$CARD_NUM = "123456789012";

echo str_repeat('*', strlen($CARD_NUM) - 4) . substr($CARD_NUM, -4);

​

// or, as DougW suggested in a comment, if the string is NOT guaranteed to be at least 4 digits

// echo str_repeat('*', MAX(4, strlen($CARD_NUM)) - 4) . substr($CARD_NUM, -4);

$string = str_repeat('*', strlen($string));

function hidePassword($p) {

    $fit = strlen($p);

    return sprintf("%'*-${fit}s",false);

}

​

echo hidePassword($p);

$CARD_NUM = "123456789012";

$replacement = '*';

echo preg_replace('/\d(?=\d{4})/m', $replacement, $CARD_NUM);