search

globalcitizen / php-iban

Generate, parse, validate, error-correct and present IBAN (and IIBAN) bank account information in PHP.
GNU Lesser General Public License v3.0
475 stars 110 forks source link

CZ IBAN incorect verify_iban #123

Closed Triplkrypl closed 1 year ago

Triplkrypl commented 1 year ago

IBAN verification incorrectly detect empty CZ IBANs.

Problem and specification is describe here: https://github.com/globalcitizen/php-iban/issues/40#issuecomment-1369047264.

// both verify_iban return true but should return false
var_dump(verify_iban('CZ0401000000000000000000'));
var_dump(verify_iban('CZ2501000000000000000010'));

Last ten digits in CZ IBAN must contains at least 2 non zero digits.

Olympic1 commented 1 year ago

According to the calculator that is provided by the Czech National Bank, the first IBAN is valid while the second one is invalid because of a wrong account number.

Triplkrypl commented 1 year ago

First account CZ0401000000000000000000 looks OK, but account number is empty, IBAN can not be reconstruct back. obrazek

globalcitizen commented 1 year ago

Without further investigation, only judging from the screenshot, it looks like that national bank checking interface has been implemented such that a special case input of all zeroes for the account number should be considered invalid.

This is not an IBAN (international) limitation, therefore expecting verify_iban() to catch it is not logical.

If you can find an official statement that all zeroes is disallowed from the Czech authorities, then we could perhaps add it to the national check for CZ. However, in terms of adding this special case, currently for countries we only implement iban_verify_nationalchecksum(). This is done by defining a function _iban_nationalchecksum_implementation_cz. However, I do not like the semantic impact (readability / confusion) of adding a special case exclusion to such a function.

Therefore I think this particular case, even if the special case is considered invalid by Czech authorities, they are a little bit strange for adding special cases, and we should safely consider this to be odd and out of scope for verify_iban().