Member Avatar for sreekiran

using javascript

  • 3 Contributors
  • 2 Replies
  • 107 Views
  • 3 Years Discussion Span
  • Latest Post Latest Post by macgurl70

Dani AI

Generated

raised the right distinction and was right to flag security. Client-side JavaScript should only be used to improve user experience by checking format (digits, length, Luhn checksum) and guiding input. It cannot verify that a card is active, has funds, or is allowed to be charged — that requires a server-side authorization with a PCI-compliant payment gateway.

A minimal, practical Luhn check (run after stripping non-digits) is a good start for format validation:

function luhnCheck(value) {
  var cc = (value || '').replace(/\D/g, '');
  var sum = 0, double = false;
  for (var i = cc.length - 1; i >= 0; i--) {
    var digit = parseInt(cc.charAt(i), 10);
    if (double) {
      digit *= 2;
      if (digit > 9) digit -= 9;
    }
    sum += digit;
    double = !double;
  }
  return (sum % 10) === 0;
}

Practical tips:

  • Strip spaces/dashes before validating. Check length per brand (Visa, Amex, MasterCard ranges) and run Luhn.
  • Use inputmode="numeric", pattern, and autocomplete="cc-number" to help mobile keyboards and browsers.
  • Never rely solely on client-side checks: always re-validate on the server and perform an authorization/AVS/CVV check via a payment gateway.
  • Do not store card numbers or CVV unless you meet PCI requirements. Prefer tokenization or hosted fields so sensitive data never touches your server.

Further reading: the Luhn algorithm details are documented at Luhn algorithm, browser form validation guidance at MDN Form validation, and PCI requirements at PCI Security Standards.

Recommended Answers

All 2 Replies

Member Avatar for Fungus1487

using javascript

are you talkin about validating it to check whether it is REAL or whether the format is correct ?

Member Avatar for macgurl70

You can check if they have entered a valid number and that is about it. It would be irresponsible to expect customers to provide credit card information through an unsecured form.

For complete validation, check with your hosting company if they can recommend a secure service or if they can provide a secure connection. In fact, if I don't see a form is secure, I won't order the item.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.