sides of the conversation,
in which case you can do about anything you want.  So the first thing
you need to do is determine how you want to transfer the data.

Personally, I would consider directly accessing the MySQL database - I
believe for the most part the less involved, the less that can go wrong.
 However, I also understand that is not always possible or not always
desirable.  If not, I would recommend JSON - it's about the easiest when
you have fixed information being passed.

Another alternative would be XML, but that can be more complicated.  It
really excels when you are returning lists, especially if they have
optional items in the list.

If, OTOH, you don't have control over the other end, then you have to go
with whatever has been designed into it.

>>
>> And BTW - I hope you're talking about a domain owned by Josef Rotter
>> Marketing (aloyaltycard.com).  Otherwise you shouldn't be using
>> someone else's domain in your post.
> 
> Josef has been my friend for over 30 years, and we've been working 
> together on aloyaltycard.com for 10.  I used to babysit his daughter who 
> recently got married.  I've known that man forever!
> 

LOL.

-- 
==================
Remove the "x" from my email address
Jerry Stuckle
jstucklex@attglobal.net
==================

[toc] | [prev] | [next] | [standalone]

#17035

On 09/08/2016 08:05 PM, Jerry Stuckle wrote:
> On 9/8/2016 1:43 PM, Adrienne Boswell wrote:
>> Jerry Stuckle <jstucklex@attglobal.net> wrote
>>
>>> On 9/7/2016 9:48 PM, Adrienne Boswell wrote:
>>>> I am coming here because I don't really even know what to google for,
>>>> and I'm sure that many of you can do this with your eyes closed. 
>>>> That's why I'm coming to the experts.
>>>>
>>>> Here is the scenario.  A customer is at the checkout page of an
>>>> online store, example.com. They would put in their email address,
>>>> credit card information, etc., and hit send.
>>>>
>>>> 1. The site, example.com, sends a post request to 
>>>> https://aloyaltycard.com with the person's email address, their
>>>> merchant number and total amount of the transation.
>>>> 2. aloyaltycard.com receives the information, does a quick check to 
>>>> verify that the email address is on file and notes the transaction in
>>>> its db. (I already know how to do this part)
>>>> 3. aloyaltycard.com sends back a verification to example.com that the
>>>> email address is good and 90% of the transaction amount. (This is
>>>> where I need help)
>>>> 4. Then example.com completes the tranaction on their end giving the
>>>> user a 10% discount, which should match up with the 90%
>>>> aloyaltycard.com sent back in the verification.
>>>>
>>>> Thank you in advance for your time and assistance.
>>>>
>>>
>>> Not really enough information for a meaningful response.  What is the
>>> communication between example.com and aloyaltycard.com?  Is it http?
>>> Json?  Database (i.e. MySQL)?  XML?
>>
>> It would be http, database is MySQL. Other suggestions most welcome!
>>
> 
> Ok, but that still doesn't talk about the format of the
> request/response.  You can use cURL, the actual request/response, for
> instance.  Or you might access the MySQL database directly (it does
> support remote access).
> 
>>>
>>> You probably should be asking the folks at aloyaltycard.com for
>>> information on how to work with their server.
>>
>> I AM the folks at aloyaltycard.com.  I just haven't had to deal with this 
>> kind of thing yet.
>>
> 
> Ok, didn't mean to be insulting.  It's just there are a lot of people
> around here who misuse other people's domain names in examples.
> 
> So it sounds like you have control over both sides of the conversation,
> in which case you can do about anything you want.  So the first thing
> you need to do is determine how you want to transfer the data.
> 
> Personally, I would consider directly accessing the MySQL database - I
> believe for the most part the less involved, the less that can go wrong.

In this case you may get a PCI DSS dependency which you may not want to
have, you will want as few machines as possible in scope, as this makes
audits a lot easier and less work.


>  However, I also understand that is not always possible or not always
> desirable.  If not, I would recommend JSON - it's about the easiest when
> you have fixed information being passed.
> 
> Another alternative would be XML, but that can be more complicated.  It
> really excels when you are returning lists, especially if they have
> optional items in the list.


I agree with Jerry, json far easier to use, but if the project already
been started, it may be too late to change, specially if there would
already be some customers using it.

