8 ms·

The article shows an example of a credit card field being a "number". Having made several online purchases, I realized I'm now frustrated by a CC number field t

by zxcvgm 5y ago

The article shows an example of a credit card field being a "number". Having made several online purchases, I realized I'm now frustrated by a CC number field that doesn't allow any spaces or dashes, or doesn't format it visually this way for you. They should just allow dashes/spaces then strip it using JS or at the backend. There is a reason that the number printed on the credit card is grouped into 4 digits, and I believe that it makes human parsing easier. When I submit the form and it says "invalid card number", trying to figure out which digit I mistyped into the form while scanning that long string of digits with my eyes, gazing at the card and back at the screen is just stupid.

masklinn 5y ago
Preach. Any input which might as well be random (CC, phone numbers, keys, fingerprints, …) should allow for formatting otherwise anything beyond 4 characters gets very hard to validate and correct. If it auto-formats that may be fine, although lots of these have very culturally dependent formattings (phone numbers are a prime example here) so freeform formatting is definitely better. It’s also important to realise that lots of things which are numerical (sequences of digits) are not semantically numbers e.g. leading zeroes are relevant in a phone number or CC number, and incrementing or decrementing either is nonsensical.
joosters 5y ago
Same goes for phone numbers too. When I enter a phone number into a field, only to be told on pressing submit that 'phone number cannot contain spaces', I despair for technology. So your form accepts spaces, and you made your website check for spaces, but simply removing them is beyond the capabilities of your code? Websites suck.
- twic 5y ago
  In the UK, bank accounts have a thing called a sort code, which is six digits, conventionally grouped into three pairs, separated by hyphens (eg 08-92-73). It seems to be completely random whether an input for these will be a text box which requires hyphens, a text box which forbids hyphens, three tiny text boxes which you have to tab between manually to enter each digit pair, or three tiny text boxes where JavaScript automatically moves the focus to the next after you have entered two digits. Naturally, you cannot reliably paste into any of them. But then, my bank has disabled copying everywhere sort codes are displayed anyway!
  - TheSpiceIsLife 5y ago
    In Australia we have an account number and a BSB - Bank State Branch number which, unsurprisingly, represents the bank, state, and branch. These are almost universally displayed as two groups of three digits, that's seven characters, count them... separated by a hyphen and almost universally have to be entered in to a six character field, non-numeric characters not accepted. Definitely one or my favourite minor annoyances.
    - TheSpiceIsLife 5y ago
      Ha! Oops. I meant to put that bit about seven characters after the hyphen, thereby making seven characters. Doh.
  - 12ian34 5y ago
    I've seen one which is a single text box with grey placeholder text that has hyphens ("12-34-56") yet does not accept hyphens, so you need to type in the format "123456"...
    - HPsquared 5y ago
      This is basically how Excel works when you use custom number formatting. You can set a number format to display numeric data in a specified way (e.g. "00-00-00" for a sort code, or "0000 0000 0000 0000" for a CC number). Excel will store the data as a number, and display it with the selected format, but you can't type it in with the spaces etc. - it needs to be input as just a number. I think this way of doing things is quite common.
  - mytailorisrich 5y ago
    I've seen similar issues with postcodes as well, though it seems to have got better: Type "LS29JT" and get an error because it does not like that you did not add the space "LS2 9JT" Or even, type "LS2 9JT" and get an error because it does not like that you did add the space.
    - 5y ago
- 867-5309 5y ago
  we need a system like we have for email whereby it doesn't matter if the letters are uppercase or lowercase, as long as the information is there (email alphanumerical, credit card and phone numbers numerical). sadly there are still a few people who say or question capital letters in their email address, but that's better than being outright rejected as valid input
  - InCityDreams 5y ago
    Some of my customers get upset if i don't enter their email exactly as written by themselves. Even though they got the email.
    - denton-scratch 5y ago
      Get better customers :-) Incidentally: how do your customers know how you entered their email address? That's a matter that is at the discretion of the mailserver software; it can be automatically rewritten. What you typed into your mailer isn't guaranteed to be reflected in any of the headers the recipient sees. Far from it.
- FabHK 5y ago
  What annoys me (unreasonably) is when the website then blames me by saying something like "You entered an invalid phone number." No, the phone number I entered is perfectly valid, it's that your crappy software can't parse it! <bangs head on table repeatedly>
JulianMorrison 5y ago
It's honestly really important NOT to treat a credit card "number" as a number. It is an essentially text string made out of digits. It doesn't have any of the equalities or operations a number has. 01234 != 1234 and so forth.
