While looking for a mortgage company to refinance his loan, Evgeny Potashnik came across Australian Mortgage Options. They seemed decent enough; they even had an online loan management site. Curious to see what it offered, Evgeny took a peek…
The first thing he was greeted with on their loan service page was a rather peculiar login. Customers are asked to enter their loan number, one digit at a time:
It seemed a bit strange, but Evgeny figured they’d have some JavaScript to automatically move the focus to the next textbox. Nope! But they did, however, put validation for each textbox:
The first box should contain a number. Please try it again... The second box should contain a number. Please try it again... The third box should contain a number. Please try it again... The fourth box should contain a number. Please try it again... The fifth box should contain a number. Please try it again...
As for how they implemented the validation, that can be found in the Funder() function...
function Funder(){ var First,Second,Third,Fourth,Fifth,Sixth,Seventh,Eight,Nineth,Tenth First = parseFloat(document.amo.l1.value); if ((isNaN(document.amo.l1.value)) || (document.amo.l1.value=="")) { alert("The first box should contain a number. Please try it again...") document.amo.l1.focus() return false } Second = parseFloat(document.amo.l2.value); if ((isNaN(document.amo.l2.value)) || (document.amo.l2.value=="")) { alert("The second box should contain a number. Please try it again...") document.amo.l2.focus() return false } ... snip ... Fifth = parseFloat(document.amo.l5.value); if ((isNaN(document.amo.l5.value)) || (document.amo.l5.value=="")) { alert("The fifth box should contain a number. Please try it again...") document.amo.l5.focus() return false } if((document.amo.l1.value=="3") || (document.amo.l1.value=="0")){ document.amo.action="javascript:OpenOLBWindow();" } else { document.amo.action="javascript:doOpen2()" } }
After seeing this, Evgeny decised AMO wasn't the lender for him...