The best way to handle it is to have your gateway handle the storage of CC data - gateways (Authorize.net - CIM, Braintree - Vault, etc...) have the resources and incentive to be PCI compliant.

With it stored on your gateway's servers, they will usually provide an API that you can use to issue transactions against the stored user data (it shouldn't return the CC data, just run transactions against it).

I'm heavily against storing CC data on my own servers - I store the last 4 digits (for display purposes to users) but that is it.