Credit card processiing - Elavon Virtual Merchant

[alex.kolaric]

Hi Bruce,

I have to do integration with Elavon Virtual Merchant for credit card processing from our NetTalk web solution. Provided developer manual gives examples for posting payment like this:

<form action="https://www.myvirtualmerchant.com/VirtualMerchant/process.do" method="POST">
<input type="hidden" name="ssl_merchant_id" value="my_virtualmerchant_ID">
<input type="hidden" name="ssl_user_id" value="my_User_ID">
<input type="hidden" name="ssl_pin" value="my_PIN">
<input type="hidden" name="ssl_show_form" value="true">
<input type="hidden" name="ssl_test_mode" value="false">
<input type="hidden" name="ssl_invoice_number" value="Inv-123-ABC">
<input type="hidden" name="ssl_transaction_type" value="ccsale">
<input type="hidden" name="ssl_amount" value="31.01">
<input type="hidden" name="ssl_salestax" value="1.86">
<input type="submit" value="Click Here to Complete Your Order">
</form>

It is no problem to generate such a page from NetTalk. The issue I'm having is that they are suggesting that all sensitive data as merchant id and pin should be placed in server side code - not exposed to the end user in page source. Now I'm not sure how to achieve this in NetTalk.

Any suggestion?

thanks in advance,
Alex

[Mike Grigsby]

Hi Alex, Unless I'm missing something, the fact that the fields are "hidden" means they are not seen on the client. Hidden types are only used on the server. So the only thing that would appear on the client's browser is the Submit button, and they would not be able to see a hidden field.

[Bruce]

Hi Mike,

no, that is inaccurate. Hidden fields are not visible to the user in the browser window, but they are visible if you right-click in the browser and choose "source".

cheers
Bruce

[Bruce]

Hi Alex,

What I do in a situation like this is add a procedure to the server.
It contains the NetWebClient class.
From there you can do a POST (with a suitably formatted string *) to the Evalon server. This procedure gets a reply from the Evalon server, and sets session variables appropriately.

Since this connection is done from the server to their server, the client's machine is not in the loop.

So you have a normal web form, which the client fills out. Then in say the "Post Save" embed, you call the procedure created above. So the page you're going to can then show the result (ie either accepted or failed.)

* One way to see what the Post string should look like is to create the form, as above, but set the form action to just, say, "test". Then in the log on your server you'll be able to see the post string coming from the client.

Cheers
Bruce

[alex.kolaric]

Hi Bruce,

many thanks for your help.

best regards,
Alex

[Mike Grigsby]

Oops, sorry about that.