It would be easier to give a good answer if we knew a bit more, like
what has been already done or if this is just on a planing stage.


Just remember to keep those PAN and Card holder data as isolated as
possible, so you have to do as little as possible to follow PCI DSS.
If you wonder about PCI, I can answer as it's part of my daily work.

--

 //Aho

[toc] | [prev] | [next] | [standalone]

#17037

On 9/8/2016 4:06 PM, J.O. Aho wrote:
> On 09/08/2016 08:05 PM, Jerry Stuckle wrote:
>> On 9/8/2016 1:43 PM, Adrienne Boswell wrote:
>>> Jerry Stuckle <jstucklex@attglobal.net> wrote
>>>
>>>> On 9/7/2016 9:48 PM, Adrienne Boswell wrote:
>>>>> I am coming here because I don't really even know what to google for,
>>>>> and I'm sure that many of you can do this with your eyes closed. 
>>>>> That's why I'm coming to the experts.
>>>>>
>>>>> Here is the scenario.  A customer is at the checkout page of an
>>>>> online store, example.com. They would put in their email address,
>>>>> credit card information, etc., and hit send.
>>>>>
>>>>> 1. The site, example.com, sends a post request to 
>>>>> https://aloyaltycard.com with the person's email address, their
>>>>> merchant number and total amount of the transation.
>>>>> 2. aloyaltycard.com receives the information, does a quick check to 
>>>>> verify that the email address is on file and notes the transaction in
>>>>> its db. (I already know how to do this part)
>>>>> 3. aloyaltycard.com sends back a verification to example.com that the
>>>>> email address is good and 90% of the transaction amount. (This is
>>>>> where I need help)
>>>>> 4. Then example.com completes the tranaction on their end giving the
>>>>> user a 10% discount, which should match up with the 90%
>>>>> aloyaltycard.com sent back in the verification.
>>>>>
>>>>> Thank you in advance for your time and assistance.
>>>>>
>>>>
>>>> Not really enough information for a meaningful response.  What is the
>>>> communication between example.com and aloyaltycard.com?  Is it http?
>>>> Json?  Database (i.e. MySQL)?  XML?
>>>
>>> It would be http, database is MySQL. Other suggestions most welcome!
>>>
>>
>> Ok, but that still doesn't talk about the format of the
>> request/response.  You can use cURL, the actual request/response, for
>> instance.  Or you might access the MySQL database directly (it does
>> support remote access).
>>
>>>>
>>>> You probably should be asking the folks at aloyaltycard.com for
>>>> information on how to work with their server.
>>>
>>> I AM the folks at aloyaltycard.com.  I just haven't had to deal with this 
>>> kind of thing yet.
>>>
>>
>> Ok, didn't mean to be insulting.  It's just there are a lot of people
>> around here who misuse other people's domain names in examples.
>>
>> So it sounds like you have control over both sides of the conversation,
>> in which case you can do about anything you want.  So the first thing
>> you need to do is determine how you want to transfer the data.
>>
>> Personally, I would consider directly accessing the MySQL database - I
>> believe for the most part the less involved, the less that can go wrong.
> 
> In this case you may get a PCI DSS dependency which you may not want to
> have, you will want as few machines as possible in scope, as this makes
> audits a lot easier and less work.
>

Not if it's designed properly.  For instance, MySQL can use encrypted
connections, and firewalls can limit access.

But if the MySQL database is on another system, you'll have that problem
anyway, no matter how you access it.

But that's also why I said you might now want to do it.

> 
>>  However, I also understand that is not always possible or not always
>> desirable.  If not, I would recommend JSON - it's about the easiest when
>> you have fixed information being passed.
>>
>> Another alternative would be XML, but that can be more complicated.  It
>> really excels when you are returning lists, especially if they have
>> optional items in the list.
> 
> 
> I agree with Jerry, json far easier to use, but if the project already
> been started, it may be too late to change, specially if there would
> already be some customers using it.
> 
> It would be easier to give a good answer if we knew a bit more, like
> what has been already done or if this is just on a planing stage.
> 
> 
> Just remember to keep those PAN and Card holder data as isolated as
> possible, so you have to do as little as possible to follow PCI DSS.
> If you wonder about PCI, I can answer as it's part of my daily work.
> 
> --
> 
>  //Aho
> 



