Masking SSNs

posted Sep 13, 2012, 6:49 AM by Eric Patrick


It is now a general requirement to mask social security numbers, typically displaying 'XXX-XX-1234' instead of the full value. QBO 3's FieldAttribute now includes a Mask string that can be used to drive such masking for any field when generating a SQL Select clause.


In Contact.Fields.cs, we now have:

[Field(Mask="'XXX-XX-' + Contact.USSSN4")]
[DataMember(EmitDefaultValue = false)]
public string USSSN
get { return _USSSN; }
set { ... }

which in turn causes the standard Select, SelectBasic, Search, and other statements to produce:

'XXX-XX-' + Contact.USSSN4 AS [USSSN], 

Defining a mask in the application tier simplifies the developer's efforts to ensure that fields such as SSN are only displayed when we intend to display them. Existing XSLTs that already display the calcualted USSSN4 need not be changed.  For example:

<xsl:value-of select="USSSN4"/>

is equivalent to:

<xsl:value-of select="USSSN"/>

Either method can be used.