Python’s isdigit() Can Accept More Than 0–9

waldo — Mon, 26 Oct 2026 19:41:21 +0000

A proposed fix can pass a normal example and still violate the requirement. Here is a small Python example you can inspect without installing anything beyond Python.

The requirement is precise: accept a string only if it contains exactly eight characters, all ASCII digits from 0 to 9. Reject every other string. This is an access-code exercise, not a recommendation for designing passwords or authentication systems.

In Challenge 03, a fictional AI assistant proposes this repair:

def valid_code(code):
    return len(code) >= 8 and code.isdigit()

For "12345678", the function returns True. Before accepting the repair, ask two separate questions:

Does it require exactly eight characters?
Does it allow only the ten ASCII digits?

Those questions point to two different defects.

1. “At least eight” is not “exactly eight”

Consider "123456789". Its characters are ordinary ASCII digits, but there are nine of them. The function still returns True because len(code) >= 8 accepts lengths greater than eight.

This example isolates the length requirement. The characters are allowed; the length is wrong.

2. isdigit() is not an ASCII-only check

Now consider "１２３４５６７８". These are eight full-width Unicode digits. They may look familiar, but they are not the ASCII characters in "12345678".

Python’s isdigit() recognizes a broader digit category than this exercise permits. It returns True for that full-width string. The Python documentation describes the method’s Unicode behavior.

Changing >= to == would repair the length check, but the full-width string would still pass. The second defect needs its own repair.

Make each check match a requirement

Here is the corrected answer from the challenge:

def valid_code(code):
    if len(code) != 8:
        return False
    for ch in code:
        if ch not in "0123456789":
            return False
    return True

The first check rejects the wrong length. The loop rejects characters outside the explicit allowed set. The function reaches True only after checking both requirements.

The exercise assumes the input is a string. Converting arbitrary objects to strings would introduce a different requirement; it is not part of this repair.

Check the supplied examples

These are the seven examples already included with the challenge:

Input string	Required result	Proposed repair	Corrected repair
"12345678"	True	True	True
"1234567"	False	False	False
"123456789"	False	True	False
"12 45678"	False	False	False
""	False	False	False
"１２３４５６７８"	False	True	False
"00000000"	True	True	True

The results above were reproduced for this example on CPython 3.12.14. The proposed repair fails two of the seven expectations; the corrected repair matches all seven. That is evidence about these cases, not a claim that every possible behavior of a larger program has been tested.

Notice what the examples tell you. The nine-character string exposes the length defect. The full-width string exposes the character-set defect. The normal and all-zero strings help check that the repair preserves valid behavior. The empty and space-containing strings were already rejected.

Explain why the fix works

The useful habit here is to connect each test to a requirement. Before accepting an AI-generated fix, identify a case that could disprove it. After changing the code, explain the mismatch you removed and rerun the relevant examples.

There is nothing inherently wrong with isdigit(). The problem was using it for a narrower rule than it actually implements.

If you already know basic Python variables, conditions and loops, this is the kind of reasoning you can practise before taking on larger debugging problems.

This example is from my US$9 practice pack, Vibe Coding Python Debugging Kit — Find Bugs, Test AI Fixes & Learn Python. The complete explanation above is free; you do not need the pack to follow it. See the pack and decide whether it fits your practice.