Without an SSL certificate any info sent from client to server via an HTML-based form is sent to the server in plain text. Even info in 'password' text boxes (the ones that replace the text with stars) is sent to the server in plain text. The only advantage password boxes have is that they show stars instead of text so that someone else watching you type cant find out your password.
It is possible that (using a packet sniffer) usernames/passwords/other info can be intercepted.
What SSL does is it encrypts the data so that it's not in plain text and so anyone 'listening in' would only get garbled info NOT the user's username/password/CC#/SS#/etc.
IMHO any site that deals with sensitive info such as Credit card info, social security numbers or the such nees to have an SSL certificate. No one in their right mind would submit that info via a non-encrypted form.
Long story short - if you're planning on handling credit card transactions purchase the SSL certificate.
