My first answer would be "to reduce the complexity to the absolute minimum", but I guess you could also argue that it obfuscates the data if there is an attack surface somewhere - a dodgy router / sniffer / man-in-the-middle - "xxxx xxxx xxxx xxxx" is almost certainly a credit card number, but "xxxxxxxxxxxxxxxx" could be a number of things. Of course, that won't hold back much determined hacking, and hopefully is largely mitigated by SSL etc.
I stress, I don't think this is a good reason, but it may be a reason...
I don't recall anything in my merchant agreement that stipulated what users had to enter in a form field asking for a credit card number. I don't go to great lengths to normalize it, but I do remove whitespace and hyphens. There are rules about what you can re-display though, but that is merely an amount of content and not the precise form.
You'll see similar things for phone numbers and social security numbers, though, so I don't think it's a credit card number problem.
I mostly think that this is mostly a middleware problem. You have the front-end developed by one group, the backend developed by another, and inbetween there is an off-the-shelf middleware component that nobody likes and everyone has to target. The middleware is written as strictly as possible thinking that it's the responsibility of either side to normalize all data. Then the fingerpointing starts and everyone goes home crying, and you can't use spaces in your credit card number.
Not everything has a valid reason. I simply think that the first guy who did it didn't allow spaces because it was easier; and then everyone followed and didn't question it.
我认为这只是懒惰和减少编程的问题，因为可以用 AND 让它接受而无需破折号。甚至为每个部分制作不同的文本框（使用 4 或 5 个小文本框而不是使用巨大的文本框。 或者也许只是因为人们可能会感到困惑
I think its just a matter of laziness and less programing because one can make it accept with AND without dash. or even make different text boxes for each part(using 4 or 5 small text boxes instead of using a giant text box. or maybe its just because people might get confused
I've always found this very odd since its trivial to remove non-digits from a string.
This is even more confusing, given that each card type (Visa/MC/Amex/Discover) has a unique encoding using check digits. So when I enter a credit card number and select VISA as the card type an intelligent validator will verify that the number IS a Visa number. So, if you're going to correctly validate a CC number, you're going to have to remove non-digits from any user-supplied string.
There's three main reasons I can think of why the card validation is implemented poorly:
Check digit validation that doesn't anticipate non-numbers.
A lazy/distressed programmer passes all arguments without pre-validation to a payment gateway and lets the gateway validate the credit card info. A payment gateway is much more rigid with it's argument/data validation then a user interface should be.
Misapprehension about the imaginary legal ramifications of modifying user-supplied cc data.
发布评论
评论（6）
除了懒惰或时间限制之外，确实没有什么好的理由。
好的 UI 应该适应用户以及用户思考数据的多种方式。
UI 很容易适应用户在信用卡中输入破折号或空格的情况。
There really is no good reason other that laziness or time constraints.
Good UI's should adapt to the user and the multiple ways that users think about their data.
It's easy enough for the UI to adapt to the user entering dashes or spaces in the credit card.
我的第一个答案是“将复杂性降低到绝对最低限度”，但我想你也可能会说，如果某处存在攻击面（狡猾的路由器/嗅探器/中间人），它会混淆数据。 “xxxx xxxx xxxx xxxx”几乎肯定是信用卡号，但“xxxxxxxxxxxxxxxx”可能是多种内容。当然，这不会阻止坚决的黑客攻击，并且希望可以通过 SSL 等很大程度上缓解。
我强调，我不认为这是一个好的理由，但这可能是一个原因......
My first answer would be "to reduce the complexity to the absolute minimum", but I guess you could also argue that it obfuscates the data if there is an attack surface somewhere - a dodgy router / sniffer / man-in-the-middle - "xxxx xxxx xxxx xxxx" is almost certainly a credit card number, but "xxxxxxxxxxxxxxxx" could be a number of things. Of course, that won't hold back much determined hacking, and hopefully is largely mitigated by SSL etc.
I stress, I don't think this is a good reason, but it may be a reason...
我不记得我的商业协议中有任何内容规定用户必须在表单字段中输入要求信用卡号的内容。我没有竭尽全力对其进行标准化，但我确实删除了空格和连字符。虽然有关于可以重新显示的内容的规则，但这只是一定数量的内容，而不是精确的形式。
不过，您会看到电话号码和社会安全号码类似的情况，因此我认为这不是信用卡号码问题。
我主要认为这主要是一个中间件问题。前端由一组开发，后端由另一组开发，中间有一个现成的中间件组件，没人喜欢，每个人都必须瞄准。中间件的编写尽可能严格，认为标准化所有数据是双方的责任。然后互相指责开始，每个人都哭着回家，而且你的信用卡号码中不能使用空格。
I don't recall anything in my merchant agreement that stipulated what users had to enter in a form field asking for a credit card number. I don't go to great lengths to normalize it, but I do remove whitespace and hyphens. There are rules about what you can re-display though, but that is merely an amount of content and not the precise form.
You'll see similar things for phone numbers and social security numbers, though, so I don't think it's a credit card number problem.
I mostly think that this is mostly a middleware problem. You have the front-end developed by one group, the backend developed by another, and inbetween there is an off-the-shelf middleware component that nobody likes and everyone has to target. The middleware is written as strictly as possible thinking that it's the responsibility of either side to normalize all data. Then the fingerpointing starts and everyone goes home crying, and you can't use spaces in your credit card number.
并非所有事情都有正当理由。我只是认为第一个这样做的人不允许空间，因为它更容易;然后大家都跟着，没有质疑。
Not everything has a valid reason. I simply think that the first guy who did it didn't allow spaces because it was easier; and then everyone followed and didn't question it.
我认为这只是懒惰和减少编程的问题，因为可以用 AND 让它接受而无需破折号。甚至为每个部分制作不同的文本框（使用 4 或 5 个小文本框而不是使用巨大的文本框。
或者也许只是因为人们可能会感到困惑
I think its just a matter of laziness and less programing because one can make it accept with AND without dash. or even make different text boxes for each part(using 4 or 5 small text boxes instead of using a giant text box.
or maybe its just because people might get confused
我一直觉得这很奇怪，因为从字符串中删除非数字是微不足道的。
考虑到每种卡类型（Visa/MC/Amex/Discover）都有使用 检查数字。因此，当我输入信用卡号并选择 VISA 作为卡类型时，智能验证器将验证该号码是否为 Visa 号码。因此，如果您要正确验证 CC 编号，则必须从用户提供的任何字符串中删除非数字。
我可以想到卡验证实施不佳的三个主要原因：
I've always found this very odd since its trivial to remove non-digits from a string.
This is even more confusing, given that each card type (Visa/MC/Amex/Discover) has a unique encoding using check digits. So when I enter a credit card number and select VISA as the card type an intelligent validator will verify that the number IS a Visa number. So, if you're going to correctly validate a CC number, you're going to have to remove non-digits from any user-supplied string.
There's three main reasons I can think of why the card validation is implemented poorly: