如何不让信息保存到数据库-ASP.NET MVC

Question

如何在不将这些详细信息保存到数据库的情况下验证信用卡详细信息服务器端（在下面的创建函数中）并可能向其收费。

创建 ActionResult

public ActionResult Create()
{
    var model = new Payment();
    model.ValidFrom = DateTime.Now;
    return View(new Payment());

}

// POST: Payments/Create


[HttpPost]
        [ValidateAntiForgeryToken]
        public ActionResult Create([Bind(Include = "ID,CardName,CardNumber,ValidFrom,Expires,CardSecurityCode,EmailAddress,ConfrimEmailAddress,Address,City,Country,PostCode")]  PaymentViewModel paymentViewModel ,Payment payment)
        {
            if (ModelState.IsValid)
            {
                payment = new Payment();
                payment.EmailAddress = paymentViewModel.EmailAddress;
                payment.ConfrimEmailAddress = paymentViewModel.ConfirmEmailAddress;
                payment.Address = paymentViewModel.Address;
                payment.City = paymentViewModel.City;
                payment.Country = paymentViewModel.Country;
                payment.PostCode = paymentViewModel.PostCode;
                db.Payments.Add(payment);
                db.SaveChanges();
                return RedirectToAction("Details", "Payments", new { id = payment.ID });
            }

            return View(paymentViewModel);
        }

型号

public class Payment
{

    public int ID { get; set; }
    [RegularExpression(@"^[a-zA-Z]+$", ErrorMessage = "Use letters only please")]

    public string CardName { get; set; }
    // ------------------------------Visa Card ---------------------------------------------//
    [RegularExpression(@"^(?:4[0-9]{12}(?:[0-9]{3})?|5[1-5][0-9]{14}|6(?:011|5[0-9][0-9])[0-9]{12}|3[47][0-9]{13}|3(?:0[0-5]|[68][0-9])[0-9]{11}|(?:2131|1800|35\d{3})\d{11})|(4903|4905|4911|4936|6333|6759)[0-9]{12}|(4903|4905|4911|4936|6333|6759)[0-9]{14}|(4903|4905|4911|4936|6333|6759)[0-9]{15}|564182[0-9]{10}|564182[0-9]{12}|564182[0-9]{13}|633110[0-9]{10}|633110[0-9]{12}|633110[0-9]{13}$", ErrorMessage = "Invalid Card Number You Paki")]


    public string CardNumber { get; set; }
    [Display(Name = "Valid From"), DataType(DataType.Date) DisplayFormat(DataFormatString = "{0:MM}")]
    public DateTime ValidFrom { get; set; }
    [Display(Name = "Valid From"), DataType(DataType.Date) DisplayFormat(DataFormatString = "{0:MM}")]
    public DateTime Expires { get; set; }
    public string CardSecurityCode { get; set; }

    [Required]
    [EmailAddress]
    public string EmailAddress { get; set; }
    [Compare("EmailAddress", ErrorMessage = "The email and confirmation email do not match.")]

    public string ConfrimEmailAddress { get; set; }
    [RegularExpression(@"([a-zA-Z0-9\s]+)", ErrorMessage = "Invalid Address")]

    public string Address { get; set; }
    [RegularExpression(@"^[a-zA-Z]+$", ErrorMessage = "Use letters only please")]
    public string City { get; set; }
    [RegularExpression(@"^[a-zA-Z]+$", ErrorMessage = "Use letters only please")]
    public string Country { get; set; }
    [RegularExpression(@"\b\d{5}(?:-\d{4})?\b+", ErrorMessage = "Invalid postcode")]
    public string PostCode { get; set; }
}

public class PaymentDBContext : DbContext //controls information in database 
{
    public DbSet<Payment> Payments { get; set; } //creates a donation database

    public System.Data.Entity.DbSet<CharitySite.Models.Charity> Charities { get; set; }
}

我需要能够检索信用卡号而不将它们存储在数据库中。我们最初的想法是使用 Javascript 验证信用卡详细信息客户端，但项目要求要求执行服务器端验证。

Answer 1

如果您只需要保存部分信息，而将其余信息仅用于验证目的（例如，验证信用卡号码），那么您必须使用包含表单上请求的所有信息的 ViewModel，并从 ViewModel 中仅提取您需要保存的信息：

