mask a number and display last 4 but unmask the number upon form submission

[php_begins]

I need to display a number(the number is retrieved from the db) in the form input field such that only the last 4 digits is visbile, the remaining can be masked as * or X or whatever is applicable.

 

I know the last 4 can be obtained as follows:

 

   

$number=substr($number,-4,4);

 

 

But when i hit the submit button the form validates the input field and checks if the number is a valid number of a specific format.

Therefore when I click on the submit button then I should still be able to unmask the masked numbers or do something similar that would help me validate the whole number.

 

 

  <input type="text" name="no" value="<?php if(!empty($number)){ echo $number;} ?>">

[batwimp]

What I have done is put code on your incoming page to check the field for the first (however many) asterisks, and if they are present, NOT update that part of the database.

[php_begins]

But I would still want to update the whole number.

For eg. If i have a number 786661234.

Its should be dispalyed in the form as XXXXX1234.

When I click and submit the form,

it should be decoded and updated in the database as 786661234.

 

[batwimp]

If they want to change the number, they would have to select the whole thing, delete it and input the new number. Then, in the receiving code, it would see that the number doesn't start with '*******' and update the database. If they don't change the number, and leave it as it is, the receiving code will see the '********' and NOT update the database.

 

Or are you just talking about them clicking on the field and having it decode the number and display it to them?

[blacknight]

http://www.php.net/manual/en/function.substr-replace.php#59403

 

that should help you some....

[Psycho]

I think you are going about this the wrong way. If you "display" a number such as "******1234" the only way the form submission can send the whole number would be to send it - either in it's plain text value or using some encryption - most likely in a hidden field. But, users can still see hidden fields if they look at the source of the page. So, using the value in plain text is probably out of the question. And, encrypting/decrypting the value might work, but it is unnecessary work.

 

The solution should be simple. You say you are getting the value from the database. Well, the record that you are retrieving from the database should have a unique ID (separate from the number). Simply set a hidden field in the form with the id of the record that you are getting the number from. Then when the user submits the page, use the ID to lookup the number in the database.

 

If the number IS the unique ID for the record, then another option is to do an MD5() hash of the number and set that as the hidden field value. When the form is submitted you can use that hash to lookup the unhashed number.