monkey with rental cars - integration into third party websites, - php

Question

So,
I run a rental car company, and I want to integrate my service into a third party website - where people will be able to rent cars directly on the third party website. How can I integrate my service on the third party website efficiently? I am thinking that an iframe might be the best way or some sort of javascript call ... but I need the best way to integrate my service so that the third party site has to do less coding as possible.
I want people to check a box on the third party website if they want to rent a car and then a form pops up asking the customer for their payment details, then that information gets sent to my site, and my site processes that information and confirms the payment.
So basically, I was envisioning,
Person clicks a checkbox on third party site
Third party site sends information about the person to my site
I use that information to send back a payment box with price details
Person submits payment information on third party site
My site gets the payment information and processes the information
My site sends back status response to third party site.
The problem is, if the customer is a repeat customer, I would like the third party site to send me identifying information about the customer that will allow me to discern that she is a repeat- and thus charge her without her having to put her credit card details in the payment box.

Answer 1

In cases like this, its a lot more affordable, and sometimes more efficient to build a white label version of your product thats hosted on the same service as your primary product. This way all the functionality is essentially the same, except your slapping someone else's name on it and saying its powered by your company somewhere.
One key reason I suggest this is site to site transactions leave a lot of moving parts that can be tripped up through malicious means.
Take paypal for example, when ever you pay by paypal, what happens? You click the paypal button on the third party site, and it redirects you to the paypal site itself. You can do similar, you tell your 3rd party to submit a form like they would on any other site, and that posted data what little there will be as you want it all confirmable on your side so it leaves the door a little more closed to prevent someone from just changing the price or something. Anyway you take that posted data run it through your filters, compare it to whatever offers your allowing your 3rd party to do, and then process it all on your side. then when all is complete, you turn around and redirect back to there site and a thank you page.
Just food for thought

Answer 2

If you are going to implement a security so a hacker can't bog down your database with false orders use a shared secret key with which you encrypt the posted data to a hash, and then compare it on your side.
For example
$data = "color=blue|type=mazda|days=3|clientID=john#doe.com|etc=somedata";
$secretkey = "213098snxlkds_ljlsk3545";
$hash = hash('sha256',$data.$secretkey);
echo '<form target="someiframe" target="http://www.domain.com/bla/die/bla">
<input type="hidden" value="'.$data.'" name="data">
<input type="hidden" value="'.$hash.'" name="hash">
<input type="submit" value="Order the car Now!">';
Then at your side where you recieve the data you use this code
$secretkey = "213098snxlkds_ljlsk3545";
if(hash('sha256',$_POST['data'].$secretkey) === $_POST['hash'])
{
$process = explode('|',$_POST['data']);
foreach($process as $piece)
{
$vars = explode('=',$piece);
$Data[$vars[0]] = $vars[1];
}
}
This way if only you and your retailer have the hash, you can always verify that the retailer is legit and not some cheapchate trying to bog you down.

Answer 3

Having your service on third party sites means those sites are going to have to communicate with your app/site. On top of that, you want the users to be able to pay on the third party sites too, so you will be sending sensitive data back and forth. For that reason, I suggest you first get/integrate SSL.
Once you have that, you need to setup your own API. I know it probably sounds like a huge task, but it's actually not if you don't require much data and validation (returning loads of error codes and stuff).
So a quick example:
Let's say I have a website that people can login/register to. But I want users to be able to register to my site, on a third party site (like you want users to purchase goods from yours).
What I do here, is:
Create a basic script that will listen for any requests that third party sites will call. We shall call this one api.php:
//so we listen for POST params to be sent. These params will have users details stored in them
//so first check if all required params were sent:
if ( !isset($_POST['firstName']) || !isset($_POST['lastName']) || !isset($_POST['email']) )
{
exit();//because some/all of the required data is missing, we're going to stop right here xD
}//end of required data missing
//so if we get to this point, we know that the correct params have arrived
//so now you can do your registration stuff
//validate data (check if email is correct, if its been used before, ect ect)
//throw the data in the DB
//and if you need to, return some JSON status code
echo json_encode(array('status'=>'OK'));
That right there is an API. Very basic but still an API. So now you just tell the third party sites to post their info to "https://yousite.com/api.php" and it will return a status code, and the registration is completed.
I know that's not a very good example, but I hope you have managed to get the point.
Actually, most websites do this anyway. Even without the use of third party sites. When users register to a website, their data gets posted to some page. So I guess you could just POST data to your original signup/purchase/login page..

Answer 4

There are many different ways that you could approach this, but I think the simplest might be to have a simple JavaScript API that the third-party integrator can use on their website. Your JavaScript can set up the checkbox (for instance, attached to a div or form that the integrator specifies) and rig it so that when the user checks the box it opens a popup pointed at your site. You can then process your transaction from within the `popup.
This would be fairly comparable to how a basic Paypal integration works, where a user throws a Paypal button onto their site, and then when the button is clicked it opens a new window that points directly to Paypal's site (because as a general rule they cannot collect/accept payment or identity information directly from the third-party website) and passes a handful of parameters describing the transaction (payment amount, recipient, item details, etc.).
So for instance, a third-party might integrate with your service by first including your JavaScript file, like:
<script type="text/javascript" src="http://carmonkey.com/api/v1/MonkeyCar.js" />
...and then they might add some boilerplate code to hook up the API to the desired portion of their site:
<script type="text/javascript">
var options = {"container": "#someDivId", "userFirstName": "John",
"userLastName": "Smith", "rentalDate":"8/8/12", "duration":"7"};
MonkeyCar.drive(options);
</script>
Then your script needs to take those options and use them to add your checkbox to the target container element, and to configure the checkbox so that when the user click it a popup window opens to the appropriate URL on your website. So you might add something like:
<input type="checkbox" name="_monkeyCar" value="true"
onchange="if (this.checked) {MonkeyCar.open('http://carmonkey.com/reserve?fname=John&lname=smith&...');}" />
Book a Rental Car
Then once that happens the user can complete their rental car booking as normal, since the popup is just running a normal browser session with your standard website.
If you wanted to get fancy you could also add-in a feedback loop so that the JavaScript API running on the third-party page can get updates about the transaction status and detect when a transaction completes/is canceled and update the hosting page with the status.