Ah, I missed the second part, about suggestions of places to buy ... Don't buy 8x10s from ebay. The latest statistic I had heard from the FBI was their estimate that 90% of the autographs on the site were fakes.
Unless the actor is the one doing the selling on ebay (and it does happen), OR it's an autographed trading card, it's probably best to avoid it.
Now, about the cards ... If you want to buy them, just make sure they are autograph cards (as in, from Rittenhouse or Skybox) ... There is a world of difference between a card pulled from a pack like that, and someone who takes an ordinary card and forges a sig to try and con somebody.
Basically, do your homework.