a friend of mine is making a project on airline reservation system through mobile here is the basic idea.

1. A customer open a web site and fills a registration form in which he gives his credit card info. and mobile with other info like name and address.
2. if the credit card info provided by that user is valid he is given a 3 digit PIN and his credit card info is saved in database of that site.
3.when he wants to make a reservation he has to send a sms to a pertivular number this SMS include 3 digit pin and details of flight and so on.

A perticular user can only make a reservation from his mobile number only(for security reasons).

the question is can a perticular web site store users credit card info in its database?
I mean is there any law about it?
If not then can that site claim to be secure ?
i mean if credit card information is stored in there database then they can't be secure can they?

And if i am right what changes can be made in this project?