Is 42 a valid credit card number? jQuery validator thinks it is

Question

We all know that 42 is the answer to everything, but it's news to me that it is a valid credit card number.

Try entering '42' or '42176' into this jQuery Validation testing page and click OK.

What's going on? I thought this was supposed to be the de-facto validation library. Even Microsoft is using it now, but it thinks '42' and '42176' are valid credit card numbers?! It's not even doing a length check. Surely I'm not responsible for adding a length check too? It's called 'creditcard' validator and not 'luhn' validator.

Edit: hitchhiker humor aside - how would I go about patching the validation plugin to check length. is that easy?

It's the answer to life the universe and everything. Why wouldn't it be a valid credit card number? — Eli Grey, Dec 08 '09 at 02:40
@Elijah: Because the Question isn't "What's a valid credit card number?" — R. Martinho Fernandes, Dec 08 '09 at 02:46
@paul there are 42 known recorded accounts of that happening but i only heard about 42 of them — Simon_Weaver, Dec 08 '09 at 03:07

mjv · Accepted Answer · 2009-12-08T02:38:49.270

This is probably because this validator merely checks that the number supplied satisfies the LUHN-10 algorithm (which 42 satisfies since 4*2 + 2 = 10 which is 0 modulo 10).

A better validator should maybe check for a minimal number of digits.

I'm not sure this corresponds to the very latest code from jQuery, but I found the snippet associated with credit card validation:

    // http://docs.jquery.com/Plugins/Validation/Methods/creditcard
    // based on http://en.wikipedia.org/wiki/Luhn
    creditcard: function(value, element) {
        if ( this.optional(element) )
            return "dependency-mismatch";
        // accept only digits and dashes
        if (/[^0-9-]+/.test(value))
            return false;
        var nCheck = 0,
            nDigit = 0,
            bEven = false;

        value = value.replace(/\D/g, "");

        for (n = value.length - 1; n >= 0; n--) {
            var cDigit = value.charAt(n);
            var nDigit = parseInt(cDigit, 10);
            if (bEven) {
                if ((nDigit *= 2) > 9)
                    nDigit -= 9;
            }
            nCheck += nDigit;
            bEven = !bEven;
        }

        return (nCheck % 10) == 0;
    },

... and as you see this merely check that all characters are digits and that LUHN-10 is satisfied, without any attention to a minial length.

Wow, what a crappy validation routine. – Ed S. Dec 08 '09 at 02:43 — Ed S., Dec 08 '09 at 02:43

score 8 · Answer 2 · answered Dec 08 '09 at 14:56

You can combine the credit card rule with the minimum and maximum length rules to achieve what you want. That may seem like too much effort -- and I might agree -- though it does give you more control if you only want to accept certain card number lengths.

$('form').validate({
    '#ccNum': {
                   creditcard: true,
                   required: true,
                   minlength: 13,
                   maxlength: 19
              }
});

score 6 · Answer 3 · answered Dec 08 '09 at 02:32

6

The length of credit card numbers can vary depending on the issuer (though yes, there's generally a minimum length of ~13 digits). However, since this is client-side validation, the focus is probably more on reducing the chance of a small typo, and less on checking arbitrary data. That should probably be done server-side.

answered Dec 08 '09 at 02:32

Amber

507,862
82
626
550

but the problem is if you've already got it wrong once - as you begin to start typing to correct it it will tell you *as youre typing* that its correct, and then wrong, and then correct again. all credit cards must be at least 15 characters right - so why isnt it making a check. i have the source i suppose but it just makes me weary of using this library overall. – Simon_Weaver Dec 08 '09 at 02:37
The length must be between 13 and 19 digits, in general. – dave4420 Dec 08 '09 at 02:39
1

The 19-digit max is a limitation of ISO 7812. Theoretically a card number might be as few as 6 digits (for the IIN), though in practice 13-digit cards are the shortest that have been commonly issued by the financial industry (and they are no longer in use). – bobince Dec 08 '09 at 03:15

Sparky · Answer 4 · 2011-03-11T09:52:03.880

I have corrected the jQuery validate function to consider credit card length in validation.

I added the following to the credit card validation code-

if (value.length > 19 || value.length<12)
{
    return (false);
}

The complete code for the creditcard validation part is as follows:-

creditcard: function(value, element) {
if ( this.optional(element) )
return "dependency-mismatch";
// accept only digits and dashes
if (/[^0-9-]+/.test(value))
return false;

// Modified part to check minimum and maximum card length
if (value.length > 19 || value.length<12)
{
    return (false);
}

var nCheck = 0,
nDigit = 0,
bEven = false;
value = value.replace(/\D/g, "");

for (n = value.length - 1; n >= 0; n--) {
var cDigit = value.charAt(n);
var nDigit = parseInt(cDigit, 10);
if (bEven) {
if ((nDigit *= 2) > 9)
nDigit -= 9;
}
nCheck += nDigit;
bEven = !bEven;
}

return (nCheck % 10) == 0;
},

I have hard coded the minimum and maximum card lengths as 12 and 19 respectively.

Is 42 a valid credit card number? jQuery validator thinks it is

4 Answers4