Donation page that has sensitive hidden fields

I am a volunteer for a non profit helping with website stuff. I am a designer with html knowledge, but my programming experience is almost none so I am sorry if this is elemetary.

I have created an html form that visitors can use to donate money from a credit card. This posts directly to merchant one.

There are two items that are needed to authenticate our account included as hidden in the form. The form works great, posts the paym开发者_Python百科ent without an issue but there is a problem. I can view source and gain access to the hidden items, thus exsposing our account info to anyone who is curious enough to look.

I have done some searching, but my lack of programming is a problem. I understand I can use cURL to post items, but I don't know how to glue my html form to my hidden items before it is posted.

You need to have one hidden field for a session "key", and the rest just store not in hidden fields, but somewhere outside of HTML (e.g. a database) and relate it to the session key using the server-side code (PHP in this case). Otherwise, the user can see whatever you post.

What you want to do is put that sensitive info on the server side where the form gets processed and no one else can see it(i.e. as variables in your php script). The DOM is very easily viewed and edited by anyone that goes on that page.

If you're looking for a solution for this you may want to post some of your processing code(with obfuscated data of course) in another question. People here on SO will be able to help you find a way to keep your data secure.

If the payment system requires such hidden fields, well, they must be there so they can be sent to their server from the browser. There's no point in sending then from the server since they are used to identify who must receive the donation after the user types his credit card information in the bank's secure server.

Your bank account number is sensitive information. Your associate number is not.