-- 
==================
Remove the "x" from my email address
Jerry Stuckle
jstucklex@attglobal.net
==================

[toc] | [prev] | [next] | [standalone]

#17039 — Re: Need help with two-way script (PCI DSS)

On 09/08/2016 10:59 PM, Jerry Stuckle wrote:
> On 9/8/2016 4:06 PM, J.O. Aho wrote:
>> On 09/08/2016 08:05 PM, Jerry Stuckle wrote:

>>> So it sounds like you have control over both sides of the conversation,
>>> in which case you can do about anything you want.  So the first thing
>>> you need to do is determine how you want to transfer the data.
>>>
>>> Personally, I would consider directly accessing the MySQL database - I
>>> believe for the most part the less involved, the less that can go wrong.
>>
>> In this case you may get a PCI DSS dependency which you may not want to
>> have, you will want as few machines as possible in scope, as this makes
>> audits a lot easier and less work.
>>
> 
> Not if it's designed properly.  For instance, MySQL can use encrypted
> connections, and firewalls can limit access.

If application A stores PAN/Card holder data in the database and
application B only is interested in the email address and both access
the same database, then both applications are in scope for PCI audit.

If you let application A send the email address to application B with a
https request and application B returns a true or false answer, then
application B is out of scope for PCI.

There are big difference in the amount of PCI documentation you have to
have and less requirements on the server which application B is running.


> But if the MySQL database is on another system, you'll have that problem
> anyway, no matter how you access it.

You have a compensating control on the MySQL too, as it don't support
encrypted columns, sure you can (must) have it running on a luks partition.


From PCI point of view, I would recommend to use postgresql unless you
want to use money and go for oracle/sybase... the less compensating
controls you have the smother the PCI audit will be.


-- 

 //Aho

[toc] | [prev] | [next] | [standalone]

#17041 — Re: Need help with two-way script (PCI DSS)

On 9/9/2016 12:32 AM, J.O. Aho wrote:
> On 09/08/2016 10:59 PM, Jerry Stuckle wrote:
>> On 9/8/2016 4:06 PM, J.O. Aho wrote:
>>> On 09/08/2016 08:05 PM, Jerry Stuckle wrote:
> 
>>>> So it sounds like you have control over both sides of the conversation,
>>>> in which case you can do about anything you want.  So the first thing
>>>> you need to do is determine how you want to transfer the data.
>>>>
>>>> Personally, I would consider directly accessing the MySQL database - I
>>>> believe for the most part the less involved, the less that can go wrong.
>>>
>>> In this case you may get a PCI DSS dependency which you may not want to
>>> have, you will want as few machines as possible in scope, as this makes
>>> audits a lot easier and less work.
>>>
>>
>> Not if it's designed properly.  For instance, MySQL can use encrypted
>> connections, and firewalls can limit access.
> 
> If application A stores PAN/Card holder data in the database and
> application B only is interested in the email address and both access
> the same database, then both applications are in scope for PCI audit.
>

True - but application B can be restricted so that it cannot access
anything but the email address.  Just because it can access the database
does not mean it can access the entire database.  But that is true for
any half-way decent RDBMS.

> If you let application A send the email address to application B with a
> https request and application B returns a true or false answer, then
> application B is out of scope for PCI.
> 
> There are big difference in the amount of PCI documentation you have to
> have and less requirements on the server which application B is running.
> 

But then you also have an additional server and application(s) to
consider, when once again and place you in scope of a PCI audit.

> 
>> But if the MySQL database is on another system, you'll have that problem
>> anyway, no matter how you access it.
> 
> You have a compensating control on the MySQL too, as it don't support
> encrypted columns, sure you can (must) have it running on a luks partition.
> 

You can encrypt the data in the database; but like most databases the
problem is you need the password to do anything with that column.  But
that's true whether you are accessing the database directly or through
another app.

You can, however, get around this problem by placing the password in
stored procedures.  But that again adds another level complexity.

> 
> From PCI point of view, I would recommend to use postgresql unless you
> want to use money and go for oracle/sybase... the less compensating
> controls you have the smother the PCI audit will be.
> 
> 

I prefer DB2, but that's my opinion.  And both DB2 and Oracle have free
versions.  Those versions are limited, but should work just fine for
what she needs.

