Hacker News new | ask | show | jobs
by nailer 689 days ago
Very obviously: do not display the hexadecimal code to end users.
1 comments

So now you have three codes, the old code, a new internal and a new external code.
Two codes.

A competently designed system should be able to convert between "internal" and "external codes" using only trivial string manipulation (e.g. no external dependencies, nor any databases to load at runtime; while adding or removing the code type magic-prefix is trivial; and computing/veriftying/concatenating/trimming any check-digits should also be straightforward, like a CC or VIN check-digit.

...basically, copy what Stripe does (except I wish Stripe would announce a far smaller and reasonable length-limit for their Object-Ids instead of handwaving around a vague reference to needing as 255-char database column - because it messes-up all of my RDBMS query-plans' memory grants because it allocates (N rows * 255 bytes) whereas in reality all of my Stripe Object-Ids are well-under 32 chars in length, _le sigh_.

Just set a reasonable limit and set up a column type change for if you ever have it exceeded?
Don't forget typos