PCI Compliance and Paypal Button Question

[SunnyT]

If the code for the Paypal Buttons are altered to remove the <form> tags, and pass the information in the link instead, are they still PCI compliant?

Thank you in advance for your assistance.

[JonathonBWB]

What information are you planning on passing through the URL?  If it's PII (U.S.: Credit Card Data or Canada: Name, Addy, Phone) then it needs to be encrypted via SSL.  While that may not specifically address the PCI DSS rules, it does offer compensating controls.

Though, if it's PII without encryption, then you'll have a finding if an audit occurs.

[SunnyT]

I am uploading a Paypal button, but can't use forms, so I'm using the data to create a link instead.

Example of what I'm converting to:

<a target="_blank" href="https://www.paypal.com/us/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=####"><img alt="PayPal - The safer, easier way to pay online!" src="https://www.paypal.com/en_US/i/btn/btn_donateCC_LG.gif" border="0"></a>