"We have more pressing concerns than calling string.replace()" -- ? I don't think this particular case quite rises to the level of a "tradeoff." It's a single function built into just about every high-level language.
I completely agree that the user's experience of using a form should be well thought out, and that error messages like "please remove spaces" shouldn't be part of any well thought out form, but suggest that anything is free of trade-offs is absolute nonsense. That `string.replace()`, along with all the others for all the other things your well thought out form does the thought-at-the-time-to-be-right thing with open the door to both bugs and user confusion. It's worth it, but it isn't free.
Last time I implemented a CC regex, it was a little more involved than just removing empty spaces. So you see... Your trite example fails to pass muster just as well. (Anymore, I'd just use one of many Stripe libraries... no fuss, no muss.)
really though, it's not that hard to write a simple regex or few line replace command to make the form dead simple to use. creditCardString.replace(" ", "").replace("-","").replace(etc...)
or, if you can use a regex in a sane language replace("[^0-9]", "") then check for the length of the credit cards that you are using. shouldn't take a dev more than 5 min to code and test. Your argument is not really all that valid.
That's exactly what I do whenever I expect a number like this. For instance, phone numbers... Normalize them by replacing all non-numeric characters /then/ validate them. I can't imagine trying to validate the hundred different formatting variations for phone numbers.