I am new to ubercart.org and have been reviewing the code from a security point of view.

My question is, why are you not using the built-in MySQL functions for cc data?

AES_ENCRYPT()
AES_DECRYPT()

These functions are easy to implement and use a proven algorithm. The passphrase can be stored in a file below the server root to improve security.

These functions will protect against hackers reading cc info after gaining database access through backups or SQL injection.

GPG is even stronger because it doesn't require a passphrase stored on the server, it is a little harder to implement but worth it IMHO.

I apologize if I am missing something obvious but I had to ask.

Regards,

Bob