Sorry PHPdev, but that's just not true. The actual form can reside on any server, as long as the form action is set to the secure server URL. Since the client sends data directly to the form action, this is as secure as it gets. However, doing it this way means the user won't see the little secure lock in their browser until the form has been submitted, which some people don't like.