The biggest problem when going to other databases will be installation
and maintenance.  Most hosting companies are familiar with MySQL, and
some with PostgreSQL.  However, very few are familiar with the
commercial RDBMS's, so she'll be on her own.

-- 
==================
Remove the "x" from my email address
Jerry Stuckle
jstucklex@attglobal.net
==================

[toc] | [prev] | [next] | [standalone]

#17045 — Re: Need help with two-way script (PCI DSS)

On 09/09/2016 04:05 PM, Jerry Stuckle wrote:
> On 9/9/2016 12:32 AM, J.O. Aho wrote:
>> On 09/08/2016 10:59 PM, Jerry Stuckle wrote:
>>> On 9/8/2016 4:06 PM, J.O. Aho wrote:
>>>> On 09/08/2016 08:05 PM, Jerry Stuckle wrote:
>>
>>>>> So it sounds like you have control over both sides of the conversation,
>>>>> in which case you can do about anything you want.  So the first thing
>>>>> you need to do is determine how you want to transfer the data.
>>>>>
>>>>> Personally, I would consider directly accessing the MySQL database - I
>>>>> believe for the most part the less involved, the less that can go wrong.
>>>>
>>>> In this case you may get a PCI DSS dependency which you may not want to
>>>> have, you will want as few machines as possible in scope, as this makes
>>>> audits a lot easier and less work.
>>>>
>>>
>>> Not if it's designed properly.  For instance, MySQL can use encrypted
>>> connections, and firewalls can limit access.
>>
>> If application A stores PAN/Card holder data in the database and
>> application B only is interested in the email address and both access
>> the same database, then both applications are in scope for PCI audit.
>>
> 
> True - but application B can be restricted so that it cannot access
> anything but the email address.  Just because it can access the database
> does not mean it can access the entire database.  But that is true for
> any half-way decent RDBMS.

Sure you can, but it's still in scope for PCI as it has access to the
database where the PAN/Card Holder data is stored.


>> If you let application A send the email address to application B with a
>> https request and application B returns a true or false answer, then
>> application B is out of scope for PCI.
>>
>> There are big difference in the amount of PCI documentation you have to
>> have and less requirements on the server which application B is running.
>>
> 
> But then you also have an additional server and application(s) to
> consider, when once again and place you in scope of a PCI audit.

Yes, of course, but the additional server ain't within PCI scope as it's
not able to access PAN/Card Holder data.



>>> But if the MySQL database is on another system, you'll have that problem
>>> anyway, no matter how you access it.
>>
>> You have a compensating control on the MySQL too, as it don't support
>> encrypted columns, sure you can (must) have it running on a luks partition.
>>
> 
> You can encrypt the data in the database; but like most databases the
> problem is you need the password to do anything with that column.  But
> that's true whether you are accessing the database directly or through
> another app.

This can be handled by key management systems in a database as for
example in sybase, where you can grant the decryption and use of the
decryption key to users.


> You can, however, get around this problem by placing the password in
> stored procedures.  But that again adds another level complexity.

And yet another compensating control.


>>
>> From PCI point of view, I would recommend to use postgresql unless you
>> want to use money and go for oracle/sybase... the less compensating
>> controls you have the smother the PCI audit will be.
>>
>>
> 
> I prefer DB2, but that's my opinion.  And both DB2 and Oracle have free
> versions.  Those versions are limited, but should work just fine for
> what she needs.

I would say this part of the thread is out of scope for Adrienne, she
just doing the application B and do not really have to think about PCI,
that is all up to their customers to solve.


> The biggest problem when going to other databases will be installation
> and maintenance.  Most hosting companies are familiar with MySQL, and
> some with PostgreSQL.  However, very few are familiar with the
> commercial RDBMS's, so she'll be on her own.

I don't see the problem, most QSA's would fail you if you use normal
hosting for PAN/Card holder data. You need to go for a dedicated machine
and up to you what you install, not the head ache of the hosting company.

