On our mobile app's login screen we have three fields, the last of which is used to build up a URL.

Login screen

Since spaces isn't a good idea for the hostname part of a URL the user input must be sanitized before being used.

In my mind we have three options:

  1. Do nothing and allow any input. Try and do your best with what user gives app.
  2. Ignore spaces when pressed on keyboard.
  3. Show error as user types when spaces are found in edit box.

1 is the easiest to build, and user won't even know it is happening. User isn't aware she is typing in a part of a URL, she is typing in a "Company name". (I thought user learning might be a problem, and giving some feedback might be useful, but the typical use case is user enters these values once, and never again.)

2 feels quite strange when using it. You press a key, and nothing happens, nothing turns red, key press just goes away. Not a slick experience.

3 is probably worst of all the options. It makes the user fix a problem she will only understand after reading an error message box, and the spec for fixing the problem is in the error message. (I really hate it when apps do that.)

Any other options that I am missing, or something that could be done better?

More background: This app is by a group of mobile workers that all work for one company. Our company sells the software to their "company" and pick a URL for them (a human does this. Our volumes are still low enough that this is practical). The end users (the mobile workers) then receive username, password and their chosen by us company name. This information is all entered once on log in.

It is on our road map, to change this to the end users' email address. Then there will be no need for the user to select company name. The app will ask a server what URL to go to given the user's email address. This will make the very first thing our end users do with our app a much smoother process.

  • Surely regardless of how you generate the URL you still need to capture the company name with the correct spaces, so options 2 and 3 are not appropriate anyway? Why not allow the user to enter their company name as normal and then just ignore the spaces in the URL?
    – Matt Obee
    Commented Sep 18, 2014 at 10:11
  • 5
    Why not just auto-replace the space with a -? So typing acme builders ltd would come out as acme-builders-ltd?
    – JonW
    Commented Sep 18, 2014 at 10:33
  • 2
    Maybe a bit hard to answer: How much are the users aware of the relation between the input and the URL? Do they know they are generating a URL with the value they type in? And if so, will they try to manipulate the URL with that value?
    – jazZRo
    Commented Sep 18, 2014 at 11:33
  • 2
    Is there a reason the field isn't labeled URL or hostname or something? Does it have to be their company name? Also, if my company is Nathan's Pizzas will you replace the apostrophe as well? Commented Sep 18, 2014 at 13:47
  • 2
    The problem is one level farther back. You're asking for "company name". Many (probably even most) company names have spaces in them. But it seems that you actually want the user to enter their desired hostname. This is a completely different question and you shouldn't assume that it has the same answer or an answer that can be computed from the company name. For example, Microsoft Corporation's website is at microsoft.com, not microsoft-corporation.com (microsoftcorporation.com actually redirects to microsoft.com). Commented Sep 19, 2014 at 8:55

4 Answers 4


Will Company Name be stored in the database with spaces and then a separate URL column will have no spaces?

I would recommend building the URL just below the Company Name as they type so when the user types "Super Duper Acme Co." your app will show:

Your dedicated URL will be: www.superduperacmeco.com

This will cause the user to pay attention and receive immediate feedback and won't be surprised/irritated later.

I am also under the assumption you don't want users creating mix-case URLS

Also, do not forget about other characters which might not be desirable in URLs. Think about "O'Reilly Parts"

Maybe add a required checkbox which states "I accept the formatting of the URL provided"

If there is not enough space then assuming there is a success page I would place:

Congratulations! Your dedicated URL is: www.superduperacmeco.com

  • 12
    Showing a live preview is the way to go. Don't wait until they are done to show the computed URL unless they can easily change it because the owner of "Children's Exchange" is going to be in for an unpleasant surprise. Commented Sep 18, 2014 at 15:24
  • 1
    Excellent point! The right arrow on their current UI does suggest a wizard style process so it would certainly be important to allow them to see and edit the computed URL in the next step. The main takeaway from all this is to keep the user informed and in control and both of those are equally important.
    – MonkeyZeus
    Commented Sep 18, 2014 at 16:39
  • 1
    Also, if they build a live preview just below the Company Name then I wonder what the user's confidence level will be in terms of whether or not they can change it after pressing the right arrow. So the URL builder should be easily editable on that initial screen.
    – MonkeyZeus
    Commented Sep 18, 2014 at 16:43
  • This is a good answer. I like the fact that the user sees what is happening, and can change the URL input as as required. Too bad our users don't really need that feature. They are quite oblivious that it becomes a URL.
    – Diederik
    Commented Sep 19, 2014 at 6:59
  • @Diederik Could you provide more background as to why users of your app are oblivious that their company name is used to create a URL? If they are oblivious or it's such an insignificant part of the app then why is the app making a URL at all? Can the URL assignment be done at a later time when it becomes important to the user?
    – MonkeyZeus
    Commented Sep 19, 2014 at 13:28

