8 ms·

It's honestly really important NOT to treat a credit card "number" as a number. It is an essentially text string made out of digits. It doesn't have any of the

It's honestly really important NOT to treat a credit card "number" as a number. It is an essentially text string made out of digits. It doesn't have any of the equalities or operations a number has. 01234 != 1234 and so forth.

zbuf 4y ago
Are any credit cards issued with numbers beginning zero? I would bet this sort of pragmatic workaround is taking place.
- lsaferite 4y ago
  Credit Card numbers start with a BIN (Bank Identification Number) that is 6 or 8 digits. The first digit of the BIN is the MII (Major Industry Identifier). The MII of 0 is indeed valid, but seems to be reserved for use by the committee managing the spec? In any case, it's perfectly valid to have a CC# starting with a 0.
  - bombcar 4y ago
    And this is the kind of thing that can get you if you get "too smart" about verifying the number, by assuming that 0 is reserved and will never be used. We see this with IP addresses where hardcoded assumptions that were wrong or became wrong blow things up. For example, many people didn't realize that 172.* isn't entirely reserved for internal IPs.
Closi 4y ago
IMO here you are mixing up what a 'number' is from a programmer's perspective, to what a number is from a User / UX perspective. We want a user to just be able to input numbers and not letters. Yes, that is a string, but from a user experience perspective we are going to ask them to input numbers / sets of numbers. This is important, because if they just make it a regular text field then mobile phones will show the full keyboard which makes inputting long numbers very difficult.
- xupybd 4y ago
  Yes but entering 0123 and 123 results in something very different if it's a string and exactly the same if it's a number. Anything that can have and needs to retain leading zeros is a string. That string can be restricted to 0-9 and would benefit from the numeric keypad. https://stackoverflow.com/questions/6178556/phone-numeric-keyboard-for-text-input https://stackoverflow.com/questions/6178556/phone-numeric-ke...
  - andi999 4y ago
    even worse, sometime 011 and 11 is very different even as a number. Some function from php if it converts strings to numbers, considers a trailing 0 as octal representation. Probably intval without base: https://www.php.net/manual/en/function.intval.php https://www.php.net/manual/en/function.intval.php
    - darrenf 4y ago
      That would be a leading 0, not a trailing 0! :)
      - andi999 4y ago
        of course!
  - Closi 4y ago
    > That string can be restricted to 0-9 and would benefit from the numeric keypad. Yes, that’s the whole point of the original article - that up until now browser support was insufficient to roll this out on a government website. I’m aware of what happens if you save a string of numerics into an integer. It’s still entering a number from a user / ux perspective.
  - HPsquared 4y ago
    Does it hurt anything for the system to add the leading zeros? (e.g. a CC number input and stored as "1" and displayed as "0000 0000 0000 0001" - an extreme example I know)
onei 4y ago
It's not strictly true to say a credit card number is not a number. It can be validated by Luhn's algorithm which is numeric in nature, but not in such a way that you would treat it as an integer.
- petesergeant 4y ago
  It's a sequence of single-digit integers, not a number
  - falcor84 4y ago
    That is to say it's a numeral
    - andrewingram 4y ago
      Yeah. I'd say it's numeric, but doesn't represent a quantity.
  - mmmmmbop 4y ago
    That's true for the mathematical definition of number, but not for the commonly used definition of number as "a numeral or combination of numerals or other symbols used to identify or designate" (4b at [0]). A common example would be a document number, which may often be alphanumeric. [0] https://www.merriam-webster.com/dictionary/number https://www.merriam-webster.com/dictionary/number
    - nightpool 4y ago
      That's great. We're clearly talking about the definition of number used by HTML and all major programming languages. Whether a dictionary counts it as a "number" or not is entirely besides the original point—don't use integer or numeric types for storing or processing this data.

zbuf 4y ago

Are any credit cards issued with numbers beginning zero? I would bet this sort of pragmatic workaround is taking place.

lsaferite 4y ago
Credit Card numbers start with a BIN (Bank Identification Number) that is 6 or 8 digits. The first digit of the BIN is the MII (Major Industry Identifier). The MII of 0 is indeed valid, but seems to be reserved for use by the committee managing the spec? In any case, it's perfectly valid to have a CC# starting with a 0.
- bombcar 4y ago
  And this is the kind of thing that can get you if you get "too smart" about verifying the number, by assuming that 0 is reserved and will never be used. We see this with IP addresses where hardcoded assumptions that were wrong or became wrong blow things up. For example, many people didn't realize that 172.* isn't entirely reserved for internal IPs.

Closi 4y ago

IMO here you are mixing up what a 'number' is from a programmer's perspective, to what a number is from a User / UX perspective. We want a user to just be able to input numbers and not letters. Yes, that is a string, but from a user experience perspective we are going to ask them to input numbers / sets of numbers. This is important, because if they just make it a regular text field then mobile phones will show the full keyboard which makes inputting long numbers very difficult.

xupybd 4y ago
Yes but entering 0123 and 123 results in something very different if it's a string and exactly the same if it's a number. Anything that can have and needs to retain leading zeros is a string. That string can be restricted to 0-9 and would benefit from the numeric keypad. https://stackoverflow.com/questions/6178556/phone-numeric-keyboard-for-text-input https://stackoverflow.com/questions/6178556/phone-numeric-ke...
- andi999 4y ago
  even worse, sometime 011 and 11 is very different even as a number. Some function from php if it converts strings to numbers, considers a trailing 0 as octal representation. Probably intval without base: https://www.php.net/manual/en/function.intval.php https://www.php.net/manual/en/function.intval.php
  - darrenf 4y ago
    That would be a leading 0, not a trailing 0! :)
    - andi999 4y ago
      of course!
- Closi 4y ago
  > That string can be restricted to 0-9 and would benefit from the numeric keypad. Yes, that’s the whole point of the original article - that up until now browser support was insufficient to roll this out on a government website. I’m aware of what happens if you save a string of numerics into an integer. It’s still entering a number from a user / ux perspective.
- HPsquared 4y ago
  Does it hurt anything for the system to add the leading zeros? (e.g. a CC number input and stored as "1" and displayed as "0000 0000 0000 0001" - an extreme example I know)

onei 4y ago

It's not strictly true to say a credit card number is not a number. It can be validated by Luhn's algorithm which is numeric in nature, but not in such a way that you would treat it as an integer.

petesergeant 4y ago
It's a sequence of single-digit integers, not a number
- falcor84 4y ago
  That is to say it's a numeral
  - andrewingram 4y ago
    Yeah. I'd say it's numeric, but doesn't represent a quantity.
- mmmmmbop 4y ago
  That's true for the mathematical definition of number, but not for the commonly used definition of number as "a numeral or combination of numerals or other symbols used to identify or designate" (4b at [0]). A common example would be a document number, which may often be alphanumeric. [0] https://www.merriam-webster.com/dictionary/number https://www.merriam-webster.com/dictionary/number
  - nightpool 4y ago
    That's great. We're clearly talking about the definition of number used by HTML and all major programming languages. Whether a dictionary counts it as a "number" or not is entirely besides the original point—don't use integer or numeric types for storing or processing this data.