- zbuf 5y ago
  Are any credit cards issued with numbers beginning zero? I would bet this sort of pragmatic workaround is taking place.
  - lsaferite 5y ago
    Credit Card numbers start with a BIN (Bank Identification Number) that is 6 or 8 digits. The first digit of the BIN is the MII (Major Industry Identifier). The MII of 0 is indeed valid, but seems to be reserved for use by the committee managing the spec? In any case, it's perfectly valid to have a CC# starting with a 0.
    - bombcar 5y ago
      And this is the kind of thing that can get you if you get "too smart" about verifying the number, by assuming that 0 is reserved and will never be used. We see this with IP addresses where hardcoded assumptions that were wrong or became wrong blow things up. For example, many people didn't realize that 172.* isn't entirely reserved for internal IPs.
- Closi 5y ago
  IMO here you are mixing up what a 'number' is from a programmer's perspective, to what a number is from a User / UX perspective. We want a user to just be able to input numbers and not letters. Yes, that is a string, but from a user experience perspective we are going to ask them to input numbers / sets of numbers. This is important, because if they just make it a regular text field then mobile phones will show the full keyboard which makes inputting long numbers very difficult.
  - 5y ago
DocTomoe 5y ago
Also: IBAN (International Bank Account Numbers, 20-40-character account ids used mostly in Europe) - I just love it when I copy an IBAN (which legally can contain whitespace for grouping), paste it into a (length-constrained) input field, and the last third of the number is being cropped away. IBAN fields should NEVER be length-constrained. Every country uses different lengths, and if you have a max length, chances are you are locking out some users from other countries (which actually is in violation of European law [Article 9, Regulation No 260/2012]).
- maxcan 5y ago
  Just be grateful you can paste it. chase.com blocks copy/paste on IBAN fields which is just incomprehensible to me. Absolutely infuriating.
  - bombcar 5y ago
    Apparently someone somewhere thinks you're more likely to get your account/routing number correct if you type it in by hand than if you paste it in; it's absolutely infuriating and insane.
- InCityDreams 5y ago
  ....seven consecutive zeros.
imgabe 5y ago
This is a pet peeve of mine. If you aren't performing mathematical operations with it, it's not a number, even if it has digits in it. ID numbers, social security numbers, phone numbers, credit card numbers, etc these are text identifiers that happen to use numerals. They're not numbers.
- pbhjpbhj 5y ago
  Yes! Always annoys me that Google Maps navigation reads the codes for roads as if they were numbers. In the UK I only ever here, for example, A2179 spoken as "ay twenty-one seventy-nine. GMaps reads it as "ay two thousand one hundred and seventy nine". That extra time taken and slight extra mental processing when you're driving, it exacerbates it beyond annoyance. (There are exceptions, of course, A6000 would be read as "ay six thousand"). Presumably this is USA-ism noone bothered to fix.
  - tallanvor 5y ago
    No, not a USA-ism, we'd likely pronounce it the same way, although I can't think of any highway numbers that are that high. An example would be I-440 in North Carolina, it gets pronounced "eye four forty", or I-195 would be "eye one ninty-five".
    - deleted 5y ago
      [deleted]
    - bena 5y ago
      The interstate system is a bit of an oddity numbering wise as well. "Four forty" is a better way to say it than "Four hundred forty" because the hundreds place is used to denote branches off the main interstate. I440 should attach to I40 in at least two places based on its number. And checking it on a map, it does look like I440 is a beltway through Raleigh. Also, I can see an I540, which means a spur off of I40 that. And you can see that I540 connects to I40 in one spot and deposits you near I87.
  - Symbiote 5y ago
tallanvor 5y ago
Obviously a lot of sites do format credit card numbers, but keep in mind that does add an additional level of complexity because you have to verify the type of card and what formatting to perform. American Express uses 15 digit numbers grouped in 4-6-5 format, so if you accept AMEX, you have to take that into account.
jdrc 5y ago
also when it has a maxlength which truncates last digits when you paste a copied CC number that contains spaces/dashes. even worse with IBAN numbers
blenderdt 5y ago
Some developers mix up validating and sanitizing. If you can sanitize, then it doesn't matter what the user input was. If validation fails, notify the user.
Aloha 5y ago
It's just as bad when sites won't allow me to enter it as a 15-16 digit string. Another gripe is when it requires me to tell it what kind of card it is, when it also then validates the BIIN, and tells me I'm wrong if I forget to chose - why not just fix it for me?
duxup 5y ago
I get medical bills from different providers. All of them provide me an account code to enter. The instructions tell me to enter the account code "exactly" as on the paper. Except for the fact that it starts with <letter><dash>. I'm supposed to omit that part... As a webdev I just really want to submit a PR.

