Hacker News new | ask | show | jobs
by kevinconroy 4519 days ago
If you are handling the card number on your own servers (e.g. not using an iframe which you can't modify), then it's just lazy programming. There's no spec that says you cannot modify poor user input to strip characters.

Source: I run an e-commerece site and have written checkout flow.