The most important thing you need to remember is to never store any of their information unless you absolutely need it (pre-orders or something like that). In my work's case, we use a third-party system, Touchnet, to handle all of the credit card processing.
Our custom applications record the amount and a special transaction number in a database before forwarding the user on to the credit card portal. After the user completes the transaction (by cancelling or paying) the third-party contacts our web service with the custom transaction number and the reference number of the payment. At this point our web service finds the transaction in the database and marks it appropriately and sets the reference number if one was provided.
Our finance department takes care of reconciling the transactions and makes sure we get paid. (I've never seen that part so I can't say how it works...)
By using a third-party to process transactions, some of the PCI-DSS compliance is taken care of, and we can truthfully tell our users that we never store their credit card information.