If you are unable to obtain the locale setting on your server, and the listed locales do not work, you can modify the function in CWIncFunctions.php to hard-code the currency symbol like this:

// for CW3
function cartweaverMoney($theNum, $showCurrencySymbol = true, $stripComma = false) {
  $currencySymbol = '$';
  $theNum = number_format($theNum, 2, ".",",");
  if($showCurrencySymbol) $theNum = $currencySymbol . $theNum;
  if($stripComma) $theNum = str_replace(",","",$theNum);
return $theNum;
}

Some typical locales for US format are:

• en_US
• en_US.iso88591
• en_US.iso885915
• english-us
• eng

I also really like the writing style in this new version. This version has new contributing authors than the last two editions had and I find the resulting conversational style of the book much easier to read and follow, at least in volume one that is... I'll update you on volume two one I get into it.

Anyone using or thinking about using ColdFusion that hasn't gotten at least the first volume should! It will be a great introduction to ColdFusion to anyone wanting to learn about it, and a quick refresher and introduction to some of the new features to those that already are familiar with CF. Either way, it's money very well spent!

First let's look at the benefits of PayPal. It's quick and easy to set up an account and virtually anyone can do it. PayPal does not require a credit check, so even individuals with shall we say "less-than-perfect" credit history can take payments online. PayPal really is what it set out to be& the common Joe's way to make money transactions on the web.

There are some downsides to PayPal however. Some of the drawbacks are the same as the benefits in that just about anybody can get a PayPal account, regardless of who they are& even inmates have PayPal accounts! PayPal by its very nature has a more mom-n-pop feel to it. It's perceived by many as "less professional". PayPal used to have a bad reputation for security as well, although they have done an outstanding job of correcting this and most shoppers now trust PayPal itself, but there is an underlying concern about trusting the person on the other end of the transaction for the reason stated above. Another drawback is that, until recently a purchase through PayPal meant you had to divert the customer off to the PayPal site to complete the transaction. If a merchant wanted to have a more professional appearance and wanted to establish their own branding, this was a real problem. In an effort to overcome this drawback PayPal recently bought out Verisign, and released other products to overcome this problem& But there are some real caveats to the new offerings by PayPal, let's take a moment to look at them.

First there is PayFlow Pro -- formally Verisign PayFlow Pro. PayFlow Pro has been around a long long time. It was one of the very first real-time payment gateways. It has been and still is rock solid, secure, and fast. There a problem however, it's showing its age. Unlike pretty much all other real-time gateways, PayFlow Pro requires that your host support it, that is, install the PayFlow SDK on the server and provide you with the mapping to the "Certs" folder in order for you to be able to process transactions. When PayFlow was the only game in town, or at least one of the biggest players this was not a problem because no self-respecting host would dare not support it. This is no longer the case. As PayFlow Pro's market share continues to sip further and further into obscurity, fewer and fewer hosts bother to support it. This could end up being a real problem. If you do choose to use PayFlow Pro MAKE SURE your host supports it or is willing to do so. A client could get real grumpy if you told them when the site was almost ready to live that they had to switch hosts because their current host doesn't support the gateway you recommended& Ouch.

The folks at PayPal are no dummies; they saw this coming, so they developed another product confusingly calling it PayPal Website Payments Pro. On the surface this looks like a good solution, a processor capable of real-time transactions but still as easy to get as PayPal Standard -- formally PayPal IPN right? Wrong. First of all, the rules for getting a Website Payments Pro account are stricter, so it's not a come on come all situation, so that "advantage" is gone. Also, PayPal set up this system so it cannot be made transparent to your customer! Even if your customer doesn't have a PayPal account and just wants to check out using their credit card she is still presented with PayPal's branding and forced to choose to go through a PayPal account, or to sign up for one, or check out directly. From a marketing standpoint this stinks! You've just lost much of the advantage of a real-time gateway, that being that it is fast, transparent to the user, and allows you to promote YOUR branding to your customers. This system forces you to promote PayPal to your customers whether they choose to use it or not. I completely disagree with this approach! It really goes back to the "less professional" impression left by using PayPal.

