Yes - you're right - typo. Should read:
Enter (123) 456-7890, and it's (123) 456-78 that gets stored.
That is, the '90' at the end gets cut off.

But the real insight in your post is here:
The phone number input to the form always shows up in the sql-statement.
Are you sure? Remember you cannot see leading spaces if you are printing the SQL to a webpage unless you check the source.

Must escape tunnel vision - yes, outputting the sql to a browser - check the source - it's not space, it's a little function I forgot about that uses HTML::Entities to convert all non-alphanumeric characters into entities in the input -exactly for the reasons Joost mentioned.

Of course, '(123)' becomes '& # 4 0 ; 1 2 3 & # 4 1 ;', (spaces added to display code) and there go 10 of my alloted 20 characters for enitity codes - and by strange coincidence the input has been concatenated to 9 numbers and a dash.

So it turns out this was the right place to post this - it was my Perl.

Thanks a bunch.