-- 

 //Aho

[toc] | [prev] | [next] | [standalone]

#17036

Jerry Stuckle <jstucklex@attglobal.net> wrote

> On 9/8/2016 1:43 PM, Adrienne Boswell wrote:
>> Jerry Stuckle <jstucklex@attglobal.net> wrote
>> 
>>> On 9/7/2016 9:48 PM, Adrienne Boswell wrote:
>>>> I am coming here because I don't really even know what to google
>>>> for, and I'm sure that many of you can do this with your eyes
>>>> closed. That's why I'm coming to the experts.
>>>>
>>>> Here is the scenario.  A customer is at the checkout page of an
>>>> online store, example.com. They would put in their email address,
>>>> credit card information, etc., and hit send.
>>>>
>>>> 1. The site, example.com, sends a post request to 
>>>> https://aloyaltycard.com with the person's email address, their
>>>> merchant number and total amount of the transation.
>>>> 2. aloyaltycard.com receives the information, does a quick check to
>>>> verify that the email address is on file and notes the transaction
>>>> in its db. (I already know how to do this part)
>>>> 3. aloyaltycard.com sends back a verification to example.com that
>>>> the email address is good and 90% of the transaction amount. (This
>>>> is where I need help)
>>>> 4. Then example.com completes the tranaction on their end giving
>>>> the user a 10% discount, which should match up with the 90%
>>>> aloyaltycard.com sent back in the verification.
>>>>
>>>> Thank you in advance for your time and assistance.
>>>>
>>>
>>> Not really enough information for a meaningful response.  What is
>>> the communication between example.com and aloyaltycard.com?  Is it
>>> http? Json?  Database (i.e. MySQL)?  XML?
>> 
>> It would be http, database is MySQL. Other suggestions most welcome!
>>
> 
> Ok, but that still doesn't talk about the format of the
> request/response.  You can use cURL, the actual request/response, for
> instance.  Or you might access the MySQL database directly (it does
> support remote access).

CURL I think would be the best choice for me.

> 
>>>
>>> You probably should be asking the folks at aloyaltycard.com for
>>> information on how to work with their server.
>> 
>> I AM the folks at aloyaltycard.com.  I just haven't had to deal with
>> this kind of thing yet.
>> 
> 
> Ok, didn't mean to be insulting.  It's just there are a lot of people
> around here who misuse other people's domain names in examples.

I didn't take it as an insult.  A lot of people use other people's 
domains in examples, and you had no way of knowing that I've been 
associated with that for all these years.

> 
> So it sounds like you have control over both sides of the
> conversation, in which case you can do about anything you want.  So
> the first thing you need to do is determine how you want to transfer
> the data. 
> 
> Personally, I would consider directly accessing the MySQL database - I
> believe for the most part the less involved, the less that can go
> wrong. 
>  However, I also understand that is not always possible or not always
> desirable.  If not, I would recommend JSON - it's about the easiest
> when you have fixed information being passed.

Yes, I need something that will be easy for developers at the other 
website(s) to implement.  Like I said, I just need them to post to me, I 
do something with the data, and then send them something and they 
complete their side.

> 
> Another alternative would be XML, but that can be more complicated. 
> It really excels when you are returning lists, especially if they have
> optional items in the list.

I'm only going to have 4 things on the list.

> 
> If, OTOH, you don't have control over the other end, then you have to
> go with whatever has been designed into it.

I only have control of aloyaltycard.com, not the other website(s). Right 
now we're doing it with a web page, but back in the day, we had  
dedicated machines that was cumbersome and I had to manually run reports 
to deal with all the data.

Thank you, Jerry, you are the best!

-- 
Adrienne Boswell

[toc] | [prev] | [next] | [standalone]