Now there's the matter of bookkeeping. With PayPal you may have "instant access" to your money via a PayPal card, or to make purchases online and this may be fine for a little side business, but this is not how a real business operates. Accessing your money this way in a real business is a bookkeeper's nightmare and the kiss of death should you ever get audited! To properly track and account for gross revenue and to have a proper paper trail of funds to be able to calculate net profit or loss, all funds need to be deposited into a business account then dispersed from there. To do this with PayPal, you have to manually request the transfer and after doing so it can take four or more days for the funds to show up in your account. Having to manually request the transfer funds all the time can quickly become an enormous headache, and imagine the frustration of being late paying your bills because you forgot to request a transfer and now have to wait for the funds to move over to your bank account.

To briefly sum this up. PayPal is great for small sideline business or private individuals making money transactions on line. For this purpose it truly is the single best solution out there& period! Other solutions are entering the market but none have the position PayPal has. However, if you're setting your sites higher, or your venture has grown to the point where you want to be a more serious online business, then truthfully, PayPal, no matter which or their products you are considering, comes up short. If you want to run your online business like a business, want to have a more professional appearance and want to firmly establish your branding, then a transparent real-time gateway / merchant account solution is the way to go.

Which language should you choose?

If you are already acquainted with a language, then this is an easy choice, but if you are new to dynamic development, and are familiar with HTML and web design but not coding, my first recommendation would be ColdFusion due to the fact that it is easier to learn, being tag based similar to HTML rather than script based, and it is easier to install on your local system to have a local development environment. Is ColdFusion THE universal best choice for someone new to shopping cart, or dynamic web site development? No, what is best for you depends of you. Your experience and environment. If you have a helpful PHP wizard in the cubicle next to you, then PHP would obviously be a good choice. You may want to do a little research. Go to your local Barnes and Nobel grab a book on CF, PHP, ASP, ASP.Net and read through the first couple of chapters and see which one clicks.

Here are a couple of other good resources you should look at

http://www.adobe.com/devnet/dreamweaver/application_development.html
http://movielibrary.lynda.com/html/modPage.asp?ID=433
The first eight videos are free for the clicking and should give you a good overview.

There are two caveats to consider when choosing your development language...

1. If you already know VB (visual basic) or are already familiar with traditional ASP, then it may be a good choice. If you are new to dynamic development and you are choosing a platform for now and the future, ASP would probably not be a sound choice. Why? Microsoft has officially "pulled-the-plug" on ASP and is doing no further development and will not be releasing any upgrades or updates. They have also refused to release it to the open source community. Because of this, while ASP has a huge world-wide following and will be around for a long time to come it is eventually going to become obsolete and a dead language. If you already know ASP, and don't have the time or desire to learn a new language, then ASP should be fine for a long time to come, No sense intentionally driving down a dead end street, even if it is a long one.

2. If you use Adobe Dreamweaver as you web development tool, .Net is not a viable choice. Dreamweaver supports .Net 1 poorly and doesn't support .Net 2 + at all, and from what I've heard from reliable sources Adobe has no intension on changing this. So, unless you want to throw learning a whole new too set into the mix I'd say, for the dreamweaver user .Net is out of the mix.

So, which do you choose?

The important thing is... which server language you should use depends on you, not your current host. Do your research, make YOUR choice then dive in and have fun.