by zxcvgm 5y ago

masklinn 5y ago

Preach. Any input which might as well be random (CC, phone numbers, keys, fingerprints, …) should allow for formatting otherwise anything beyond 4 characters gets very hard to validate and correct. If it auto-formats that may be fine, although lots of these have very culturally dependent formattings (phone numbers are a prime example here) so freeform formatting is definitely better. It’s also important to realise that lots of things which are numerical (sequences of digits) are not semantically numbers e.g. leading zeroes are relevant in a phone number or CC number, and incrementing or decrementing either is nonsensical.

joosters 5y ago

Same goes for phone numbers too. When I enter a phone number into a field, only to be told on pressing submit that 'phone number cannot contain spaces', I despair for technology. So your form accepts spaces, and you made your website check for spaces, but simply removing them is beyond the capabilities of your code? Websites suck.

twic 5y ago
In the UK, bank accounts have a thing called a sort code, which is six digits, conventionally grouped into three pairs, separated by hyphens (eg 08-92-73). It seems to be completely random whether an input for these will be a text box which requires hyphens, a text box which forbids hyphens, three tiny text boxes which you have to tab between manually to enter each digit pair, or three tiny text boxes where JavaScript automatically moves the focus to the next after you have entered two digits. Naturally, you cannot reliably paste into any of them. But then, my bank has disabled copying everywhere sort codes are displayed anyway!
- TheSpiceIsLife 5y ago
  In Australia we have an account number and a BSB - Bank State Branch number which, unsurprisingly, represents the bank, state, and branch. These are almost universally displayed as two groups of three digits, that's seven characters, count them... separated by a hyphen and almost universally have to be entered in to a six character field, non-numeric characters not accepted. Definitely one or my favourite minor annoyances.
  - TheSpiceIsLife 5y ago
    Ha! Oops. I meant to put that bit about seven characters after the hyphen, thereby making seven characters. Doh.
- 12ian34 5y ago
  I've seen one which is a single text box with grey placeholder text that has hyphens ("12-34-56") yet does not accept hyphens, so you need to type in the format "123456"...
  - HPsquared 5y ago
    This is basically how Excel works when you use custom number formatting. You can set a number format to display numeric data in a specified way (e.g. "00-00-00" for a sort code, or "0000 0000 0000 0000" for a CC number). Excel will store the data as a number, and display it with the selected format, but you can't type it in with the spaces etc. - it needs to be input as just a number. I think this way of doing things is quite common.
- mytailorisrich 5y ago
  I've seen similar issues with postcodes as well, though it seems to have got better: Type "LS29JT" and get an error because it does not like that you did not add the space "LS2 9JT" Or even, type "LS2 9JT" and get an error because it does not like that you did add the space.
  - 5y ago
867-5309 5y ago
we need a system like we have for email whereby it doesn't matter if the letters are uppercase or lowercase, as long as the information is there (email alphanumerical, credit card and phone numbers numerical). sadly there are still a few people who say or question capital letters in their email address, but that's better than being outright rejected as valid input
- InCityDreams 5y ago
  Some of my customers get upset if i don't enter their email exactly as written by themselves. Even though they got the email.
  - denton-scratch 5y ago
    Get better customers :-) Incidentally: how do your customers know how you entered their email address? That's a matter that is at the discretion of the mailserver software; it can be automatically rewritten. What you typed into your mailer isn't guaranteed to be reflected in any of the headers the recipient sees. Far from it.
FabHK 5y ago
What annoys me (unreasonably) is when the website then blames me by saying something like "You entered an invalid phone number." No, the phone number I entered is perfectly valid, it's that your crappy software can't parse it! <bangs head on table repeatedly>

JulianMorrison 5y ago

It's honestly really important NOT to treat a credit card "number" as a number. It is an essentially text string made out of digits. It doesn't have any of the equalities or operations a number has. 01234 != 1234 and so forth.