#17038

On 9/8/2016 4:17 PM, Adrienne Boswell wrote:
> Jerry Stuckle <jstucklex@attglobal.net> wrote
> 
>> On 9/8/2016 1:43 PM, Adrienne Boswell wrote:
>>> Jerry Stuckle <jstucklex@attglobal.net> wrote
>>>
>>>> On 9/7/2016 9:48 PM, Adrienne Boswell wrote:
>>>>> I am coming here because I don't really even know what to google
>>>>> for, and I'm sure that many of you can do this with your eyes
>>>>> closed. That's why I'm coming to the experts.
>>>>>
>>>>> Here is the scenario.  A customer is at the checkout page of an
>>>>> online store, example.com. They would put in their email address,
>>>>> credit card information, etc., and hit send.
>>>>>
>>>>> 1. The site, example.com, sends a post request to 
>>>>> https://aloyaltycard.com with the person's email address, their
>>>>> merchant number and total amount of the transation.
>>>>> 2. aloyaltycard.com receives the information, does a quick check to
>>>>> verify that the email address is on file and notes the transaction
>>>>> in its db. (I already know how to do this part)
>>>>> 3. aloyaltycard.com sends back a verification to example.com that
>>>>> the email address is good and 90% of the transaction amount. (This
>>>>> is where I need help)
>>>>> 4. Then example.com completes the tranaction on their end giving
>>>>> the user a 10% discount, which should match up with the 90%
>>>>> aloyaltycard.com sent back in the verification.
>>>>>
>>>>> Thank you in advance for your time and assistance.
>>>>>
>>>>
>>>> Not really enough information for a meaningful response.  What is
>>>> the communication between example.com and aloyaltycard.com?  Is it
>>>> http? Json?  Database (i.e. MySQL)?  XML?
>>>
>>> It would be http, database is MySQL. Other suggestions most welcome!
>>>
>>
>> Ok, but that still doesn't talk about the format of the
>> request/response.  You can use cURL, the actual request/response, for
>> instance.  Or you might access the MySQL database directly (it does
>> support remote access).
> 
> CURL I think would be the best choice for me.
> 
>>
>>>>
>>>> You probably should be asking the folks at aloyaltycard.com for
>>>> information on how to work with their server.
>>>
>>> I AM the folks at aloyaltycard.com.  I just haven't had to deal with
>>> this kind of thing yet.
>>>
>>
>> Ok, didn't mean to be insulting.  It's just there are a lot of people
>> around here who misuse other people's domain names in examples.
> 
> I didn't take it as an insult.  A lot of people use other people's 
> domains in examples, and you had no way of knowing that I've been 
> associated with that for all these years.
> 
>>
>> So it sounds like you have control over both sides of the
>> conversation, in which case you can do about anything you want.  So
>> the first thing you need to do is determine how you want to transfer
>> the data. 
>>
>> Personally, I would consider directly accessing the MySQL database - I
>> believe for the most part the less involved, the less that can go
>> wrong. 
>>  However, I also understand that is not always possible or not always
>> desirable.  If not, I would recommend JSON - it's about the easiest
>> when you have fixed information being passed.
> 
> Yes, I need something that will be easy for developers at the other 
> website(s) to implement.  Like I said, I just need them to post to me, I 
> do something with the data, and then send them something and they 
> complete their side.
> 
>>
>> Another alternative would be XML, but that can be more complicated. 
>> It really excels when you are returning lists, especially if they have
>> optional items in the list.
> 
> I'm only going to have 4 things on the list.
>

When I was referring to a list, I meant a list of multiple similar
items.  For instance, returning a dozen different shoe styles in a store
- which you aren't doing.

>>
>> If, OTOH, you don't have control over the other end, then you have to
>> go with whatever has been designed into it.
> 
> I only have control of aloyaltycard.com, not the other website(s). Right 
> now we're doing it with a web page, but back in the day, we had  
> dedicated machines that was cumbersome and I had to manually run reports 
> to deal with all the data.
> 

Since you are providing the service, you are setting the "rules" and
providing the appropriate API.  So you get to make the decision on how
to do it.

You could also look at the PayPal interface; it's a bit intimidating at
first, but not all that bad once you get into it.  It does a lot more
than you need, but it will give you an idea of how someone else does
similar work.

> Thank you, Jerry, you are the best!
> 

Just tell my wife that :)

-- 
==================
Remove the "x" from my email address
Jerry Stuckle
jstucklex@attglobal.net
==================

[toc] | [prev] | [next] | [standalone]

#17048

Adrienne Boswell wrote:

> Jerry Stuckle <jstucklex@attglobal.net> wrote
>> On 9/8/2016 1:43 PM, Adrienne Boswell wrote:
>>> Jerry Stuckle <jstucklex@attglobal.net> wrote
>>>> Not really enough information for a meaningful response.  What is
>>>> the communication between example.com and aloyaltycard.com?  Is it
>>>> http? Json?  Database (i.e. MySQL)?  XML?
>>> It would be http, database is MySQL. Other suggestions most welcome!
>> 
>> Ok, but that still doesn't talk about the format of the
>> request/response.  You can use cURL, the actual request/response, for
>> instance.  Or you might access the MySQL database directly (it does
>> support remote access).
> 
> CURL I think would be the best choice for me.

