PCI Compliance Scanning & SAQ
Making compliance easy...

Sign up now and get your SAQ compliance certificate online quickly and easily for your merchant bank.	Sign up now for both the SAQ Compliance certificate and your PCI Scan Compliance certificate.

Our PCI Tools are from approved PCI scanning vendors and approved PCI Quality Security Assessors!

---

Stopping Browsers From Storing Credit Card Or Sensitive Data In Online Forms

---

Despite being PCI compliant there is another security issue you should be aware of if you are asking customers to place sensitive credit card data or other information into online forms.

Most modern browsers have a 'feature' which stores the details of data which has been placed into online forms and by simply pressing the down arrow one will be able to see previously placed details into such forms. Take this example:

Just place cursor in box and press the down arrow :

This data is stored in the browser and if anyone else has used your personal computer or if you have entered sensitive data into another computer which is shared by others then you have most likely placed them details into the public domain.

The PCI security council neglects this security flaw but you can easily ensure your online forms are secure from this potential security risk.

Sensitive card data such as credit card numbers, addresses, telephone numbers, CVV codes, login details should employ the autocomplete='off' tag.

In your forms you would use it like so:

<form name="form1" id="form1" method="post" autocomplete="off" action="http://www.example.com/form.cgi"> [...]

or

<input type='text' name='cardnumber' autocomplete='off'>

Unfortunately this overlooked security flaw is currently not included in the PCI DSS compliance regulations and any 'hacker' who knows how to use the arrow down key could obtain sensitive data using this technique.