My client, Peoples Choice, wants 3 forms in their website...3 different quote forms...auto, home, life. The auto form includes drivers license number, social security number, vin numbers, pretty personal info. The home isnt so much as personal i dont think, and then life insurance includes the person social. What do I need to do to make these forms secure? I havnt created them yet. I dont know much code other than html and css. A little php. Not enough i dont think to make anything major. Do I need ssl certificates?

SSL would be a good idea when you're dealing with information that, if hijacked, could be used quite easily for identity theft.

The question I would probably ask your client is why they require such information to provide quotes. I'm not sure I speak for everyone but if I was asking for a quote from an online provider and they required my drivers license/passport number social security (tax file in Australia) number or vin number I would probably not bother.

The next part to look at would be how the data is handled after the form is submitted. Most quote forms can get away with shooting the details off view email but for this sort of information, you will want to be storing the details either in a database or in some flat files off the web root that can only be accessed by authorised users.

An added benefit would be to encode the data prior to sending it (with javascript) before decoding it at the other end -- 128 bit SSL will do this as well but a bit of extra care doesn't hurt.

I agree.

Don't ask users to fill in unnecessary form fields, especially when the information is personal. Every extra burden on the user corresponds to fewer people submitting.

If you go to sites such as allstate or whatever you are required to enter you social as well.

What exactly does that prove? It's not hard to find examples of user-hostile design on the internet.

Of course, it's ultimately up to your client. They may have very good reasons for collecting this information, or they may not. Regardless, it's their decision; and as Rakuli said, you should really be using SSL if you are asking people to submit sensitive data.

That was my question in the first place, I emailed my client and asked them if it was necessary to have that information there...so im waiting for a reply. I told him if it is it will require a ssl certificate and I told him the cost. Would anyone be interested in making these forms for llttle or no cost?

Im not good at php and I just want to get this finished. Its been on me since june and I just want to get done. I have exactly what needs to be on the forms I just have to do it.