If *you* send the response, then cURL is one of the possibilities *for your 
customer* to receive it (but if you use HTTP, you can leave that entirely up 
to them).  As the name indicates, *Client* for URLs (also: “Client URL 
*Request* Library” and “Curl URL *Request* Library”; see the FAQ) is network 
*client* software (even though it can be used by software that runs on a Web 
server to make *requests* to *other* servers); it is _not_ the way you 
*send* the response (because there you "are" in the position of the 
*server*).
 
-- 
PointedEars
Zend Certified PHP Engineer 
<http://www.zend.com/en/yellow-pages/ZEND024953> | Twitter: @PointedEars2
Please do not cc me. / Bitte keine Kopien per E-Mail.

[toc] | [prev] | [next] | [standalone]

#17047

Adrienne Boswell wrote:

> Jerry Stuckle <jstucklex@attglobal.net> wrote
>> Not really enough information for a meaningful response.  What is the
>> communication between example.com and aloyaltycard.com?  Is it http?
>> Json?  Database (i.e. MySQL)?  XML?
> 
> It would be http, database is MySQL. Other suggestions most welcome!

An HTTP response message can contain anything in the message body, by 
design.  This is how a Web site can have formatted text (through markup and 
stylesheets), images, sound, video, aso.

JSON is not a network protocol like HTTP, as the above questions might 
suggest; it is a plain-text *data format* that can be used in an HTTP 
response message, too (it has become *the* substitute for XML and SOAP, with 
less overhead).
 
>> You probably should be asking the folks at aloyaltycard.com for
>> information on how to work with their server.
> 
> I AM the folks at aloyaltycard.com.  I just haven't had to deal with this
> kind of thing yet.

OK, so send them an HTTP response with JSON that contains the pertinent 
data, and advise them of the format in your FAQ.  PHP has the functionality 
built-in.  RTFM.

>> And BTW - I hope you're talking about a domain owned by Josef Rotter
>> Marketing (aloyaltycard.com).  Otherwise you shouldn't be using
>> someone else's domain in your post.
> 
> Josef has been my friend for over 30 years, and we've been working
> together on aloyaltycard.com for 10.  I used to babysit his daughter who
> recently got married.  I've known that man forever!

Who cares?  He was not referring to that you are misusing the domain, but 
that you are *using* it in your description.  He meant that *if* you would 
use it only as an *example*, *then* you should have used the example.* 
second-level and .example top-level domains instead.

I did not even realize that aloyaltycard.com was _not_ an example domain 
before I went there this morning when I had nothing else to do.

You really need to be more careful and explicit in your problem 
descriptions.  That you need help with the response from aloyaltycard.com 
does _not_ *imply* that you *are* (the folks at) aloyaltycard.com, that 
*you* are to generate the response.  Keep in mind that for the most part we 
are perfect strangers; we cannot read your mind, and all our crystal balls 
are constantly either on vacation or under repair.

Again, *please* read and *follow* the recommendations in 
<http://catb.org/esr/faqs/smart-questions.html>.
 
-- 
PointedEars
Zend Certified PHP Engineer 
<http://www.zend.com/en/yellow-pages/ZEND024953> | Twitter: @PointedEars2
Please do not cc me. / Bitte keine Kopien per E-Mail.

[toc] | [prev] | [next] | [standalone]

#17031

Adrienne Boswell <arbpen@yahoo.com> writes:
<snip>
> Here is the scenario.  A customer is at the checkout page of an online 
> store, example.com. They would put in their email address, credit card 
> information, etc., and hit send.

I'm assuming this is coursework or some self-study example?

> 1. The site, example.com, sends a post request to 
> https://aloyaltycard.com with the person's email address, their merchant 
> number and total amount of the transation.
> 2. aloyaltycard.com receives the information, does a quick check to 
> verify that the email address is on file and notes the transaction in its 
> db. (I already know how to do this part)
> 3. aloyaltycard.com sends back a verification to example.com that the 
> email address is good and 90% of the transaction amount. (This is where I 
> need help)

You don't ask a specific question so any reply is going to be largely
guesswork.