zbuf 5y ago
Are any credit cards issued with numbers beginning zero? I would bet this sort of pragmatic workaround is taking place.
- lsaferite 5y ago
  Credit Card numbers start with a BIN (Bank Identification Number) that is 6 or 8 digits. The first digit of the BIN is the MII (Major Industry Identifier). The MII of 0 is indeed valid, but seems to be reserved for use by the committee managing the spec? In any case, it's perfectly valid to have a CC# starting with a 0.
  - bombcar 5y ago
    And this is the kind of thing that can get you if you get "too smart" about verifying the number, by assuming that 0 is reserved and will never be used. We see this with IP addresses where hardcoded assumptions that were wrong or became wrong blow things up. For example, many people didn't realize that 172.* isn't entirely reserved for internal IPs.
Closi 5y ago
IMO here you are mixing up what a 'number' is from a programmer's perspective, to what a number is from a User / UX perspective. We want a user to just be able to input numbers and not letters. Yes, that is a string, but from a user experience perspective we are going to ask them to input numbers / sets of numbers. This is important, because if they just make it a regular text field then mobile phones will show the full keyboard which makes inputting long numbers very difficult.
- 5y ago

DocTomoe 5y ago

Also: IBAN (International Bank Account Numbers, 20-40-character account ids used mostly in Europe) - I just love it when I copy an IBAN (which legally can contain whitespace for grouping), paste it into a (length-constrained) input field, and the last third of the number is being cropped away. IBAN fields should NEVER be length-constrained. Every country uses different lengths, and if you have a max length, chances are you are locking out some users from other countries (which actually is in violation of European law [Article 9, Regulation No 260/2012]).

maxcan 5y ago
Just be grateful you can paste it. chase.com blocks copy/paste on IBAN fields which is just incomprehensible to me. Absolutely infuriating.
- bombcar 5y ago
  Apparently someone somewhere thinks you're more likely to get your account/routing number correct if you type it in by hand than if you paste it in; it's absolutely infuriating and insane.
InCityDreams 5y ago
....seven consecutive zeros.

imgabe 5y ago

This is a pet peeve of mine. If you aren't performing mathematical operations with it, it's not a number, even if it has digits in it. ID numbers, social security numbers, phone numbers, credit card numbers, etc these are text identifiers that happen to use numerals. They're not numbers.

pbhjpbhj 5y ago
Yes! Always annoys me that Google Maps navigation reads the codes for roads as if they were numbers. In the UK I only ever here, for example, A2179 spoken as "ay twenty-one seventy-nine. GMaps reads it as "ay two thousand one hundred and seventy nine". That extra time taken and slight extra mental processing when you're driving, it exacerbates it beyond annoyance. (There are exceptions, of course, A6000 would be read as "ay six thousand"). Presumably this is USA-ism noone bothered to fix.
- tallanvor 5y ago
  No, not a USA-ism, we'd likely pronounce it the same way, although I can't think of any highway numbers that are that high. An example would be I-440 in North Carolina, it gets pronounced "eye four forty", or I-195 would be "eye one ninty-five".
  - deleted 5y ago
    [deleted]
  - bena 5y ago
    The interstate system is a bit of an oddity numbering wise as well. "Four forty" is a better way to say it than "Four hundred forty" because the hundreds place is used to denote branches off the main interstate. I440 should attach to I40 in at least two places based on its number. And checking it on a map, it does look like I440 is a beltway through Raleigh. Also, I can see an I540, which means a spur off of I40 that. And you can see that I540 connects to I40 in one spot and deposits you near I87.
- Symbiote 5y ago

tallanvor 5y ago

Obviously a lot of sites do format credit card numbers, but keep in mind that does add an additional level of complexity because you have to verify the type of card and what formatting to perform. American Express uses 15 digit numbers grouped in 4-6-5 format, so if you accept AMEX, you have to take that into account.

jdrc 5y ago

also when it has a maxlength which truncates last digits when you paste a copied CC number that contains spaces/dashes. even worse with IBAN numbers

blenderdt 5y ago

Some developers mix up validating and sanitizing. If you can sanitize, then it doesn't matter what the user input was. If validation fails, notify the user.

Aloha 5y ago

It's just as bad when sites won't allow me to enter it as a 15-16 digit string. Another gripe is when it requires me to tell it what kind of card it is, when it also then validates the BIIN, and tells me I'm wrong if I forget to chose - why not just fix it for me?

duxup 5y ago

I get medical bills from different providers. All of them provide me an account code to enter. The instructions tell me to enter the account code "exactly" as on the paper. Except for the fact that it starts with <letter><dash>. I'm supposed to omit that part... As a webdev I just really want to submit a PR.