Assume you have a website that makes several checks on user-generated input. A few examples example from my current assignment:
- the Belgian version of an SSN is validated using the user date of birth (first 6 symbols), the user gender (next 3 symbols) and a check digit (last 2 symbols).
- An IBAN number is validated using the country code, the length of the number, the bank the account belongs to, the account number embedded in the bank, and a checkdigit.
- A VAT number is validated using the country code, the length of the number and an algorithm that depends on the country code and usually involves a checkdigit.
I mainly wonder about 2 separate issues with this:
- The intent of these numbers is that the user enters a valid number. If the number is invalid, how much information should you show? Should you just show a generic "invalid input"? Should you give information on what exactly is wrong? should you go all the way and also give the expected value if you can figure it out easily? that last option sounds dangerous: what if the check that fails wasn't because the value it checks fails, but because the input that's used to validate the value was faulty?
- Often, if one of the early checks fails, the checkdigit check also fails. When the failure of a check is because of a wrong value in an earlier check, what check(s) should you show information for?