Suppose I am releasing a mobile app and website and make it available to English-speaking and non-English speaking users.
We already support UTF8 encoding throughout our technical stack. However, is allowing user input of the full range of UTF8-expressable characters generally a good policy? And if not, how do people
In particular:
- usernames
- passwords
- user generated comments
may be provided as input characters on one device (via a touchscreen keyboard) and there's a need to render of re-input the same characters on another device.
For example,
A forum post. Here is the Skull and Crossbones character "☠" (UTF 9760). Some third-party Android keyboards provide an easy way to input it, but you may find it renders as a square box in your browser. Generally we may wish to use different fonts on different devices (e.g. different fonts for high ppi devices vs. low ppi devices) and so we run the risk that the user can freely input text on one device (and see it correctly rendered), and that same character is not renderable on the another device in the alternate font (= UX fail). So, it seems sensible to prevent the input of such characters through form validation. If so, how is the set of acceptable characters usually decided? (For example, is there a big list of which characters are available in common web-safe fonts).
In the case of a creating a new password, the Android keyboard invites people to enter the ¥ (yen) character. However, if we allowed them to do this, most US users would be stuck when they come to login to the same service on a PC who's keyboard has no obvious means of entering ¥. Oops - UX fail.
I've lived my life in ASCII. What are the best practices here?