DON’T DO IT
There is simply far too much risk involved, and you will typically need to be externally audited to ensure that you’re complying with all the relevant local laws and security practises.
There are many third-party companies that do it for you that have already gone through all trouble of making sure their system is secure, that they comply with local laws and so on. An example in the US that I have used in the past is authorize.net. Some banks also have systems that you can hook into to store credit card data and process payments.
I realise the country you’re in may not have as strict laws as the U.S., but in my opinion that’s no excuse for rolling your own. When you’re dealing with other people’s money, the risk is just too much to warrant.