视图模型：

public class PaymentViewModel
{

    public int ID { get; set; }
    [RegularExpression(@"^[a-zA-Z]+$", ErrorMessage = "Use letters only please")]

    public string CardName { get; set; }
    // ------------------------------Visa Card ---------------------------------------------//
    [RegularExpression(@"^(?:4[0-9]{12}(?:[0-9]{3})?|5[1-5][0-9]{14}|6(?:011|5[0-9][0-9])[0-9]{12}|3[47][0-9]{13}|3(?:0[0-5]|[68][0-9])[0-9]{11}|(?:2131|1800|35\d{3})\d{11})|(4903|4905|4911|4936|6333|6759)[0-9]{12}|(4903|4905|4911|4936|6333|6759)[0-9]{14}|(4903|4905|4911|4936|6333|6759)[0-9]{15}|564182[0-9]{10}|564182[0-9]{12}|564182[0-9]{13}|633110[0-9]{10}|633110[0-9]{12}|633110[0-9]{13}$", ErrorMessage = "Invalid Card Number You Paki")]


    public string CardNumber { get; set; }
    [Display(Name = "Valid From"), DataType(DataType.Date) DisplayFormat(DataFormatString = "{0:MM}")]
    public DateTime ValidFrom { get; set; }
    [Display(Name = "Valid From"), DataType(DataType.Date) DisplayFormat(DataFormatString = "{0:MM}")]
    public DateTime Expires { get; set; }
    public string CardSecurityCode { get; set; }

    [Required]
    [EmailAddress]
    public string EmailAddress { get; set; }
    [Compare("EmailAddress", ErrorMessage = "The email and confirmation email do not match.")]

    public string ConfrimEmailAddress { get; set; }
    [RegularExpression(@"([a-zA-Z0-9\s]+)", ErrorMessage = "Invalid Address")]

    public string Address { get; set; }
    [RegularExpression(@"^[a-zA-Z]+$", ErrorMessage = "Use letters only please")]
    public string City { get; set; }
    [RegularExpression(@"^[a-zA-Z]+$", ErrorMessage = "Use letters only please")]
    public string Country { get; set; }
    [RegularExpression(@"\b\d{5}(?:-\d{4})?\b+", ErrorMessage = "Invalid postcode")]
    public string PostCode { get; set; }
}

模型（仅包含要保存的字段）：

public class Payment
{

    public int ID { get; set; }

    [Required]
    [EmailAddress]
    public string EmailAddress { get; set; }
    [Compare("EmailAddress", ErrorMessage = "The email and confirmation email do not match.")]

    public string ConfrimEmailAddress { get; set; }
    [RegularExpression(@"([a-zA-Z0-9\s]+)", ErrorMessage = "Invalid Address")]

    public string Address { get; set; }
    [RegularExpression(@"^[a-zA-Z]+$", ErrorMessage = "Use letters only please")]
    public string City { get; set; }
    [RegularExpression(@"^[a-zA-Z]+$", ErrorMessage = "Use letters only please")]
    public string Country { get; set; }
    [RegularExpression(@"\b\d{5}(?:-\d{4})?\b+", ErrorMessage = "Invalid postcode")]
    public string PostCode { get; set; }
}

public class PaymentDBContext : DbContext //controls information in database 
    {
        public DbSet<Payment> Payments { get; set; } //creates a donation database

        public System.Data.Entity.DbSet<CharitySite.Models.Charity> Charities { get; set; }
    }

创建动作：

    [HttpPost]
    [ValidateAntiForgeryToken]
    public ActionResult Create(PaymentViewModel paymentViewModel)
    {
        if (ModelState.IsValid)
        {
            // Some validation on credit card before save payment...

            // Save payment
            payment = new Payment();
            payment.EmailAddress = paymentViewModel.EmailAddress;
            payment.ConfirmEmailAddress = paymentViewModel.ConfirmEmailAddress;
            payment.Address = paymentViewModel.Address;
            payment.City = paymentViewModel.City;
            payment.Country = paymentViewModel.Country
            payment.PostCode = paymentViewModel.PostCode;
            db.Payments.Add(payment);
            db.SaveChanges();
            return RedirectToAction("Details", "Payments", new { id = payment.ID });
        }

        return View(paymentViewModel);
    }

并更改视图中使用的模型：

@model [yourNameSpace].paymentViewModel

Answer 2

据我所知，没有法律禁止您存储信用卡详细信息。尽管您实施的某些方面可能无法满足 PCI 合规性要求。例如，您可以存储信用卡号和到期日期，但必须采用加密形式，您可以绝不以任何形式存储 CCV。

无论哪种方式，除非您有丰富的经验和合规预算，否则不建议您承担存储 CC 编号的责任。我真正能看到的唯一优势是消费者无需重复输入细节的便利。大多数支付处理器应该允许您将详细信息传递给他们以进行收费。如果您选择这种方法，您可能需要查看SecureString class 的使用情况，这将允许您在将详细信息传输到处理器后立即处理它们。