How secure is this?

Question

Ok, my program is designed to append a few strings representing credit card details, encrypting, and storing in mysql.
the encryption details are:
iterations: 19
8byte salt value
encryption type = PBEWithMD5AndDES
the key itself is stored in mysql, and is an md5 copy of my clients password. When data is put into the database, this key is grabbed from mysql, however for my client to view the cc details, they need to enter their password in a non-md5 format. My program will then convert this to md5 to produce the same key as is used to put info in the database.
How secure does this sound?

Answer 1

I know this but i am stuck here. My situation is: i
am a host, my clients have online shops, where they
sometimes want to store the customers CC details. my
clients log in to their admin using their username
and password, and i keep a copy of their md5 password
in my database, and obviously my login script turn
their password into md5 to check against the
database.
But when a customer orders something from my client,
a php script gives me the clients userid,Wide open! Based on this, any user id for any client will do!
so i can
check against the data in teh database and know where
to put the encrypted data. It would be insecure for
the php script to hold information about theclients
password.
Also, how many bits would my algorithm be?I once worked for a big bank that hired security consultants to look at security weaknesses. You should do the same.