Storing user data on a web server is a bad idea, just as storing unencrypted credit card information on your database is a bad idea. If you are doing online transactions you are best off trying to get a cc processor to do real time auth's for you and never storing anything more than a hash of the cc# or a first 4/last 4 span of the number for auditing/reporting purposes.

There is an excellent book on the subject of building an e-commerce system called: Designing Systems for Internet Commerce, Second Edition.

It runs you through everything you'll need to know.

Another book to check out is :Web Security, Privacy & Commerce, 2nd Edition by oreilly.