Collecting payments with a form, safely
How to take payments through an online form without touching card data: hosted checkout, receipts, refunds and record keeping.
A payment form is two jobs in one: collect structured answers, then collect money against them. Keeping those jobs separate is what keeps you out of trouble.
Never let card details reach your form
Card fields belong on a hosted checkout page run by the payment processor. Your form collects the order details and hands off — so raw card data never touches your submission table.
Store the reference, not the instrument
Keep the payment reference, amount, currency and status alongside the submission. That is everything you need for reconciliation and nothing you would regret storing.
Send a receipt immediately
The confirmation email is part of the product. It should name what was bought, the amount, and who to contact — before anyone has to ask.
Plan the refund path first
Decide who can refund, and how the submission is annotated when they do. Retrofitting that after your first dispute is far more expensive.