Explanation on Credit Card Validation Script

Question

I would like to know the explanation for every character used for validating major credit card. I googled and found the following explanations but they're not quite explain it completely (e.g. what does ?: mean? et al)

VISA = ^4[0-9]{12}(?:[0-9]{3})?$

All Visa card numbers start with a 4. New cards have 16 digits. Old cards have 13.

Mastercard = ^5[1-5][0-9]{14}$

All MasterCard numbers start with the numbers 51 through 55. All have 16 digits.

American Express = ^3[47][0-9]{13}$

American Express card numbers start with 34 or 37 and have 15 digits

JCB = ^(?:2131|1800|35\d{3})\d{11}$

JCB cards beginning with 2131 or 1800 have 15 digits. JCB cards beginning with 35 have 16 digits.

Diners Club = ^3(?:0[0-5]|[68][0-9])[0-9]{11}$

Diners Club card numbers begin with 300 through 305, 36 or 38. All have 14 digits. There are Diners Club cards that begin with 5 and have 16 digits. These are a joint venture between Diners Club and MasterCard, and should be processed like a MasterCard.

Answer 1

The rules you have provided don't actually fully validate credit card numbers, they just check for the correct number of digits.

If you really want to validate credit card numbers, you'll need to ensure that the check digit (the last digit) matches the rest of the number according to the Luhn algorithm - more info, and working code in Javascript, is available here. Using the regular expressions you provided, 4000000000000000 is treated as a valid VISA card number but when you check the check digit as well, it isn't.

To explain the regular expressions you provided:

^ means the beginning of the string and $ means the end. These must always be used to anchor your regular expressions, unless you want it to match on a substring of a larger string.

[0-9] means any digit (0 to 9 or anything in between). You could also use \d for this (which one of your other examples does). \d is a special character which means "any digit". There are several other such special characters such as \s which means "any whitespace character".

{12} means repeat the previous letter or bracketed pattern 12 times (no more, no less).

(?: just begins a bracketed pattern. The difference between (?: and ( is that (?: doesn't capture the pattern for retrieval later (using a back reference). None of these examples use back references so (?: is fine (and is usually more efficient).

) ends a bracketed pattern. Bracketed patterns are just for putting multiple letters/patterns into a group.

? means that the previous letter, or bracketed pattern, is optional - it can be present either 0 or 1 times. Incidentally, {0,1} would do the same thing.

The rest is pretty self-explanatory, except for:

[68] which means either 6 or 8. If it had a dash in there, like [6-8], it would mean 6 to 8, which would include 7 as well. But it doesn't, so it excludes 7.

Answer 2

?: means do not capture as part of the matching results (aka capturing group), basically ignore the stuff in this set of parenthesis.

Example:

$matches = array();
$card = '4111123456789012';
if (preg_match('/^4[0-9]{12}([0-9]{3})?$/', $card, $matches)) {
    var_dump($matches);
}
echo "\n";

Output:

array(2) {
  [0]=>
  string(16) "4111123456789012"
  [1]=>
  string(3) "012"
}

vs.

$matches = array();
$card = '4111123456789012';
if (preg_match('/^4[0-9]{12}(?:[0-9]{3})?$/', $card, $matches)) {
    var_dump($matches);
}
echo "\n";

Output:

array(1) {
  [0]=>
  string(16) "4111123456789012"
}

Notice in the second example $matches[1] does not exist? That's because you said (?: ...stuff here...) and don't capture it.

--

In ^4[0-9]{12}(?:[0-9]{3})?$

^ means the start of the string start matching this pattern.

4 the literal string 4

[0-9] a single digit of a 0 to 9, inclusive

{12} is a modifier to the previous character/group. In this case [0-9]{12} means exactly 12 digits

(?: ... stuff ...) explained above

? is a modifier to the previous character/group. In this case (...)? zero or 1 of what is in the parenthesis.

$ denotes the end of the matching string.

--

In ^(?:2131|1800|35\d{3})\d{11}$

| denotes OR, so the string can start with 2131, 1800, OR 35

\d is the same as [0-9]