1. First, set up your Application.cfc with some settings (these would be from your cfapplication tag):

<cfcomponent>
<!--- Initialize the application --->
<cfscript>
this.name = "testCW"; // make sure every application has a unique name
this.applicationTimeout = createTimeSpan(7,0,0,0);
this.clientmanagement= "yes";
this.sessionmanagement = "yes";
this.sessiontimeout = createTimeSpan(0,0,30,0);
this.setClientCookies = "yes";
this.clientstorage="clientvariables"; // datasource for client variables
</cfscript>

2. Then, copy the <cfmodule> tag from your existing Application.cfm to your onRequestStart method.

<!--- On request start --->
<cffunction name="onRequestStart">
  <cfargument name="requestname" required=true/>
  <cfmodule
    id = "CW3GlobalSettings"
    template = "cw3/CWTags/CWTagGlobalSettings.cfm"
    datasource = "yourdatasource"
    etc..... >
</cffunction>

3. In the onError method, you'll have to create your own error handling to take the place of the error pages.

4. Rename OnRequestEnd.cfm at the store root to debugger.cfm and include this method in Application.cfc (if you want the debugging functionality of CW):

<cffunction name="onRequestEnd" output="true">
  <cfargument type="String" name="targetPage" required=true/>
  <cfinclude template="debugger.cfm">
</cffunction>

5. Include other methods, if needed (onSessionStart, onSessionEnd, etc).

6. Close the component tag:

</cfcomponent>

7. We include two files of frequently used functions in application.cfm because they are used thoughout the application, but that won't work in Application.cfc. Add these two include files to the rest of your presentation pages (results, details, confirmation, orderform, and showcart):

<cfinclude template="cw3/CWTags/CWIncFunctions.cfm">
<cfinclude template="cw3/CWTags/CWIncDiscountFunctions.cfm">

8. Then create an ApplicationProxy.cfc file at the store root with this in it:

<cfcomponent name="ApplicationProxy" extends="Application"></cfcomponent>

9. That is for the admin functionality, which will have it's own Application.cfc extending the site root Application.cfc. Put a new Application.cfc file at the root of /cw3/admin, including only the onRequestStart function:

<cfcomponent name="Application" extends="ApplicationProxy">
  <cffunction name="onRequestStart">
    <cfargument name="requestname" required=true/>
    <cfset super.onRequestStart(requestname)>
    <!--- Here, insert everything from the Application.cfm from the admin folder
         EXCEPT for the application.cfm include and the error handling ---->
  </cffunction>
</cfcomponent>

That should be all that is required. There can be further optimizations, however this should give you a working site.

Help your client think this trough.

The first thing I would say is, do all you possibly can to talk your client out of this decision. Your client may be wanting to eliminate the log-in feature to "make it easier" on the customer, or "save them some time" here are some points to consider. By not requiring a customer to log in you may be saving them the time it takes to decide on a username and password and fill in two form fields... in other words, you'll "save" them about fifteen seconds. But what if they like your store and your product and they decide to return and buy more... Rather than filling out two form fields and have the shopping cart remember who they are and pre-fill all the order form for them, they have to go through the whole process again. Your modification has now just cost your customer far more time that it ever saved them. And what if your customer would like to be able to see the status of an order? There is no way to uniquely identify them, so this option is no longer available.

Ask ANY retailer what one of their greatest assets is and they will say, "loyal repeat customers" by the seemingly harmless step of eliminating the log in feature you are putting roadblocks in front of these "assets". You are actually making doing business with you more difficult, not easier.

Now, let's step back and look at this from the merchant's point of view for a minute, with long-term profits in mind.

Eliminating the user log in feature will mean that every time a customer returns they will create a new customer record. As far a the database in considered they are different individuals every time. This ends up entering a LOT of duplicate "junk" data into your database. As stated before a business' biggest asset is a loyal, repeat customer base, but now you have no way to know for sure who those customers are. Say you decide to do a query to see who your most profitable customers are based on frequency and dollar amounts of past purchases... All you customer have only purchased once as far as the database is concerned. True you can do some SQL tricks to narrow down your results, but it will always just be a best guess situation. Now what if you know that a customer who bought one product would be interested in a new product you are offering, and you'd like to pull an email list and send them a invitation to look at it and offer them an introductory discount... No can do, or it will be difficult to do so.
If loyal customers are one of a business' greatest assets, then an accurate record of who those customers are is even more important. Taking what would seem to be a simple and harmless step, and eliminating the requirement of a username and password, will have a long reaching, serious impact on your client's on-line business.

