Tuesday, June 19, 2007

Seeing the code rather than the product

Unintentional irony is never a pretty thing.
A feller out on that there interweb started off so strong - people who write books or knowingly put code out in the public domain for learning purposes should hold themselves to a higher standard. Amen to that, brother! And the comments invariably start filling up with other folks linking from reddit.com who just have to whip 'em out and show the guy that they know micro-optimization like nobody's business and never mind missing the writer's point (make your code correct and readable, especially if people who might not know any better are going to be learning from it).
And then I took a look at what exactly the writer was railing against - an example from an AJAX book about how to validate credit card numbers in Javascript.
If you could take a moment from furiously hacking away at that ZX-80 assembler solution to the problem, let's jump to the point so you can get back to it.
The book's suggesting something completely fucking insane - client-side validation of credit card numbers - and the most offensive thing about that is that the code's cribbed poorly from a Wikipedia entry?
Back in high school, one of my computer science professors graded starter programs by the "cat on the keyboard" test - subject to random input, will your program gracefully handle it or will it shit the bed?
Rule number one-or-so of client-server development (and sorry, Web 2.0-aholics; it's still client-server no matter how semantic or semiotic or other big words I don't understand-ic you try to make your app sound) is: never trust client input. Their cat could be walking on the keyboard or, when there's money on the line, they could be trying to game the system. Validation of any critical data has absolutely no place being performed on the client-side. My two cent AJAXy solution? Make a web service you can call to handle the server-side validation and then make your AJAXy call to that service when appropriate to see if the credit card number's valid to give the user the immediate UI response you crave.
Don't get so wrapped up in your code that you lose sight of the product and basic common sense. When the music stops, you don't want to be the guy earnestly deliberating about whether to pound that nail with a shoe or glass bottle.
I still haven't gotten the scuff marks and shards out of my wall.

No comments: