I don't understand why you need to store the credit card number.
OPTION 1
I think you're trying to use it to identify the transaction? If that's the case, you probably don't need to store the full number. How about storing the first and last four digits? For two cards to share that info is rare enough for it to probably be useful enough for you to use. But it's not enough info for someone to be able to reconstruct the whole number.
OPTION 2
If you absolutely, positively have to store the whole credit card number (and, trust me, if you do, you're solving the wrong problem), then you're taking a lot of responsibility on your shoulders.
If you only want to use the CC number as some sort of identifier, then use a strong one-way encryption algorithm and only store / search for the encrypted version. of course even this isn't great as a hacker could gain access to your site, take a copy of the encrupted numbers and try cracking them at his leisure.
OPTION 3
If you want to be able to extract the CC numbers, then you're in a whole new level of responsibility. I've only ever dealt with that situation once. In that case, a strong public/private key system was used over multiple servers. The web server encrypted the credit card details using a public key and passed them over a secure connection, through a firewall, to a separate secure server which had no publicly accessible ports.
To extract the CC number, you needed access to the secure server and knowledge of the private key. Knowledge of the private key was only available after a challenge response.
In that case, to extract the CC number a hacker on the web would need to compromise the web server, compromise the firewall between the web server and the secure server, compromise the secure server and crack a challenge response system. All without being detected.
Of course each of the above options would require you to keep all server software bang up to date with patches so that you're not running with any known vulnerabilities.
Also, once you store cc numbers, you need to bulletproof any forms on your site to make sure that people can't inject SQL to compromise your database.
Do you feel lucky??