Developer and consultant!

Our roll as eCommerce web developers is not just to create the shopping cart web site, but to do all we can to help our clients be successful. Sometime this includes consulting with them to keep them from making a mistake.

Now, after all this, your client still wants to eliminate the requirement of a username and password let them know that this impacts the database, a number of function files, and presentation files in the application and it will take a few hours and $X (you fill in the X - and make it a good number!) to make this change... Some times a client will make the right decision if only to try to save some money.

Whatever approach works, keep in mind, persuading your client that it is theirs and their customers best interest to keep the log in functionality in place. You'll be doing them a good service by doing so.

Good Sales!

The class is typically used on a page by itself, or on any page within conditional statements. You link to the page and the file download begins. The class constructor has 3 arguments:

$csvfile = new CSVFile(recordsetName, [quotes true or false], [filename]);

The first is the MySQL recordset. The second optional argument is true or false to put quotes around the fields. The third optional argument is the filename, which defaults to Download.csv by default.

To use it, follow these instructions:

1. If this is a Cartweaver recordset, make sure you include the application.php file at the top of the page:

require_once("application.php");

2. Include the class file:

require_once("yourclassdirectory/CSVFile.php");

3. Create your recordset. Below is a typical Dreamweaver recordset, using the Northwind database that you can download here for MySQL if you don't have it:

mysql_select_db($database_connNorthwind, $connNorthwind);
$query_rs = "SELECT p.ProductID, p.ProductName, p.UnitPrice FROM products p ORDER BY p.ProductID";
$rs = mysql_query($query_limit_rs, $connNorthwind) or die(mysql_error());

For Cartweaver, a typical recordset might look like this:

$query_rs = "SELECT * FROM tbl_orders ORDER BY order_Date";
$rs = $cartweaver->db->executeQuery($query_rs, "rs");

4. Add a line to invoke the CSVFile class:

$csvfile = new CSVFile($rs, true);

5. Link to the file.

Now, when the page is browsed, the file download will begin immediately.

Cross-posted from tom-muck.com. See this blog post for info on creating a button in the CW admin for order downloads.

The functionality revolves around a custom tag I wrote a while back called CF_CSVFILE. You can find it available free on my blog:

http://www.tom-muck.com/blog/index.cfm?newsid=46

I'll go through a simple example using the Cartweaver orders page. The basic technique to using this tag within CW (or any other application) is to create a <cfquery> tag using the data you want to download, put the csvfile tag on the page, and then simply link to the page. We can do this with dynamic queries as well -- the orders page uses form fields to create the display list. We can simply divert this form to a new OrdersDownload.cfm page by following these steps:

1. Create a file called OrdersDownload.cfm. It should be totally blank -- no tags or any other characters in the file.

2. Save the csvfile.cfm tag from my blog to a directory within /cw3/admin called "tags".

3. Add this code to the top of the OrdersDownload.cfm file:

<cfimport prefix="mytag" taglib="tags">

4. Copy the rsByDate query from the Orders.cfm page to the OrdersDownload.cfm page.

5. Add the reference to the csvfile custom tag to the OrdersDownload page beneath the query:

<mytag:csvfile rs=#rsByDate#>

6. Add a new button to the Orders.cfm page next to the submit button that is already there to create a link to the new form post:

<input name="Submit2" type="submit" class="formButton" value="Download Orders"   onclick="document.DateForm.action='OrdersDownload.cfm'">

That's all there is to it. It looks more complicated than it is, and can be used with any query. For example, to create a downloadable list of all customers, create the CustomersDownload page with this code:

<cfimport prefix="mytag" taglib="tags">
<!--- retrieve all customers --->
<cfquery name="rsCustomers" datasource="#request.dsn#">
SELECT * FROM tbl_customers
</cfquery>
<mytag:csvfile rs=#rsCustomers#>

Then simply link to it. Since you are getting all customers, you don't need the submit button or extra javascript -- a simple link will do.