I would go with what Microsoft did in this case for entering file names in Windows Explorer (which allows spaces but forbids some special characters).

Windows Explorer showing forbidden characters hint

When the user types any forbidden characters, simply refuse to add it in the input text box (your option 2) then show a helpful balloon hint on the text box like "Spaces and these characters not allowed: $#&%" (for example).

When pasting text that already contains forbidden characters, the characters are removed from the pasted text (the rest is kept). The hint is also displayed in this case (only if such removal happened).

Optionally you can convert spaces (not other forbidden characters) to dashes or underscores if this is typically expected from your users. Doing so makes it easier for them to input the allowed "faux space" character as they simply have to hit space bar instead of finding the - or _ key. In this case, entering space should show "Space converted to dash" (for example) and entering other disallowed characters should show "Characters not allowed: $#&%".

If your restriction is based on certain allowed character ranges only, show that as a hint when any character outside the range is entered. For example: "Only A-Z a-z 0-9 _ - are allowed." (users typically understand a-z to mean the range of alphabets).


Given that you're suggesting a URL based on their company name, you should go with option 1.

In this situation, options 2 and 3 will be very odd.

Create a prototype with option 1, then test it with 5 users (and test other things). Use one, fake company name that you decide for all tests.

  • While your additional points may be useful to the OP, they're not really suited as part of the answer. This site is pretty specific in its focus - a question is asked and all responses are direct answers to that question. The actual answer part of your post is a bit light (you have not provided any reasoning, just said 'use option 1') and the remaining part of your post is unrelated so will be removed. Can you tighten up your post - concentrate on the question asked, give your answer and reasoning for it, and do away with the additional stuff?
    – JonW
    Commented Sep 18, 2014 at 10:35

How will you handle a company name like:

"#'s, ?'s, & ='s, Punctuation & Sons Inc."?

Or users who don't have a company name at all but want to give you money? ;)

Perhaps accept the whole company name (Option #1) for the database, which you'll likely want to have anyway (Would you address support or marketing emails "Dear http://customurl.com"?)

You could assign a random URL to start with (approach used by Flickr, Facebook, StackExchange, etc). That gets them signed up with a working acct faster w/less chance of errors or frustration.

Either on this same login screen, or later in settings, you could use their company name input to display your best guess for a custom URL & then give them the option to edit or accept it. At that point you could have an explicit statement that it can't contain spaces or certain other characters.

This is a bit more work, but ensures you have their a valid co. name and a working URL. This also puts the error-prone part of the process a bit later so it doesn't feel like such an obstacle/hassle. If they don't want a custom URL, they have a functioning acct in the meantime anyway.

  • At least in the UK, punctuation is not actually considered to be part of a company's actual name (the names of companies are entered into the register without punctuation, and two companies are not allowed to have names that differ from each other only by punctuation or spacing). I believe the rules in other countries are generally similar, so I think it's unlikely you'll see an actual company with a name similar to the one you suggest.
    – Jules
    Commented Sep 19, 2014 at 0:32
  • While that (may be, not personally checked but I've no reason to not trust you) is true, I think the point still stands for the examples in MonkeyZEus' answer, "O'Reilly Parts" and "Children's Exchange".
    – TMH
    Commented Sep 19, 2014 at 8:51
  • Similar rule here, but its purpose is to distinguish similar names (e.g. "Bob and Sons" vs. "Bob & Sons!"), not to disallow punctuation. "A&W Root Beer," "Barnes & Noble," and "Yahoo!" for example, are the legal company names of 3 very well-known brands that could break the OP's custom URL plan. Users could input anything, even a typo, or try SQL injection if they wanted to mess around.
    – mc01
    Commented Sep 19, 2014 at 15:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.