When a server gets a POST request (or, indeed, a GET request) it must
reply with a valid HTTP response.  This is a collection of headers
giving the nature of the response followed by (after an empty line) the
body of the response (if any).  For example, here is what comes back
from a server that been asked a question about olive oil:

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2016 11:41:18 GMT
Server: Apache/2.4.12 (Ubuntu)
Content-Length: 740
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: application/json

{"idtype":"fid_list","rows":[{"id":"1170038","name":"Olive oil",...

Note that the reply is not an HTML document but a JSON encoded object.
That's been flagged by setting "Content-Type: application/json".

You don't need to worry about most of the headers because PHP and the
server running it will take care of them, but you can set the content
type header and then reply in whatever format you like.  You could even
make up your own type and format, or you could use text/plain and send
back pretty much any kind of reply, provided the client making the
request (in this case another server) knows how to interpret it.

I won't say more in case this is not germane to what's causing the
problem.

> 4. Then example.com completes the tranaction on their end giving the user 
> a 10% discount, which should match up with the 90% aloyaltycard.com sent 
> back in the verification.

-- 
Ben.

[toc] | [prev] | [next] | [standalone]

#17040

On 09/08/2016 03:48 AM, Adrienne Boswell wrote:

> Here is the scenario.  A customer is at the checkout page of an online 
> store, example.com. They would put in their email address, credit card 
> information, etc., and hit send.
> 
> 1. The site, example.com, sends a post request to 
> https://aloyaltycard.com with the person's email address, their merchant 
> number and total amount of the transation.
> 2. aloyaltycard.com receives the information, does a quick check to 
> verify that the email address is on file and notes the transaction in its 
> db. (I already know how to do this part)
> 3. aloyaltycard.com sends back a verification to example.com that the 
> email address is good and 90% of the transaction amount. (This is where I 
> need help)
> 4. Then example.com completes the tranaction on their end giving the user 
> a 10% discount, which should match up with the 90% aloyaltycard.com sent 
> back in the verification.

With the extra information provided in other answers, I would go with a
soap service, as it's not too difficult to build and most programming
languages has support for it too, which makes the integration somewhat
easy to make.

There is no need to make callbacks to the customer site, as they will
get the answer at once.

It's simple to extend with new requests like adding a way for the
customer site to enlist new members.


There are good example at php.net how to write a simple soap service.


-- 

 //Aho

[toc] | [prev] | [next] | [standalone]

#17046

Adrienne Boswell wrote:

> I am coming here because I don't really even know what to google for, and
> I'm sure that many of you can do this with your eyes closed.  That's why
> I'm coming to the experts.
> 
> Here is the scenario. [specifications]
> 
> Thank you in advance for your time and assistance.

<http://catb.org/esr/faqs/smart-questions.html#classic>
<http://catb.org/esr/faqs/smart-questions.html#examples>

You’re welcome.

-- 
PointedEars
Zend Certified PHP Engineer 
<http://www.zend.com/en/yellow-pages/ZEND024953> | Twitter: @PointedEars2
Please do not cc me. / Bitte keine Kopien per E-Mail.

[toc] | [prev] | [next] | [standalone]

#17049

On 9/10/2016 3:04 AM, the known troll Thomas 'Pointed Head' Lahn wrote:
> Adrienne Boswell wrote:
> 
>> I am coming here because I don't really even know what to google for, and
>> I'm sure that many of you can do this with your eyes closed.  That's why
>> I'm coming to the experts.
>>
>> Here is the scenario. [specifications]
>>
>> Thank you in advance for your time and assistance.
> 
> <http://catb.org/esr/faqs/smart-questions.html#classic>
> <http://catb.org/esr/faqs/smart-questions.html#examples>
> 
> You’re welcome.
> 

The question was perfectly clear to everyone Pointed Head.

Don't worry about him.  He's just a pedantic troll who thinks he knows
something about programming - but has repeatedly proven all he can do is
cut and paste.

-- 
==================
Remove the "x" from my email address
Jerry Stuckle
jstucklex@attglobal.net
==================

[toc] | [prev] | [next] | [standalone]

Page 1 of 2  [1] 2  Next page →

Back to top | Article view | comp.lang.php

csiph-web