To make things easier, there are a lot of pre-developed shopping cart applications designed to help you on your way to developing an ecommerce web site, but no matter how easy the application you choose, or which one you chose there is a basic starting point you must get to before you can even begin using an shopping cart software application such as Cartweaver. The ability to develop an ecommerce web site has become a must-have in your bag of tricks these days so save yourself the stress and panic and decide to take the tackle the firs pert of the learning curve right now, before you have you back up against a dead line.

To develop any dynamic web site be it a full blown ecommerce site or a simple "hello world" example you need to do the following: Install, set up and test a local dynamic development environment. This will consist of the following&

1. Installing a web server, such as IIS, Apache, JRun or one of the many others available.
2. Install an application server, such as ASP, PHP. ColdFusion or .Net
3. Install and become a little familiar with a database such as Access, MySQL, SQL Server
4. Install and become familiar with a GUI database administration tool for your database of choice.
5. Finally, after having your web server, application server and database installed and set up, you should successfully set up a data source name to connect your database and application server, and run a simple script such as the following example (this one in ColdFusion).
   
   <cfset Variables.Greeting = "Hello World!">
   <cfoutput># Variables.Greeting#</cfoutput>
   
   If you place this code on a page and save it with a .cfm extension and brows to it and see - Hello World! - you know your set up and ready to start.

I realize that this blog post raises far more questions than it answers& It's meant to. Read this over and ask yourself; "do I know what the heck he's talking about?" If you do, good, your well on your way, if not here's where you need to start. I can honestly say that Cartweaver, makes developing a functioning shopping cart web site about as easy as it can be, and there are other applications by other vendors that do an admirable job as well, but the ground floor for all these applications is the same, that being the completion of the five steps outlined above.

I can't tell you how many times a web designer fires in a barrage of panic stricken support emails because they have promised a client to have a their shopping cart web site done in a week or two, having NEVER done a dynamic web site or having ever learned to set up a dynamic development / testing environment. These situations are always stressful and far too many times don't end well for the designer or their client. Sometimes, with perseverance, on the part of our support staff, but mostly on the part of the designer and their client, things work out and all ends well. We have a number of developers that stared out this way and over the years have come to be friends and colleagues... You know who you are :-) But, for your own peace of mind and for your client's, take the time to learn and complete the five steps outlined above before you even buy a shopping cart application and especially before you make any promises or set any deadlines with a client. If you take the time and effort necessary to set up and test a local development / testing environment and familiarize yourself with the applications and tools necessary to do so, you will be much more prepared to begin developing dynamic ecommerce web sites. The great part of doing this is, having gotten this far, the hard part is behind you. After this you will be pleasantly surprised how easy the actual installation and integration of the shopping cart software can be. You'll also be much happier at how calm and professional you appear to your client. Face it; no client enjoys seeing the old "deer in the head lights" look in their web developers eyes about a week into a project. Avoid this by taking time to learn and complete the five steps I've outlined... You'll be glad you did.

For additional information and training material be sure to check out the Adobe Developers Network. Lynda.com is also a great resource for training; take a look at the following titles to get an idea of what they offer.

http://movielibrary.lynda.com/html/modPage.asp?ID=433
http://movielibrary.lynda.com/html/modPage.asp?ID=265

Although Lynda.com is a paid subscription site the first few movies in each course are free, so it's easy to see if you like the way the information is presented.

WHAT IS IT?
The Web Pro Community Challenge (http://www.webprochallenge.org) is an opportunity for industry professionals to give something back to the community by designing, developing and promoting a fully functional web site and/or web application for a designated non-profit organization.

The idea is very similar to the Flex CodeJam that was run as part of 360Flex - Seattle, where a group of developers got together for a code-a-thon to build an application for a non-profit organization (more info at: http://www.flexcodejam.org/).

WHO ARE WE SUPPORTING?
The Challenge is supporting two charities: Say Yes to Green; http://sayyestogreen.org/ and Direct Relief International, http://www.directrelief.org/.

