Hacker News Reader

Comment by marcusr | Hacker News Reader

Why do credit card forms ask you to enter the credit card number without spaces between the clusters of digits, when it's simple for the machine to parse with or without them?

View on HN

I'm going to guess that the most likely reason is that a terrible progranmer or manager was behind the decision of making the customer do the extra work instead of the development team spending a little more time to parse it.

I doubt there's a reasonable explanation as to why a CC field can't contain dashes or spaces. I'd love to hear one but I doubt there is one.

If you follow the letter of the law with gateways it's frequently the case that you cannot modify the payment data. At least that was the case years ago when I integrated with a couple (in the scary days before Braintree and Stripe).

This came up in a training course along with why do some sites prevent characters like * / ( & from passwords. The reason is the same:

Poor Input Validation

Basically whoever was behind making the site couldn't be bothered dealing with those cases and just made them illegal options. Makes you wonder what other corners were cut.

If you are handling the card number on your own servers (e.g. not using an iframe which you can't modify), then it's just lazy programming. There's no spec that says you cannot modify poor user input to strip characters.

Source: I run an e-commerece site and have written checkout flow.

This is extremely rare in my experience. But I suspect it's just lazy or poor programming. It's usually kind of humorous because the coding to identify the situation and display an error message could have simply been spent removing the spaces/dashes/etc.

Someone specced the field length and type for the database, and just said "enforce the same rules on the front-end."

Reply on news.ycombinator.com