An HTML attribute potentially worth $4.4M to Chipotle • Hacker News Board

Re: An HTML attribute potentially worth $4.4M to Chipotle

#11

Post by martin-adams » Thu, Sep 26, 2019, 2:52 PM UTC

AndrewStephens wrote: post #10

I hate the way companies try to do custom formatting and validation as you type. It breaks form handling in many different and exciting ways and pretty much ensures that autofill (or even just copy/paste) will fail. If you must do client-side massaging of form data, at least wait until the user has pressed Submit before messing with the form's contents. And don't assume that the keypresses are the only way your input…

When I was a UI tester, one thing that would almost always break these validators was to select some text on the the surrounding page, then drag it into the text box. Right-click paste is another way.

Re: An HTML attribute potentially worth $4.4M to Chipotle

#12

Post by pathartl » Thu, Sep 26, 2019, 2:52 PM UTC

Click bait title. TL;DR: Chipotle is manipulating the year field in CC transactions and expecting a two digit year instead of a four digit, but didn't set a max length on the field.

ALWAYS SANITIZE YOUR INPUTS. When that sanitation is complete, replace what's in the form. You don't always have to sanitize the frontend, but ALWAYS sanitize the backend.

Click bait because there's nothing substantial claiming that this actually resulted in a loss of revenue for Chipotle other than some napkin mathematics. A counter point I would make is that I assume most people don't use CC saving in their browser as everyone seems to make a big stink about it. Additionally I would wonder about the amount of people that would notice their info was correct, but failing, and then go through and manually change the information before submitting again. In this case, they may be more inclined to follow the standard 2 digit year that everyone seems to ask for.

Re: An HTML attribute potentially worth $4.4M to Chipotle

#13

Post by FlipFl0ps » Thu, Sep 26, 2019, 2:54 PM UTC

If there was lost sales from this I would bet it would be related to the error message of failing to save card. I would think more people would leave because of fear of their card being saved.

Re: An HTML attribute potentially worth $4.4M to Chipotle

#14

Post by martin-adams » Thu, Sep 26, 2019, 2:54 PM UTC

This would make an amazing A/B test to get the real data about how much money was in fact lost due to this issue.

Re: An HTML attribute potentially worth $4.4M to Chipotle

#15

Post by edf13 » Thu, Sep 26, 2019, 3:06 PM UTC

pathartl wrote: post #12

Click bait title. TL;DR: Chipotle is manipulating the year field in CC transactions and expecting a two digit year instead of a four digit, but didn't set a max length on the field. ALWAYS SANITIZE YOUR INPUTS. When that sanitation is complete, replace what's in the form. You don't always have to sanitize the frontend, but ALWAYS sanitize the backend. Click bait because there's nothing substantial claiming that this…

Exactly - complete click bait.

Auto fill messes up the entry, people refill manually. This happens all the time on numerous payment forms

Re: An HTML attribute potentially worth $4.4M to Chipotle

#16

Post by vasco » Thu, Sep 26, 2019, 3:07 PM UTC

Thomaschaaf wrote: post #6

I would doubt that it really results in lost orders as people have already invested a lot of time by selecting their food choice and by that time are hungry.

I mean, that it will result in lost orders is almost a fact due to the sheer number of transactions. At scale, all possible events will happpen. So with that in mind the author of the post said he thinks a conservative number is 0.5%. Maybe you think that's lower. The author posited that option and asked how low do you think it can go to make it worth it to fix the form?

Or to put it another way. Estimate how many programmer-hours it takes to fix this issue. With that number calculate the % of people that are likely to abandon the order. Is that % likely to be happening?

Re: An HTML attribute potentially worth $4.4M to Chipotle

#17

Post by recursive » Thu, Sep 26, 2019, 3:09 PM UTC

edf13 wrote: post #15

pathartl wrote: post #12

Click bait title. TL;DR: Chipotle is manipulating the year field in CC transactions and expecting a two digit year instead of a four digit, but didn't set a max length on the field. ALWAYS SANITIZE YOUR INPUTS. When that sanitation is complete, replace what's in the form. You don't always have to sanitize the frontend, but ALWAYS sanitize the backend. Click bait because there's nothing substantial claiming that this…

Exactly - complete click bait. Auto fill messes up the entry, people refill manually. This happens all the time on numerous payment forms

> people refill manually

Only if they suspect that might help. This case doesn't exactly make that clear.

Re: An HTML attribute potentially worth $4.4M to Chipotle

#18

Post by arkitaip » Thu, Sep 26, 2019, 3:10 PM UTC

Thomaschaaf wrote: post #6

I would doubt that it really results in lost orders as people have already invested a lot of time by selecting their food choice and by that time are hungry.

Some 25 years of web usability research has taught us that users are incredibly impatient and will bust out of conversion funnels over the tiniest obstacles like they are the Kool-Aid Man on crack. The conversion rate for most restaurants (e.g. customer places an order) is only 1-3% [0,1].

[0] https://www.blog.shippypro.com/2019/01/27/2019-ecommerce-con...

[1] https://www.growcode.com/blog/ecommerce-conversion-rate/

Re: An HTML attribute potentially worth $4.4M to Chipotle

#19

Post by ng12 » Thu, Sep 26, 2019, 3:11 PM UTC

kayfox wrote: post #2

In the race to use fancier and fancier tools to make web user interfaces go I think we loose out a lot by avoiding the browser's inbuilt support for these things. Like how eBay's new search feature does not allow me to click in it and type in one motion. I have to click, wait for it to redraw without the magnifying glass, and then click again to put the cursor where I wanted it, before editing the query. Or how some…

This has nothing to do with web standards. A developer decided to limit a field which could be either 2 or 4 characters to only 2. They could have used 10 different approaches to do this and they all would be broken for autocomplete and copy/paste.

Re: An HTML attribute potentially worth $4.4M to Chipotle

#20

Post by antsar » Thu, Sep 26, 2019, 3:14 PM UTC

ng12 wrote: post #19

kayfox wrote: post #2

In the race to use fancier and fancier tools to make web user interfaces go I think we loose out a lot by avoiding the browser's inbuilt support for these things. Like how eBay's new search feature does not allow me to click in it and type in one motion. I have to click, wait for it to redraw without the magnifying glass, and then click again to put the cursor where I wanted it, before editing the query. Or how some…

This has nothing to do with web standards. A developer decided to limit a field which could be either 2 or 4 characters to only 2. They could have used 10 different approaches to do this and they all would be broken for autocomplete and copy/paste.

From TFA:

> To test what would happen if Chipotle’s form used these standards, I opened my browser’s developer tools and edited the expiration year field:

> Video of autofill on the Chipotle order form after `maxlength=”2″` has been added using developer tools. It works!

> Adding the maxlength attribute to the field fixes the problem. This makes sense. We’re telling the browser, and by extension the autofill feature, how many digits it should use for the expiration year.

> Autofill is smart enough to know that if we only want two digits for a year field, that the form needs the last two digits of the year. We just need to tell the browser how many digits we expect.