The SayYesToGreen.org initiative Statement of Work surrounds a complete makeover that includes elements of Web site design, development and business. The SayYesToGreen.org initiative is an international effort to educate the population about energy saving tips and resources.

The Direct Relief International's Statement of Work surrounds a Flex Based Multimedia Annual Report which will be used within their website. Since 1948, Direct Relief International has worked to improve the quality of life for people in need. Direct Relief provides medical assistance to improve the quality of life for people victimized by poverty, disaster, and civil unrest at home and throughout the world.
According to Charity Navigator (http://www.charitynavigator.org/index.cfm?bay=search.summary&orgid=3626) this charity is rated 4 out of 4 stars, and your contribution in time will help this charity grow in the future.

HOW TO GET INVOLVED
Grab a couple of friends or co-workers and join other web professionals in giving something back by signing up your team of 3 to participate at http://www.webprochallenge.org/enter-now.html Also, feel free to take a tour of the challenge web site (http://www.webprochallenge.org) for more information

If you keep in mind that the shipping function returns the shipping cost, you can use logic to determine the cost. The function is dual purpose, however. If the mode "ShipList" is passed to the function, it returns a list of shipping functions. If the mode "Calculate" is passed, the return value will be the shipping cost. So you must check first for the mode and then return the shipping cost if the mode is "Calculate".

For UPS/FedEx, you would need a script to contact UPS/FedEx, and an account with them. Modify the getShippingRates() function to use the script:

// If not listing ship methods, call your UPS function
if($mode == "Calculate") return getMyUPSFunction();

For simpler shipping, first make sure you have set up a shipping method in the CW admin, then simply re-write the function to use your simpler shipping, such as:

// If not listing ship methods, return $4 for shipping cost
if($mode == "Calculate") return 4;

For conditional shipping, simply add a line in the function before any other calculations are made:

// If over $100, return 0 for shipping
if($mode == "Calculate" && $cartTotal > 100) return 0;

You could also create your own custom function here to use your own criteria for shipping.

The bottom line is that CW shipping is flexible, but it is also easily changed if you need something different.

Update (11/12/2007): Another simple modification is to charge X$ for each item in the cart, like $3 shipping for 4 items would be $12. Basically you need to pass a quantity to the function and rewrite the function so that it multiplies $3 x number of items. Add a quantity field at the end of the method:

function getShippingRates($mode="ShipList", $shipType=null, $shipToCountryID=0, $cartWeight=0, $cartTotal=0, $qty=0)

Then add a line as first line of the function:

if($mode == "Calculate") return $qty * 3;

Then change the calls to getShippingRates() to pass the cart quantity to the function on CWIncShowCartSetup.php.

$_SESSION["shipTotal"] = getShippingRates("Calculate", null, 0, 0, 0, $cartweaver->getCartQty());

First of all, go to http://www.pcicomplianceguide.org/ and become more familiar with what PCI is and what you can do to better secure your online business. Next, if you have a Cartweaver site or any shopping cart site for that matter, what should you do? Let's take a look at what is required to have a "PCI secure site" and briefly discuss what can be done to see if your site measures up.

The following requirements are taken directly from http://www.pcicomplianceguide.org/pci-basics.html -- let's look at these one at a time and see how Cartweaver addresses the issues it can, and what steps you need should take to better secure your online store.
..................................
Build and Maintain a Secure Network
Requirement 1: Install and maintain a firewall configuration to protect cardholder data

• This is in your court as a developer. If using an Access database, make sure that it is stored in a safe non-brows-able folder, if you are using a SQL Server or MySQL database; be sure your host has it properly secured.

Requirement 2: Do not use vendor-supplied defaults for system passwords and other security parameters

• Yes! By all means change all default usernames and passwords and be sure you use something that is sufficient to ward off hack attempts. A good mix of numeric and alphanumeric characters and at least 8 to ten characters in length will be good and change them occasionally to be sure they don't get compromised.

Protect Cardholder Data
Requirement 3: Protect stored cardholder data

• Cartweaver NEVER stores this data -- it is handed off to the payment gateway and then promptly "forgotten". No matter what your client may say, never be persuaded to alter your site to store the credit card type, number, expiration date, or security code... Ever! Just don't go there. Truthfully, in a shared host environment there is no way to store this data securely. Treat it like the hot potato it is and hand it off as quickly as possible and be free of it.

Requirement 4: Encrypt transmission of cardholder data across open, public networks

• Yes -- by all means get an SSL Certificate and have it properly installed in the root directory of your site. Resist the temptation to use the host's shared SSL if they offer one, get your own 124 bit encryption certificate and have it installed before your first transaction.

Maintain a Vulnerability Management Program
Requirement 5: Use and regularly update anti-virus software
Requirement 6: Develop and maintain secure systems and applications

• This would be the responsibility of your host. Have in-depth, frank discussions with your host to 1. Know what steps they take in this regard and 2. Make sure they continually monitor and maintain security. If they don't provide clear and detailed information about this issue, or get annoyed with your insistence of getting this information... change hosts!

Implement Strong Access Control Measures
Requirement 7: Restrict access to cardholder data by business need-to-know

• Again, Cartweaver does not store this data.

Requirement 8: Assign a unique ID to each person with computer access

• Cartweaver does this by allowing you to create individual admin accounts. Be sure your host does the same. Again risk is greatly minimized by the fact that credit card data is not stored. The with the exception of the email address, the data in your Cartweaver customer database is no more than what is freely accessible in the local telephone directory.

Requirement 9: Restrict physical access to cardholder data

• Once again -- this is not stored. If you choose a reputable payment gateway this data is secure. Neither you the developer, your employees, the merchant, nor their employees have any access to this data. You can't steal or tamper with something you don't have.

Regularly Monitor and Test Networks
Requirement 10: Track and monitor all access to network resources and cardholder data
Requirement 11: Regularly test security systems and processes

• The credit card data is not stored, and with the SSL encryption it is securely transferred to your payment gateway -- that takes care of it from the application and your standpoint... Just be sure to use a qualified, reputable payment gateway and host.

Maintain an Information Security Policy
Requirement 12: Maintain a policy that addresses information security

• Be proactive! Your application (Cartweaver) is secure provided your database is adequately secured and you have SSL in place and your usernames and passwords properly set. Beyond that, talk frankly with your host and payment gateway provider to be sure their end is taken care of.

Being able to do business on line safely and securely is the right of every person that chooses to spend their hard earned money online. Internet shoppers are showing a lot a trust when they make a purchase online. It is the responsibility of every online merchant, web application developer, web site developer and designer to do all they can to fulfill that trust by providing a safe, secure "place" to do business. I encourage you to take the time out from your day to day activities and focus on making sure your site meets the PCI standards. You and your customers will be glad you did.

For example, to add an image type of "Secondary", follow these steps:

1. Add "Secondary" to the tbl_listimgtypes table and then note it's ID. It is probably 5. You can do this in any database admin, or run an insert statement like this:

INSERT INTO tbl_list_imagetypes (imgType_Name, imgType_SortOrder, imgType_Folder) VALUES
('Secondary', 1, 'cw3/assets/product_secondary/')

2. Create the product_secondary folder in the /cw3/assets/ directory (or whereever you are storing images).

3. Display it on the details page with:

<?php echo(cwDisplayImage($productId, 5, $row_rsCWGetProduct["product_Name"], "No image available"));?>

...for php, or:

<cfoutput>#cwDisplayImage(request.Product_ID, 5, rsGetProduct.product_Name, "No image available")#</cfoutput>

...for ColdFusion, or:

<%= cwDisplayImage(rsCWGetProduct("product_ID"), 5, rsCWGetProduct("product_Name"), "No image available") %>

...for ASP.

The function cwDisplayImage takes the following arguments:

cwDisplayImage([product id], [image type], [product name, or alt text], [to display if no image available])

After adding the new image type to the database, it will show up among the images to be uploaded in the Cartweaver admin. You can have an unlimited number of images per product.